x4, [0x4000000]}) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080)={0x0, 0xb095, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000180)={0x9, 0x6, 0xc3d, 0x400}) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x323}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x0, 0x6]}}) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x323}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080)={0x0, 0xb095, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x0, 0x6]}}) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x23, 0xa, 0x8) getsockname$llc(r2, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000700)={'\x00', 0xff7f, 0xe79, 0x0, 0x0, 0x0, 0x5000, 0x1, '\x00', 0x80}) ioctl$KVM_GET_TSC_KHZ(0xffffffffffffffff, 0xaea3) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x0, 0x6]}}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x0, 0x6]}}) (async) 16:14:35 executing program 3: io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000080), 0x400001, 0x0) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00000000c0)={0x5, 0x8000}) 16:14:35 executing program 3: io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x23, 0xa, 0x8) getsockname$llc(r2, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000700)={'\x00', 0xff7f, 0xe79, 0x0, 0x0, 0x0, 0x5000, 0x1, '\x00', 0x80}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:35 executing program 3: io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000080), 0x400001, 0x0) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00000000c0)={0x5, 0x8000}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) (async) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000080), 0x400001, 0x0) (async) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00000000c0)={0x5, 0x8000}) (async) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0xb095, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) (async) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000080), 0x400001, 0x0) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00000000c0)={0x5, 0x8000}) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0xb095, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = socket(0x23, 0xa, 0x8) getsockname$llc(r1, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0xb095, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 0: ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x1}) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000000c0)={0x0, 0xfffffff7, 0x3, &(0x7f0000000040)=0x1}) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, &(0x7f0000000100)={0x7fffffff, 0x2, 0x1}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, &(0x7f0000000080)={{0x80000000, 0x0, 0x2}}) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x5c76, 0x0, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 0: ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x1}) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000000c0)={0x0, 0xfffffff7, 0x3, &(0x7f0000000040)=0x1}) (async) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, &(0x7f0000000100)={0x7fffffff, 0x2, 0x1}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, &(0x7f0000000080)={{0x80000000, 0x0, 0x2}}) 16:14:35 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:35 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket(0x23, 0xa, 0x8) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x5c76, 0x0, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(0xffffffffffffffff, 0x5, 0x0, 0x0) 16:14:35 executing program 0: ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x1}) (async) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x1}) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000000c0)={0x0, 0xfffffff7, 0x3, &(0x7f0000000040)=0x1}) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, &(0x7f0000000100)={0x7fffffff, 0x2, 0x1}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, &(0x7f0000000080)={{0x80000000, 0x0, 0x2}}) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x5c76, 0x0, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(0xffffffffffffffff, 0x5, 0x0, 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000080)=[{0x80000000, 0x0}, {0x80000000}], &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x10000000, 0x800000]}, {0x80000000, r1}, 0x1, [0x80000000]}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f00000001c0)}) 16:14:35 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:35 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:35 executing program 2: syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(0xffffffffffffffff, 0x5, 0x0, 0x0) 16:14:35 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000080)=[{0x80000000, 0x0}, {0x80000000}], &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x10000000, 0x800000]}, {0x80000000, r1}, 0x1, [0x80000000]}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f00000001c0)}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000080), &(0x7f00000000c0)}) (async) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x10000000, 0x800000]}, {0x80000000, r1}, 0x1, [0x80000000]}) (async) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) (async) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f00000001c0)}) (async) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000080)=[{0x80000000, 0x0}, {0x80000000}], &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x10000000, 0x800000]}, {0x80000000, r1}, 0x1, [0x80000000]}) (async) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x10000000, 0x800000]}, {0x80000000, r1}, 0x1, [0x80000000]}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f00000001c0)}) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 2: syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(0xffffffffffffffff, 0x5, 0x0, 0x0) 16:14:36 executing program 1: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) getsockname$llc(r0, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000002c0)=0x10) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xa4, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x3, 0x10001, 0x80000001, 0x85]}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x78a73492, 0x7f, 0xfffffffd, 0x6, 0xfb9c]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x4, 0xfff, 0x80, 0x80000001]}, @SEG6_ATTR_DST={0x14, 0x1, @private0}, @SEG6_ATTR_DST={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20000050}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0xfffffd12, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc000004}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000041}, 0x800) r3 = syz_open_dev$media(&(0x7f0000000000), 0xffffff08, 0x2) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0x2, &(0x7f0000000040)) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 1: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_EVENTFD(0xffffffffffffffff, 0x5, 0x0, 0x0) 16:14:36 executing program 1: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 0: r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) getsockname$llc(r0, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000002c0)=0x10) (async, rerun: 64) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) (async) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xa4, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x3, 0x10001, 0x80000001, 0x85]}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x78a73492, 0x7f, 0xfffffffd, 0x6, 0xfb9c]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x4, 0xfff, 0x80, 0x80000001]}, @SEG6_ATTR_DST={0x14, 0x1, @private0}, @SEG6_ATTR_DST={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20000050}, 0x0) (async, rerun: 64) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0xfffffd12, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc000004}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000041}, 0x800) (async) r3 = syz_open_dev$media(&(0x7f0000000000), 0xffffff08, 0x2) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0x2, &(0x7f0000000040)) 16:14:36 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_io_uring_setup(0x151b, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 0: r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) getsockname$llc(r0, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000002c0)=0x10) (async) getsockname$llc(r0, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000002c0)=0x10) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xa4, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x3, 0x10001, 0x80000001, 0x85]}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x78a73492, 0x7f, 0xfffffffd, 0x6, 0xfb9c]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x4, 0xfff, 0x80, 0x80000001]}, @SEG6_ATTR_DST={0x14, 0x1, @private0}, @SEG6_ATTR_DST={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20000050}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0xfffffd12, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc000004}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000041}, 0x800) (async) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc000004}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000041}, 0x800) r3 = syz_open_dev$media(&(0x7f0000000000), 0xffffff08, 0x2) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0x2, &(0x7f0000000040)) 16:14:36 executing program 1: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000000080)) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x23, 0xa, 0x8) getsockname$llc(r2, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000700)={'\x00', 0xff7f, 0xe79, 0x0, 0x0, 0x0, 0x5000, 0x1, '\x00', 0x80}) ioctl$KVM_GET_TSC_KHZ(0xffffffffffffffff, 0xaea3) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) (async, rerun: 64) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) (async, rerun: 32) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000000080)) (rerun: 32) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x23, 0xa, 0x8) getsockname$llc(r2, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000700)={'\x00', 0xff7f, 0xe79, 0x0, 0x0, 0x0, 0x5000, 0x1, '\x00', 0x80}) ioctl$KVM_GET_TSC_KHZ(0xffffffffffffffff, 0xaea3) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) (async) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000000080)) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = semget$private(0x0, 0x1, 0x0) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f00000001c0)=""/243) semctl$IPC_RMID(r0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000080), &(0x7f00000000c0)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, &(0x7f0000000040)={{}, {0x80000000, r2, 0x0, [0x9]}}) 16:14:36 executing program 3: syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 3: syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 0: r0 = semget$private(0x0, 0x1, 0x0) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f00000001c0)=""/243) (async) semctl$IPC_RMID(r0, 0x0, 0x0) (async) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000080), &(0x7f00000000c0)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, &(0x7f0000000040)={{}, {0x80000000, r2, 0x0, [0x9]}}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x23, 0xa, 0x8) getsockname$llc(r2, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000700)={'\x00', 0xff7f, 0xe79, 0x0, 0x0, 0x0, 0x5000, 0x1, '\x00', 0x80}) ioctl$KVM_GET_TSC_KHZ(0xffffffffffffffff, 0xaea3) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 0: r0 = semget$private(0x0, 0x1, 0x0) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f00000001c0)=""/243) (async) semctl$IPC_RMID(r0, 0x0, 0x0) (async) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000080), &(0x7f00000000c0)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, &(0x7f0000000040)={{}, {0x80000000, r2, 0x0, [0x9]}}) 16:14:36 executing program 3: syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000180)={0x0, 0x5, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000480), 0x7, 0x0, &(0x7f0000000740)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f0000000040)=[{}]}) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)=@getstat={0xe0, 0x15, 0x800, 0x70bd27, 0x25dfdbff, {{'drbg_pr_sha256\x00'}, '\x00', '\x00', 0x400, 0x400}, ["", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x91}, 0x40040) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000080)={{}, {r2, r4}, 0x0, [0xfffffffc]}) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000006c0)={0x0, 0x8, 0x0, &(0x7f0000000840)=[{}, {}, {}, {}, {0x80000000}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000b40)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}], 0x2, 0x0, &(0x7f0000000640)=[{}, {}]}) r6 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000240)={r7, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000012c0)={0x0, 0x3, 0x0, &(0x7f0000000d00)=[{}, {}, {}], 0x6, 0x0, &(0x7f0000000e40)=[{}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000001100)=[{0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}], 0x7, 0x0, &(0x7f0000001180)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000001340)={{r5, r3, 0x5, [0x58, 0x180]}, {r7, r8, 0x0, [0x80, 0x1ff]}, 0x4, [0x0, 0x8001]}) getegid() 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x23, 0xa, 0x8) getsockname$llc(r2, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000700)={'\x00', 0xff7f, 0xe79, 0x0, 0x0, 0x0, 0x5000, 0x1, '\x00', 0x80}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000180)={0x0, 0x5, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000480), 0x7, 0x0, &(0x7f0000000740)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f0000000040)=[{}]}) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)=@getstat={0xe0, 0x15, 0x800, 0x70bd27, 0x25dfdbff, {{'drbg_pr_sha256\x00'}, '\x00', '\x00', 0x400, 0x400}, ["", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x91}, 0x40040) (async, rerun: 64) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000080)={{}, {r2, r4}, 0x0, [0xfffffffc]}) (rerun: 64) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000006c0)={0x0, 0x8, 0x0, &(0x7f0000000840)=[{}, {}, {}, {}, {0x80000000}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000b40)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}], 0x2, 0x0, &(0x7f0000000640)=[{}, {}]}) r6 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000240)={r7, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000012c0)={0x0, 0x3, 0x0, &(0x7f0000000d00)=[{}, {}, {}], 0x6, 0x0, &(0x7f0000000e40)=[{}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000001100)=[{0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}], 0x7, 0x0, &(0x7f0000001180)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000001340)={{r5, r3, 0x5, [0x58, 0x180]}, {r7, r8, 0x0, [0x80, 0x1ff]}, 0x4, [0x0, 0x8001]}) (async, rerun: 64) getegid() (rerun: 64) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, 0x0, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, 0x0, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = socket(0x23, 0xa, 0x8) getsockname$llc(r1, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) (async, rerun: 64) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000180)={0x0, 0x5, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000480), 0x7, 0x0, &(0x7f0000000740)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f0000000040)=[{}]}) (async, rerun: 64) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)=@getstat={0xe0, 0x15, 0x800, 0x70bd27, 0x25dfdbff, {{'drbg_pr_sha256\x00'}, '\x00', '\x00', 0x400, 0x400}, ["", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x91}, 0x40040) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000080)={{}, {r2, r4}, 0x0, [0xfffffffc]}) (async) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000006c0)={0x0, 0x8, 0x0, &(0x7f0000000840)=[{}, {}, {}, {}, {0x80000000}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000b40)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}], 0x2, 0x0, &(0x7f0000000640)=[{}, {}]}) (async, rerun: 64) r6 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (rerun: 64) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000240)={r7, 0x0, 0x0}) (async, rerun: 64) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000012c0)={0x0, 0x3, 0x0, &(0x7f0000000d00)=[{}, {}, {}], 0x6, 0x0, &(0x7f0000000e40)=[{}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000001100)=[{0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}], 0x7, 0x0, &(0x7f0000001180)=[{}, {}, {}, {}, {}, {}, {}]}) (rerun: 64) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000001340)={{r5, r3, 0x5, [0x58, 0x180]}, {r7, r8, 0x0, [0x80, 0x1ff]}, 0x4, [0x0, 0x8001]}) (async) getegid() 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, 0x0, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket(0x23, 0xa, 0x8) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x4]}}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = socket(0x23, 0xa, 0x8) getsockname$llc(r1, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x4]}}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x4]}}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x0, [0x4]}}) (async) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = socket(0x23, 0xa, 0x8) getsockname$llc(r1, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = socket(0x23, 0xa, 0x8) getsockname$llc(r1, &(0x7f00000004c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000500)=0x10) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_io_uring_setup(0x5c76, &(0x7f0000000080)={0x0, 0xb095, 0x0, 0x3, 0x355}, &(0x7f0000000100), &(0x7f0000000140)) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000180)={0x9, 0x6, 0xc3d, 0x400}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200), 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket(0x23, 0xa, 0x8) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0xffffffff, 0x0) socket(0x2a, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0xffffffff, 0x0) socket(0x2a, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:36 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0xffffffff, 0x0) socket(0x2a, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0xffffffff, 0x0) socket(0x2a, 0x0, 0x0) 16:14:36 executing program 3: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0xffffffff, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 0: syz_open_dev$media(0x0, 0xffffffff, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 0: syz_open_dev$media(0x0, 0xffffffff, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 0: syz_open_dev$media(0x0, 0xffffffff, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:36 executing program 3: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:36 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket(0x23, 0xa, 0x8) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket(0x23, 0xa, 0x8) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket(0x23, 0xa, 0x8) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000680)={0x0, 0xffffffffffffffab, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:36 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.188116][T16090] can: request_module (can-proto-0) failed. 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.231155][T16109] can: request_module (can-proto-0) failed. 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x7, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.271036][T16126] can: request_module (can-proto-0) failed. 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.311927][T16144] can: request_module (can-proto-0) failed. 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.347342][T16158] can: request_module (can-proto-0) failed. 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:14:37 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) [ 350.388404][T16174] can: request_module (can-proto-0) failed. 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.432441][T16189] can: request_module (can-proto-0) failed. [ 350.432507][T16192] can: request_module (can-proto-0) failed. 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) [ 350.467147][T16206] can: request_module (can-proto-0) failed. 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) [ 350.472873][T16202] can: request_module (can-proto-0) failed. 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc010) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket(0x1d, 0x800, 0x0) setsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f0000000000)=0x8, 0x4) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:37 executing program 3: socket(0x1d, 0x800, 0x0) 16:14:37 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:37 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 2: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 3: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 3: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 2: socket(0x1d, 0x800, 0x0) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 2: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 3: socket(0x0, 0x800, 0x0) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 0: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 2: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 3: socket(0x1d, 0x0, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x0, 0x800, 0x0) 16:14:38 executing program 2: socket(0x0, 0x800, 0x0) 16:14:38 executing program 0: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000680)={0x0, 0x2, 0x0, &(0x7f0000000080)=[{}, {}], 0x8, 0x0, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f00000004c0), 0x6, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 16:14:38 executing program 2: socket(0x1d, 0x0, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x0, 0x800, 0x0) 16:14:38 executing program 0: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1d, 0x800, 0x0) 16:14:38 executing program 0: socket(0x1d, 0x800, 0x0) 16:14:38 executing program 2: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000040)) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x0, 0x800, 0x0) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x0, 0x800, 0x0) 16:14:38 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x301000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000140)={0x80, 0x5, 0x0, 0x0, 0xffffffffffffffff}) r8 = socket(0x28, 0x3, 0xbb1) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f00000001c0)=[r8, r7], 0x2) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f0000000080)={0x4, 0x9, [{0x0, 0x0, 0x6f3}, {0x32d, 0x0, 0x1f}, {0x1f, 0x0, 0xccc}, {0x9, 0x0, 0x6a8}]}) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x0, 0x0) 16:14:38 executing program 0: socket(0x0, 0x800, 0x0) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x0, 0x800, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) 16:14:38 executing program 0: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x0, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x0, 0x800, 0x0) 16:14:38 executing program 0: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x0, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x0, 0x800, 0x0) 16:14:38 executing program 0: socket(0x1d, 0x0, 0x0) 16:14:38 executing program 1: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socket(0x1d, 0x0, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 2: io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 3: socket(0x0, 0x800, 0x0) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r4, 0xc02864ca, &(0x7f0000000140)={&(0x7f00000000c0)=[0x0, 0x0, r2, r3], &(0x7f0000000100)=[0x5], 0x3, 0x4, 0x4}) 16:14:38 executing program 0: r0 = io_uring_setup(0x12f9, &(0x7f0000000040)={0x0, 0xcccb, 0x80, 0x0, 0x2e}) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, 0x0) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = memfd_create(&(0x7f00000000c0)='}\x00', 0x1) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000100)=[r0, r0, r4, r5, r1, r6, r7, r8], 0x8) 16:14:38 executing program 2: io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 2: io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 1: r0 = io_uring_setup(0x12f9, &(0x7f0000000040)={0x0, 0xcccb, 0x80, 0x0, 0x2e}) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, 0x0) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = memfd_create(&(0x7f00000000c0)='}\x00', 0x1) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000100)=[r0, r0, r4, r5, r1, r6, r7, r8], 0x8) 16:14:38 executing program 3: socket(0x0, 0x800, 0x0) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000840)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, &(0x7f0000000640), 0x7, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000001040)={0x0, 0x7, 0x0, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}, {}], 0x76, 0x0, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000f00)=[{}, {}], 0x5, 0x0, &(0x7f0000000f40)=[{}, {}, {}, {}, {}]}) r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_FPU(r9, 0x81a0ae8c, &(0x7f0000000500)) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000180)={0x0, 0xa, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000800)=[{}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}], 0x5, 0x0, &(0x7f0000000900)=[{}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000e80)={0x0, 0x2, 0x0, &(0x7f0000000a00)=[{}, {0x80000000}], 0x4, 0x0, &(0x7f0000000ac0)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000c80)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) r6 = syz_open_dev$media(&(0x7f0000000200), 0x10001, 0x400000) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0x2, &(0x7f0000000040)={{r5, r3, 0x0, [0x0, 0x9]}, {r2, r4, 0x7}, 0x2, [0x10000004]}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(0xffffffffffffffff, 0x13, &(0x7f0000000080)=[0x1, 0x8], 0x2) 16:14:38 executing program 3: socket(0x0, 0x800, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff}) r11 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x4000, 0x2000}) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000001c0)=[r9, r10, r11, r6], 0x4) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000840)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, &(0x7f0000000640), 0x7, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000001040)={0x0, 0x7, 0x0, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}, {}], 0x76, 0x0, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000f00)=[{}, {}], 0x5, 0x0, &(0x7f0000000f40)=[{}, {}, {}, {}, {}]}) r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_FPU(r9, 0x81a0ae8c, &(0x7f0000000500)) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x38bb, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000840)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, &(0x7f0000000640), 0x7, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000001040)={0x0, 0x7, 0x0, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}, {}], 0x76, 0x0, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000f00)=[{}, {}], 0x5, 0x0, &(0x7f0000000f40)=[{}, {}, {}, {}, {}]}) r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_FPU(r9, 0x81a0ae8c, &(0x7f0000000500)) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x0, 0x0, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000840)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, &(0x7f0000000640), 0x7, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000001040)={0x0, 0x7, 0x0, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}, {}], 0x76, 0x0, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000f00)=[{}, {}], 0x5, 0x0, &(0x7f0000000f40)=[{}, {}, {}, {}, {}]}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff}) r11 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x4000, 0x2000}) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000001c0)=[r9, r10, r11, r6], 0x4) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x0, 0x0, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000840)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, &(0x7f0000000640), 0x7, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000001040)={0x0, 0x7, 0x0, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}, {}], 0x76, 0x0, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000f00)=[{}, {}], 0x5, 0x0, &(0x7f0000000f40)=[{}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x0, 0x800, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000840)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, &(0x7f0000000640), 0x7, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) socket(0x0, 0x0, 0x0) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r7, 0x3ba0, &(0x7f0000001100)={0x38, 0x7, r8, 0x0, 0x1, 0x0, 0x3, 0xd29}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000010c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff}) r11 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x4000, 0x2000}) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000001c0)=[r9, r10, r11, r6], 0x4) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) ioctl$KVM_NMI(r2, 0xae9a) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_GET_XCRS(r6, 0x8188aea6, &(0x7f0000000280)={0x2, 0x8000, [{0x7, 0x0, 0xfffffffffffffffc}, {0x6, 0x0, 0xffffffffffff7fff}]}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) ioctl$KVM_NMI(r2, 0xae9a) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_GET_XCRS(r6, 0x8188aea6, &(0x7f0000000280)={0x2, 0x8000, [{0x7, 0x0, 0xfffffffffffffffc}, {0x6, 0x0, 0xffffffffffff7fff}]}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38}) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x4000, 0x2000}) 16:14:38 executing program 2: io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) r5 = socket(0x2c, 0x80000, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f00000011c0)={0x110, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe37}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2000005}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d2cc978}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2d}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9c64}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x40041) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) ioctl$KVM_NMI(r2, 0xae9a) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_GET_XCRS(r6, 0x8188aea6, &(0x7f0000000280)={0x2, 0x8000, [{0x7, 0x0, 0xfffffffffffffffc}, {0x6, 0x0, 0xffffffffffff7fff}]}) 16:14:38 executing program 2: io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) socket(0x2c, 0x80000, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) socket(0x2c, 0x80000, 0x1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) ioctl$KVM_NMI(r2, 0xae9a) openat$binder_debug(0xffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) ioctl$KVM_NMI(r2, 0xae9a) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r4, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}], 0x8) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}], 0x7) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r3, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}], 0x6) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r3, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}], 0x5) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {r3, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) r5 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}], 0x4) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r3, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r2, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) r4 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}], 0x3) 16:14:38 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r3, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:38 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r2, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r3, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:38 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}], 0x2) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}], 0x1) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r2, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r3 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r3, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r2, 0x0, 0x0, 0x0, 0x7, 0x400a}) r3 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r3, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80), 0x0) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80), 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80), 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}], 0x1) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x0, 0x0, 0x0, 0x0, 0x0}], 0x1) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(0x0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}], 0x1) 16:14:39 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(0x0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(0x0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80), 0x0) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x2, [0x40, 0x9]}, {r1, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) 16:14:39 executing program 2: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x0, [0x40, 0x9]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, 0x0, 0x0, [0x40]}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) 16:14:39 executing program 3: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2, 0x0, 0x0, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r2, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2, 0x0, 0x0, [0xfff]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0x0, "734e6429a7b0"}) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$iommufd(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000200)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x7, 0x400a}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x9, 0x2, 0x2}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@x={0x94, 0xd, "734e6429a7b0"}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2}, 0x0, [0x4600000, 0x7fff]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r2, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2}, 0x0, [0x4600000]}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000001140), &(0x7f0000001180)=0x4) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{0x80000000, r2, 0x2, [0x40, 0x9]}, {0x80000000, 0x0, 0x2, [0xfff, 0x6]}, 0x4, [0x4600000, 0x7fff]}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000008c0)={{}, {r2}}) 16:14:39 executing program 3: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 2: r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, 0x0) 16:14:39 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38}) 16:14:39 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r1, 0x0, 0x1}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38}) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:39 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 2: r0 = io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:39 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38}) 16:14:39 executing program 0: r0 = io_uring_setup(0x7025, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1b8}) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, &(0x7f0000003d80)=[{0x9, 0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000140)=""/160, 0xa0}, {&(0x7f0000000200)=""/121, 0x79}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/216, 0xd8}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/210, 0xd2}], &(0x7f00000016c0)=[0x80, 0x8000000000000000, 0x0]}, {0x1, 0x1, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)=""/150, 0x96}], &(0x7f0000001800)=[0x3, 0xfffffffffffffffa, 0x6]}, {0x4, 0x1, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001840)=""/83, 0x53}, {&(0x7f00000018c0)=""/12, 0xc}, {&(0x7f0000001900)=""/126, 0x7e}, {&(0x7f0000001980)=""/248, 0xf8}], &(0x7f0000001ac0)=[0x2, 0x4, 0x81]}, {0x1, 0x1, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/89, 0x59}], &(0x7f0000001bc0)=[0x0, 0x9, 0xffffffffffffff01, 0x1f, 0x81, 0x7fff]}, {0x8, 0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001c00)=""/230, 0xe6}, {&(0x7f0000001d00)=""/127, 0x7f}, {&(0x7f0000001d80)=""/24, 0x18}, {&(0x7f0000001dc0)=""/32, 0x20}, {&(0x7f0000001e00)=""/4, 0x4}, {&(0x7f0000001e40)=""/152, 0x98}, {&(0x7f0000001f00)=""/63, 0x3f}, {&(0x7f0000001f40)=""/19, 0x13}], &(0x7f0000001fc0)=[0x7fff, 0x4, 0x8]}, {0x4, 0x1, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002000)=""/52, 0x34}, {&(0x7f0000002040)=""/74, 0x4a}, {&(0x7f00000020c0)=""/88, 0x58}, {&(0x7f0000002140)=""/83, 0x53}], &(0x7f0000002200)=[0x8, 0x1f, 0xffffffffffffffff, 0x81, 0x0, 0x8000, 0x5, 0x2]}, {0x7, 0x1, 0x0, &(0x7f0000003740)=[{&(0x7f0000002240)=""/50, 0x32}, {&(0x7f0000002280)=""/245, 0xf5}, {&(0x7f0000002380)=""/227, 0xe3}, {&(0x7f0000002480)=""/4096, 0x1000}, {&(0x7f0000003480)=""/142, 0x8e}, {&(0x7f0000003540)=""/201, 0xc9}, {&(0x7f0000003640)=""/205, 0xcd}], &(0x7f0000003780)=[0xffffffffffffb442, 0xfffffffffffffffa, 0x7, 0x8, 0x3, 0x3, 0x1ff, 0x8001]}, {0x4, 0x1, 0x0, &(0x7f0000003a80)=[{&(0x7f00000037c0)=""/48, 0x30}, {&(0x7f0000003800)=""/190, 0xbe}, {&(0x7f00000038c0)=""/132, 0x84}, {&(0x7f0000003980)=""/224, 0xe0}], &(0x7f0000003ac0)}, {0x2, 0x1, 0x0, &(0x7f0000003d00)=[{&(0x7f0000003b00)=""/225, 0xe1}, {&(0x7f0000003c00)=""/209, 0xd1}], &(0x7f0000003d40)=[0xff, 0x9]}], 0x9) 16:14:39 executing program 2: io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, 0x0, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000004c0)={0x0, 0x8, 0x0, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000340)=[{}], 0x3, 0x0, &(0x7f00000003c0)=[{}, {}, {}], 0x3, 0x0, &(0x7f0000000440)=[{}, {}, {}]}) 16:14:39 executing program 2: io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, 0x0, 0x0) 16:14:39 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000004c0)={0x0, 0x8, 0x0, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000340)=[{}], 0x3, 0x0, &(0x7f00000003c0)=[{}, {}, {}], 0x3, 0x0, &(0x7f0000000440)=[{}, {}, {}]}) 16:14:39 executing program 2: io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, 0x0, 0x0) 16:14:39 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000000c0)={0x38}) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000004c0)={0x0, 0x8, 0x0, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000340)=[{}], 0x3, 0x0, &(0x7f00000003c0)=[{}, {}, {}], 0x3, 0x0, &(0x7f0000000440)=[{}, {}, {}]}) 16:14:39 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 16:14:39 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:39 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:39 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) 16:14:39 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:40 executing program 2: r0 = io_uring_setup(0x7025, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x100, 0x519000) 16:14:40 executing program 2: r0 = io_uring_setup(0x7025, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:40 executing program 2: r0 = io_uring_setup(0x7025, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r0, 0x14, 0x0, 0x0) 16:14:40 executing program 0: syz_open_dev$media(0x0, 0x100, 0x519000) 16:14:40 executing program 0: syz_open_dev$media(0x0, 0x100, 0x519000) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, 0x0, 0x0) 16:14:40 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: syz_open_dev$media(0x0, 0x100, 0x519000) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x519000) 16:14:40 executing program 2: io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, 0x0, 0x0) 16:14:40 executing program 2: io_uring_setup(0x7025, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, 0x0, 0x0) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:40 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0xf96, 0x101080) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r2) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r3, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r4, 0x20, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x35}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x54}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x22}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000854) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff}, 0x80080) r6 = openat$nci(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0x800400, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@nodevmap}], [{@fsmagic={'fsmagic', 0x3d, 0xb1}}]}}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000100)={0x0, 0x0, r2}) r7 = syz_open_dev$media(&(0x7f0000000080), 0x1000, 0x100) ioctl$MEDIA_IOC_SETUP_LINK(r7, 0x541b, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0xc00) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000080), &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f0000000880)={0x0, 0x8, 0x0, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000480)=[{}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f00000007c0)=[{}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}], 0x1, 0x0, &(0x7f0000000840)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000900)={{r2, r3, 0x6, [0xa7ee, 0x1]}, {0x80000000, 0x0, 0x4, [0x2, 0x49b2]}, 0x10000000, [0x81, 0x1f]}) 16:14:40 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000040)={[0x5000, 0x5000, 0x1, 0x4000], 0x7, 0x40, 0x800}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{}, {}, 0x0, [0x1000000]}) 16:14:40 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000440)={0x0, 0x1, 0x0, &(0x7f0000000040)=[{}], 0x5, 0x0, &(0x7f00000004c0)=[{}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000300), 0x6, 0x0, &(0x7f0000000340)=[{}, {}, {}, {}, {}, {}]}) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) r2 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r2, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 1: socketpair(0x0, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000440)={0x0, 0x1, 0x0, &(0x7f0000000040)=[{}], 0x5, 0x0, &(0x7f00000004c0)=[{}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000300), 0x6, 0x0, &(0x7f0000000340)=[{}, {}, {}, {}, {}, {}]}) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) r2 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r2, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) r2 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r2, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 1: socketpair(0x0, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000440)={0x0, 0x1, 0x0, &(0x7f0000000040)=[{}], 0x5, 0x0, &(0x7f00000004c0)=[{}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000300), 0x6, 0x0, &(0x7f0000000340)=[{}, {}, {}, {}, {}, {}]}) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) read$msr(0xffffffffffffffff, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:40 executing program 1: socketpair(0x0, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) read$msr(0xffffffffffffffff, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r0) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) read$msr(0xffffffffffffffff, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)) 16:14:40 executing program 1: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={0x80000000, 0x0, 0x0}) r2 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r2, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r1, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 2: socketpair(0x2b, 0x2, 0x1, &(0x7f0000000100)) 16:14:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r1, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 2: socketpair(0x0, 0x2, 0x1, &(0x7f0000000100)) 16:14:40 executing program 1: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r0, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x0, 0x2, 0x1, &(0x7f0000000100)) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x3, 0x0) read$msr(r0, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(0x0, 0x3, 0x0) read$msr(r0, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 1: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x0, 0x2, 0x1, &(0x7f0000000100)) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(0x0, 0x3, 0x0) read$msr(r0, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(0x0, 0x3, 0x0) read$msr(r0, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x1, &(0x7f0000000100)) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000100)) 16:14:40 executing program 0: syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000100)) 16:14:40 executing program 0: syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000100)) 16:14:40 executing program 0: syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f00000001c0)=""/121, 0x79) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x9, 0x0) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x1, 0x0) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x9, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x1, 0x0) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 1: socketpair(0x2, 0x5, 0x9, 0x0) 16:14:40 executing program 0: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 2: socketpair(0x2b, 0x0, 0x1, 0x0) 16:14:40 executing program 1: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 1: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 1: r0 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 0: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 1: read$msr(0xffffffffffffffff, 0x0, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: read$msr(0xffffffffffffffff, 0x0, 0x0) 16:14:40 executing program 0: socketpair(0x0, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: read$msr(0xffffffffffffffff, 0x0, 0x0) 16:14:40 executing program 0: socketpair(0x0, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 1: r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 2: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x0, 0x5, 0x0, &(0x7f0000000040)) 16:14:40 executing program 1: r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, 0x0, 0x0) 16:14:40 executing program 1: syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x0, 0x0, &(0x7f0000000040)) 16:14:40 executing program 1: syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) 16:14:40 executing program 2: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) 16:14:40 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r3, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000080)={0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x101280) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r2, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x0, 0x0, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x0, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 2: socketpair(0x0, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x0, 0x0, &(0x7f0000000040)) 16:14:40 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r1, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r2, 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x9, 0x40, 0xffff, 0x80, 0xffffffffffff0655, 0xffffffff, 0x0], 0x3}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x34, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xffff}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x3}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x4004) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f0000000c40)={0x0, 0x5, 0x0, &(0x7f00000005c0)=[{}, {}, {}, {0x80000000}, {}], 0x6, 0x0, &(0x7f00000007c0)=[{}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000a80)=[{}, {}, {}], 0x8, 0x0, &(0x7f0000000b00)=[{}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000cc0)={{r3, 0x0, 0x2, [0x8, 0xf8e]}, {0x80000000, 0x0, 0x4, [0xce, 0x4]}, 0x2, [0x81, 0x8d]}) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, 0x0) ioctl$SNDCTL_SYNTH_ID(r1, 0xc08c5114, &(0x7f0000000500)={"b8f5381d5cc0d3cee0ea7d7db17dd8749f9c5103dfa5af6e1e37774e3eb4", 0x54, 0x3, 0x401, 0x9a, 0x4, 0x7f, 0x2, 0x4, [0x401, 0x4, 0xfffffe01, 0x8ce, 0x18ed, 0x95, 0x0, 0x7, 0x2, 0x0, 0x6, 0x6, 0xce, 0x5, 0x3, 0x800, 0x5, 0x200, 0xdc2]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000480)={0x0, 0x5, 0x0, &(0x7f0000000040)=[{}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000240)=[{}, {}], 0x2, 0x0, &(0x7f0000000340)=[{}, {}], 0x5, 0x0, &(0x7f0000000380)=[{}, {}, {}, {}, {}]}) 16:14:40 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_TSC_KHZ(r2, 0xaea3) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x8) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(r2, 0x4068aea3, &(0x7f0000000080)) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000240)={0x0, 0x1, r4}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r5, 0xc00864c0, &(0x7f0000000280)={r6}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f00000001c0)={0x60002, 0x0, [0x903f, 0x80, 0x69, 0x6, 0x5, 0x2, 0x0, 0x5]}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r3, 0xc02064cc, &(0x7f0000000180)={r7, r8, 0x0, 0x52c, 0x2}) 16:14:40 executing program 2: socketpair(0x0, 0x0, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x5, 0x0, 0x0) 16:14:40 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000340)={0x38, 0x7, r1, 0x0, 0x1}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:40 executing program 0: socketpair(0x2, 0x5, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={r4, &(0x7f0000000080), &(0x7f00000000c0)}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: socketpair(0x2, 0x0, 0x0, &(0x7f0000000040)) 16:14:41 executing program 0: socketpair(0x2, 0x5, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={r4, &(0x7f0000000080), &(0x7f00000000c0)}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000002c0)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x636136028bc7f46a}) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = socket(0x23, 0x1, 0x6) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000280)={0x80000000, &(0x7f00000001c0), &(0x7f0000000200)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f00000002c0)={{0x80000000, 0x0, 0x5, [0x34527720, 0x5]}, {0x80000000, r3, 0x0, [0x5, 0x5]}, 0x0, [0x7fffffff, 0x5]}) sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x80, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x10001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffc}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000010}, 0x8804) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={r4, &(0x7f0000000080), &(0x7f00000000c0)}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: socketpair(0x2, 0x0, 0x0, 0x0) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = socket(0x23, 0x1, 0x6) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000280)={0x80000000, &(0x7f00000001c0), &(0x7f0000000200)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f00000002c0)={{0x80000000, 0x0, 0x5, [0x34527720, 0x5]}, {0x80000000, r3, 0x0, [0x5, 0x5]}, 0x0, [0x7fffffff, 0x5]}) sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x80, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x10001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffc}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000010}, 0x8804) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000240)={r4, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: socketpair(0x2, 0x0, 0x0, 0x0) 16:14:41 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: socketpair(0x2, 0x0, 0x0, 0x0) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = socket(0x23, 0x1, 0x6) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000280)={0x80000000, &(0x7f00000001c0), &(0x7f0000000200)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f00000002c0)={{0x80000000, 0x0, 0x5, [0x34527720, 0x5]}, {0x80000000, r3, 0x0, [0x5, 0x5]}, 0x0, [0x7fffffff, 0x5]}) sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x80, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x10001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffc}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000010}, 0x8804) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000001c0)={"f3ee6027aed6729e8bcf2fdca1c64422d8e7ab94f5086adb8dd9925498f3", 0xfff, 0x2, 0x0, 0x1, 0x0, 0x2, 0xffff, 0x2, [0x0, 0x80000001, 0x0, 0x1ff, 0x7fff, 0x1ff, 0x8, 0x33e, 0x80000000, 0x0, 0x8, 0x63e, 0xda, 0xd8f, 0xa7c, 0x15b, 0x81, 0x7ff, 0x455]}) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000040), 0x610201, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000000080), 0x20e00, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0xa0302, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000100), 0x40200, 0x0) ioctl$SNDCTL_TMR_METRONOME(0xffffffffffffffff, 0x40045407) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = socket(0x23, 0x1, 0x6) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000280)={0x80000000, &(0x7f00000001c0), &(0x7f0000000200)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f00000002c0)={{0x80000000, 0x0, 0x5, [0x34527720, 0x5]}, {0x80000000, r3, 0x0, [0x5, 0x5]}, 0x0, [0x7fffffff, 0x5]}) sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x80, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x10001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffc}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000010}, 0x8804) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) r4 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r5 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5, 0x0, r4}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r5, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x1, 0x6) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000280)={0x80000000, &(0x7f00000001c0), &(0x7f0000000200)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f00000002c0)={{0x80000000, 0x0, 0x5, [0x34527720, 0x5]}, {0x80000000, r2, 0x0, [0x5, 0x5]}, 0x0, [0x7fffffff, 0x5]}) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) r4 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r5 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5, 0x0, r4}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r5, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x1, 0x6) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000280)={0x80000000, &(0x7f00000001c0), &(0x7f0000000200)}) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) r4 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r5 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5, 0x0, r4}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r5, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x1, 0x6) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x1, 0x6) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) r4 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: r0 = syz_open_dev$media(0x0, 0x2, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) r3 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: socket(0x23, 0x1, 0x6) 16:14:41 executing program 1: r0 = syz_open_dev$media(0x0, 0x2, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r3 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 0: socket(0x0, 0x1, 0x6) 16:14:41 executing program 1: r0 = syz_open_dev$media(0x0, 0x2, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r1], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) r2 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)) r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: socket(0x0, 0x1, 0x6) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x0, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: socket(0x0, 0x1, 0x6) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: socket(0x23, 0x0, 0x6) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 3: socketpair(0x0, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: socket(0x23, 0x0, 0x0) 16:14:41 executing program 3: socketpair(0x0, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: socket(0x23, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x78b2, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 3: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:41 executing program 0: socket(0x23, 0x0, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(0x0, 0x2, 0x101) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x4, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:41 executing program 0: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) socketpair(0x2, 0x5, 0x9, &(0x7f0000000040)) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x0, 0x800, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xe5}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)) 16:14:41 executing program 2: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:41 executing program 0: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:41 executing program 0: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 0: r0 = syz_open_dev$media(0x0, 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x9, 0x0) 16:14:41 executing program 0: r0 = syz_open_dev$media(0x0, 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x9, 0x0) 16:14:41 executing program 0: r0 = syz_open_dev$media(0x0, 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: socketpair(0x2, 0x5, 0x9, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x6}, 0x20) 16:14:41 executing program 3: io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x5}, 0x20) 16:14:41 executing program 0: syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x4}, 0x20) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 0: syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000400)=[{}, {}], 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 3: io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x3}, 0x20) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:41 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:41 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:41 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x2}, 0x20) 16:14:41 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:41 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x1}, 0x20) 16:14:42 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 3: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{0x0}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x1}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{0x0}], 0x0, 0x1}, 0x20) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 3: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: socketpair(0x2, 0x5, 0x0, &(0x7f0000000040)) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, 0x0, 0x0, r2], &(0x7f0000000640)=[0x3ff, 0x9869, 0xfffffffffffffa5a, 0x100, 0x7fffffffffffffff, 0x8], 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000006c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000780)={&(0x7f0000000700)=[0x0, r2, r3, 0x0], &(0x7f0000000740)=[0x1, 0xd10], 0x2, 0x4, 0x4}) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/112, 0x70}, {0xffffffffffffffff}, {&(0x7f0000000140)=""/157, 0x9d}, {&(0x7f0000000200)=""/6, 0x6}, {&(0x7f0000000240)=""/163, 0xa3}, {&(0x7f0000000300)=""/249, 0xf9}, {&(0x7f0000000400)=""/97, 0x61}], &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70], 0x7}, 0x20) 16:14:42 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = openat$sequencer(0xffffff9c, &(0x7f00000003c0), 0x400, 0x0) ioctl$SNDCTL_TMR_SOURCE(r2, 0xc0045406) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000000), &(0x7f0000000080)=[{}, {{}, {0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000140)={{0x80000000, 0x0, 0x0, [0x2, 0x822b]}, {r3, 0x0, 0xd, [0x3, 0x7bb]}, 0x10000004, [0x32ea, 0x7]}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) sendmsg$nl_crypto(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)=@del={0x108, 0x11, 0x200, 0x70bd29, 0x25dfdbfb, {{'cts-cbc-aes-neon\x00'}, '\x00', '\x00', 0x400, 0x400}, [{0x8, 0x1, 0x80}, {0x8, 0x1, 0x600000}, {0x8, 0x1, 0xfff}, {0x8}, {0x8, 0x1, 0x8001}]}, 0x108}, 0x1, 0x0, 0x0, 0xc890}, 0x40004) syz_init_net_socket$llc(0x1a, 0x2, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x3, 0x0, &(0x7f0000000280)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x0, 0x0, 0x0}) 16:14:42 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000040), 0x200, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x846000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@privport}, {@cache_mmap}, {@posixacl}, {@cache_none}], [{@audit}, {@fsmagic={'fsmagic', 0x3d, 0x1f}}, {@uid_eq}, {@uid_lt={'uid<', 0xee00}}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@fowner_gt}, {@smackfsdef={'smackfsdef', 0x3d, ':'}}, {@fowner_lt}]}}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) 16:14:42 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x102, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000100)={&(0x7f0000000140)=[0x0, 0x0, r1], &(0x7f00000000c0)=[0x0, 0xffffffffffff6d9f, 0x5, 0x800, 0x4, 0x1332], 0x3}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x102, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000100)={&(0x7f0000000140)=[0x0, 0x0, r1], &(0x7f00000000c0)=[0x0, 0xffffffffffff6d9f, 0x5, 0x800, 0x4, 0x1332], 0x3}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x44100, 0x0) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 3: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000240)="660f005a0b0f226466b9af0b00000f326452360f01c266b8000001000f23d00f21f866352000000f0f23f80f32660ffb4e0066b8050000000f23c00f21f86635020000000f23f8660f005a00", 0x4c}], 0x1, 0x20, &(0x7f00000001c0)=[@efer={0x2, 0x1000}], 0x1) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r1, 0x0, 0x1, 0x7}) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000000200)={0xfff, 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0x541b, 0x0) 16:14:42 executing program 1: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000240)="660f005a0b0f226466b9af0b00000f326452360f01c266b8000001000f23d00f21f866352000000f0f23f80f32660ffb4e0066b8050000000f23c00f21f86635020000000f23f8660f005a00", 0x4c}], 0x1, 0x20, &(0x7f00000001c0)=[@efer={0x2, 0x1000}], 0x1) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r1, 0x0, 0x1, 0x7}) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000000200)={0xfff, 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0x541b, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 1: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000240)="660f005a0b0f226466b9af0b00000f326452360f01c266b8000001000f23d00f21f866352000000f0f23f80f32660ffb4e0066b8050000000f23c00f21f86635020000000f23f8660f005a00", 0x4c}], 0x1, 0x20, &(0x7f00000001c0)=[@efer={0x2, 0x1000}], 0x1) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r1, 0x0, 0x1, 0x7}) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000000200)={0xfff, 0x4}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0x541b, 0x0) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) ioctl$SNDCTL_SEQ_SYNC(r2, 0x5101) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) r6 = syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r6, 0xc01064c1, &(0x7f00000004c0)={r4}) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) ioctl$SNDCTL_SEQ_SYNC(r2, 0x5101) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000500)=[{}, {}, {}], 0x9, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:14:42 executing program 2: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) r6 = syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r6, 0xc01064c1, &(0x7f00000004c0)={r4}) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x0, 0x0, 0x0}) 16:14:42 executing program 2: io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000004c0)=[0x8, 0x10000, 0x4, 0x70]}, 0x20) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) r2 = openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) ioctl$SNDCTL_SEQ_SYNC(r2, 0x5101) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = openat$binder_debug(0xffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, &(0x7f0000000300)={0x0, 0x0, r8}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) r6 = syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r6, 0xc01064c1, &(0x7f00000004c0)={r4}) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = openat$binder_debug(0xffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, &(0x7f0000000300)={0x0, 0x0, r8}) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = openat$binder_debug(0xffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, &(0x7f0000000300)={0x0, 0x0, r8}) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 2: r0 = io_uring_setup(0x7ebb, &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}, 0x20) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) write$sequencer(0xffffffffffffffff, &(0x7f00000002c0)=[@s={0x5, @generic=0x1, 0x2, 0x68}, @t={0x81, 0x3, 0x8, 0x1}], 0xc) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, 0x0, 0x10d282, 0x0) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000240)={0xffffffffffffffff, 0x1, 0x100000000}) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, 0x0, 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, 0x0, 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f00000001c0)}) r3 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r3, 0x1, 0x0, 0x0) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f00000001c0)}) io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r1, 0x0, 0x0}) io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, 0x0, 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, 0x0, 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, 0x0, 0x10d282, 0x0) 16:14:42 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:42 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 2: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:42 executing program 3: openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:42 executing program 1: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:42 executing program 0: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) 16:14:42 executing program 1: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:42 executing program 0: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:42 executing program 3: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:42 executing program 1: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:43 executing program 0: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:43 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) 16:14:43 executing program 0: io_uring_setup(0x6eb2, 0x0) 16:14:43 executing program 2: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:43 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:43 executing program 3: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 0: io_uring_setup(0x6eb2, 0x0) 16:14:43 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:43 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f00000001c0)}) r4 = io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x2c42, 0x4, 0x2, 0x15c}) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r6, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000100)=[r1, r6, r4, r0], 0x4) ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) 16:14:43 executing program 0: io_uring_setup(0x6eb2, 0x0) 16:14:43 executing program 3: sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f80000001300000229bd7000fdfbdf25647262675f6e6f70725f6374725f6165733132380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000800000000000000000000080001000900000008000100400080000800010000800000"], 0xf8}}, 0x24040004) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x10d282, 0x0) 16:14:43 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x0) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x4, 0x2, 0x15c}) 16:14:43 executing program 3: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x0) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2, 0x15c}) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6, 0x0, 0xffffffffffffffff}) r8 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r9 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r9, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r8}) r11 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r11, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r8, 0xc00864c0, &(0x7f00000002c0)={r10}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) 16:14:43 executing program 1: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x0) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2, 0x15c}) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6, 0x0, 0xffffffffffffffff}) r8 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r9 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r9, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r8}) r11 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r11, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r8, 0xc00864c0, &(0x7f00000002c0)={r10}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000280)={0xa3, 0x0, &(0x7f0000000240)}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6, 0x0, 0xffffffffffffffff}) r8 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r9 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r9, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r8}) r11 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r11, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r8, 0xc00864c0, &(0x7f00000002c0)={r10}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2, 0x15c}) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) openat$binder_debug(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6, 0x0, 0xffffffffffffffff}) r8 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r9 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r9, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r8}) r11 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r11, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r8, 0xc00864c0, &(0x7f00000002c0)={r10}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x4, 0x0, 0x15c}) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6, 0x0, 0xffffffffffffffff}) r8 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r9 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r9, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r8}) r11 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r11, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r8, 0xc00864c0, &(0x7f00000002c0)={r10}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x4}) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6, 0x0, 0xffffffffffffffff}) r8 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r9 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r9, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r8}) r11 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r11, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r8, 0xc00864c0, &(0x7f00000002c0)={r10}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000200)={&(0x7f0000000180)=[r1, 0x0, r4], &(0x7f0000000300)=[0x6, 0x5, 0xde, 0x8, 0x0, 0xc40], 0x3}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 0: io_uring_setup(0x6eb2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2, 0x15c}) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) 16:14:43 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000500)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000540)={0x0, 0x1, r3}) socket(0x11, 0x800, 0xe60) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000500)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000540)={0x0, 0x1, r3}) socket(0x11, 0x800, 0xe60) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r9 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r9, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r9 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r9, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) 16:14:43 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) r8 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r8, &(0x7f0000000340)='6\x00', 0x2) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) r8 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r8, &(0x7f0000000340)='6\x00', 0x2) 16:14:43 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:43 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:44 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000500)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000540)={0x0, 0x1, r3}) socket(0x11, 0x800, 0xe60) 16:14:44 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:44 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:44 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:44 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:44 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:44 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:44 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:44 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r8 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r8, &(0x7f0000000340)='6\x00', 0x2) 16:14:44 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:44 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000500)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f0000000540)={0x0, 0x1, r3}) 16:14:44 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:44 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:44 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:44 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) r8 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r8, &(0x7f0000000340)='6\x00', 0x2) 16:14:44 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:44 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:45 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) r6 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r6, &(0x7f0000000340)='6\x00', 0x2) 16:14:45 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$binder_debug(0xffffff9c, &(0x7f0000000500)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) 16:14:45 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:45 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r6 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r6, &(0x7f0000000340)='6\x00', 0x2) 16:14:45 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:45 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r6, &(0x7f0000000340)='6\x00', 0x2) 16:14:45 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) 16:14:45 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) r5 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r5, &(0x7f0000000340)='6\x00', 0x2) 16:14:45 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:45 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r4, &(0x7f0000000340)='6\x00', 0x2) 16:14:45 executing program 2: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:45 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:45 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r4, &(0x7f0000000340)='6\x00', 0x2) 16:14:46 executing program 2: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:46 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) 16:14:46 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r3 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000340)='6\x00', 0x2) 16:14:46 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:46 executing program 2: syz_open_dev$dri(0x0, 0x6, 0x40) 16:14:46 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:46 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000340)='6\x00', 0x2) 16:14:46 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:46 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:46 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:46 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) 16:14:46 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000340)='6\x00', 0x2) 16:14:46 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x0, 0x40) 16:14:46 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:46 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r2 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f0000000340)='6\x00', 0x2) 16:14:46 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x0) 16:14:46 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:46 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r0}) r2 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f0000000340)='6\x00', 0x2) 16:14:47 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x0) 16:14:47 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:47 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x541b, 0x0) 16:14:47 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) r2 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f0000000340)='6\x00', 0x2) 16:14:47 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) r1 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000340)='6\x00', 0x2) 16:14:47 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:47 executing program 2: syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x0) 16:14:47 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:47 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) r1 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000340)='6\x00', 0x2) 16:14:47 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:47 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:47 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:47 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) 16:14:47 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:48 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:48 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:48 executing program 1: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) 16:14:48 executing program 1: openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) 16:14:48 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) 16:14:48 executing program 1: openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) 16:14:48 executing program 3: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 2: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) 16:14:48 executing program 3: r0 = openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 1: openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) 16:14:48 executing program 3: r0 = openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:48 executing program 1: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) r0 = socket(0x26, 0x6, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/65, 0x41, 0x12143, &(0x7f00000000c0)={0x1a, 0x339, 0x7, 0xe7, 0x7, 0xc8, @broadcast}, 0x10) syz_open_dev$media(&(0x7f0000000000), 0x0, 0xa0000) 16:14:49 executing program 3: r0 = openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000340)='6\x00', 0x2) 16:14:49 executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000240)={0xc, &(0x7f0000000100)={0x0, 0x24, 0xd2, {0xd2, 0xd, "4efbe5f022bb17ef74d55b123998be8ab1075f2a73e24ee0b34c34e857b1b40c7e7fd6fa03d8b230e0d4b194b2a2e85c7dc29fab71ef8cd103b7f6dad90631ba7a5042a986760ac52dc3c132b956daae59d3ea35edccc426809beb699026d201d553fc3381fca772c0e59e22b0353acfffe6cfc01b4f06f9ed769e22c79852ca63e82deacbdcfe000f44de3c33fc594e18047203d2279788a78f4ad64687db2d786958682803a789eef081f03d12830b0f147cbf673bdf118d429950f00d9b9b2c0da31531fe2321bb659a033ab19f7e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x861}}}, &(0x7f00000004c0)={0x24, &(0x7f0000000280)={0x20, 0x0, 0x74, "219047c52342b1203b09897789d7f7e882759328fee453ed23c819825354fa686478df1d1ebc31dd4fd18cf11155d59a9b3d4f897e7b79c2fbc21e2cc77f0c2fc963f957d89b02a4f323d8e90e6131842fc6aecf70193d604c4d05d2c25082a66913f48797efc8d51304dfaf7d6e803353b4c2df"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7b06"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "d956a4"}, &(0x7f0000000400)={0x20, 0x83, 0x2, "a6a7"}, &(0x7f0000000440)={0x20, 0x84, 0x4, "9defd231"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "b18a23"}}) socket(0x26, 0x6, 0x0) 16:14:49 executing program 3: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:49 executing program 2: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000640)={0x0}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r4, 0xc01064c1, &(0x7f00000003c0)={r5}) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r7 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r6}) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:49 executing program 3: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:49 executing program 3: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:49 executing program 2: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000340)='6\x00', 0x2) 16:14:49 executing program 1: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:49 executing program 3: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:49 executing program 3: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 0: socket(0x26, 0x6, 0x0) 16:14:49 executing program 1: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 1: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 3: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 2: ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f0000000040)) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000440)={0x38, 0x3, 0xffffffffffffffff, 0x0, 0x6, 0xd3, &(0x7f0000000340)="110380a82fff20bd825482755a677448e6fd0de82fcc938fdd9cf632d89bebcfa54ba259667531b31cf7ec3642d8cb35860a8a2b99a3a2978fc64a85c68a341c1fa47fd12b75aa3b022efa4c759b09772ec4a7b62c0853f0e6b66e326106319cf5617969f67424801bc497c84443f7e974b14ba86e8cf0f24963c744670449bfa2b928970e9b3487359784c13c15ab4e3288f50aac2ebfaa97b8d4dfd0d3aa4f014147f7fac9571ea07e093debe9992706b8a3a99f5af1a59ddfc2caa8540ec6f638bc17b85ca386cbbacb895950acd2abc31a"}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000000)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000500)={0x0, 0x1, r2}) syz_open_dev$dri(&(0x7f0000000480), 0x6, 0x40) 16:14:49 executing program 0: socket(0x0, 0x6, 0x0) 16:14:49 executing program 1: r0 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000883ea6ac000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000b757000000000000000000"], 0xf) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x0, r1}) r4 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r4, 0xc01064c5, &(0x7f0000000640)={0x0}) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r5, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r5, 0xc01064c1, &(0x7f00000003c0)={r6}) r7 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000500)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x3, 0x384b19, 0x21e4bc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000280)={0x0, 0x1, r7}) r10 = openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(r10, &(0x7f0000000340)='6\x00', 0x2) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0], 0x7}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r7, 0xc00864c0, &(0x7f00000002c0)={r9}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000180)={0x80000000, &(0x7f0000000040), &(0x7f0000000100)}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=[0x3ff, 0x3, 0x93d, 0x7fffffffffffffff], 0x0, 0x1}) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040)=[{}, {0x80000000}], &(0x7f0000000080)}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000200)={0x80000000, &(0x7f0000000140)=[{}, {0x80000000, 0x0}], &(0x7f0000000180)}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000240)={{r3, 0x0, 0x5, [0x800]}, {r4, r5, 0x0, [0x7f, 0x6]}, 0x10000000, [0x1, 0x5]}) 16:14:49 executing program 1: write$sysctl(0xffffffffffffffff, 0x0, 0x0) 16:14:49 executing program 0: socket(0x0, 0x6, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{}, {0x80000000, 0x0, 0x0, [0x5]}}) 16:14:49 executing program 1: write$sysctl(0xffffffffffffffff, 0x0, 0x0) 16:14:49 executing program 3: io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r1 = getuid() r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r5 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r4}) r6 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r5, 0x7, &(0x7f0000000200)=r6, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r9 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r10 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000240)={r11, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r9, 0xc0347c03, &(0x7f00000008c0)={{r11, 0x0, 0x6, [0x82, 0x7]}, {r12, r13, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='taans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766e387820e", @ANYRES32=r1, @ANYBLOB=',dfltuid=', @ANYRESHEX=0xee00, @ANYBLOB=',obj_user=/dev/media#\x00,subj_role=^\'}:/!++,uid=', @ANYRESDEC=0xee00, @ANYBLOB="2c61707072616971655f747970653d696d617369672c6673757569643d64640063303a66382d513530482d30356332dd14db39cfb3e3f5323369bd9b9427336438332c736d61636b6673666c6f6f723d2e23ff2d2b242dba2a5d7d2c7502003c", @ANYRES16=r8, @ANYBLOB=',permit_directio,\x00', @ANYBLOB="3eb88e99bad5ed7aa80360f76ce1c2b5007ca16bae6792e02dd3bfc589be1c62e657efb1086bf66b823adb85a4537e569464486a7361b9d39d16bdb056a9ea30bad0a286087d19f99dca59a73b46de509290514c59beeb03a5921495cfe4c85e91ae5d027aa66737e63bfdab015f4712494608a7eb2a95dd6b88b7f19dc92921ab93321065bd1be183e1a63f520c4e4e7cb451b7d352353b32365010f71ca729fc61cbb87b7bb21045559c5d6b71fdd524", @ANYRES32=r3, @ANYRES16=r0]) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:49 executing program 1: write$sysctl(0xffffffffffffffff, 0x0, 0x0) 16:14:49 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{}, {0x80000000, 0x0, 0x4000000}}) 16:14:49 executing program 0: socket(0x0, 0x6, 0x0) 16:14:49 executing program 1: r0 = openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000040)={"8a39c944a91bcde971d3564f5b91a2afdb69fd9f055f6f6ecfe1459567d1", 0x4, 0x0, 0x1, 0x80000000, 0x3, 0x3, 0x1, 0x4, [0x80, 0x80000001, 0x100, 0x5, 0x81, 0x5, 0xd597, 0x20, 0x200006, 0xf68, 0xfffffff9, 0xffff0001, 0xb2db, 0x1, 0x7d9, 0x62551023, 0x728, 0x5, 0xaaf8]}) 16:14:49 executing program 1: r0 = openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r1 = getuid() r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r5 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r4}) r6 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r5, 0x7, &(0x7f0000000200)=r6, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r9 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r10 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000240)={r11, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r9, 0xc0347c03, &(0x7f00000008c0)={{r11, 0x0, 0x6, [0x82, 0x7]}, {r12, r13, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='taans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766e387820e", @ANYRES32=r1, @ANYBLOB=',dfltuid=', @ANYRESHEX=0xee00, @ANYBLOB=',obj_user=/dev/media#\x00,subj_role=^\'}:/!++,uid=', @ANYRESDEC=0xee00, @ANYBLOB="2c61707072616971655f747970653d696d617369672c6673757569643d64640063303a66382d513530482d30356332dd14db39cfb3e3f5323369bd9b9427336438332c736d61636b6673666c6f6f723d2e23ff2d2b242dba2a5d7d2c7502003c", @ANYRES16=r8, @ANYBLOB=',permit_directio,\x00', @ANYBLOB="3eb88e99bad5ed7aa80360f76ce1c2b5007ca16bae6792e02dd3bfc589be1c62e657efb1086bf66b823adb85a4537e569464486a7361b9d39d16bdb056a9ea30bad0a286087d19f99dca59a73b46de509290514c59beeb03a5921495cfe4c85e91ae5d027aa66737e63bfdab015f4712494608a7eb2a95dd6b88b7f19dc92921ab93321065bd1be183e1a63f520c4e4e7cb451b7d352353b32365010f71ca729fc61cbb87b7bb21045559c5d6b71fdd524", @ANYRES32=r3, @ANYRES16=r0]) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:49 executing program 0: socket(0x26, 0x0, 0x0) 16:14:49 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000040)={"8a39c944a91bcde971d3564f5b91a2afdb69fd9f055f6f6ecfe1459567d1", 0x4, 0x0, 0x1, 0x80000000, 0x3, 0x3, 0x1, 0x4, [0x80, 0x80000001, 0x100, 0x5, 0x81, 0x5, 0xd597, 0x20, 0x200006, 0xf68, 0xfffffff9, 0xffff0001, 0xb2db, 0x1, 0x7d9, 0x62551023, 0x728, 0x5, 0xaaf8]}) 16:14:49 executing program 1: r0 = openat$sysctl(0xffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 16:14:49 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000040)={"8a39c944a91bcde971d3564f5b91a2afdb69fd9f055f6f6ecfe1459567d1", 0x4, 0x0, 0x1, 0x80000000, 0x3, 0x3, 0x1, 0x4, [0x80, 0x80000001, 0x100, 0x5, 0x81, 0x5, 0xd597, 0x20, 0x200006, 0xf68, 0xfffffff9, 0xffff0001, 0xb2db, 0x1, 0x7d9, 0x62551023, 0x728, 0x5, 0xaaf8]}) 16:14:49 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000040)={"8a39c944a91bcde971d3564f5b91a2afdb69fd9f055f6f6ecfe1459567d1", 0x4, 0x0, 0x1, 0x80000000, 0x3, 0x3, 0x1, 0x4, [0x80, 0x80000001, 0x100, 0x5, 0x81, 0x5, 0xd597, 0x20, 0x200006, 0xf68, 0xfffffff9, 0xffff0001, 0xb2db, 0x1, 0x7d9, 0x62551023, 0x728, 0x5, 0xaaf8]}) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r1 = getuid() r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r5 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r4}) r6 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r5, 0x7, &(0x7f0000000200)=r6, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r9 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r10 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000240)={r11, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r9, 0xc0347c03, &(0x7f00000008c0)={{r11, 0x0, 0x6, [0x82, 0x7]}, {r12, r13, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='taans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766e387820e", @ANYRES32=r1, @ANYBLOB=',dfltuid=', @ANYRESHEX=0xee00, @ANYBLOB=',obj_user=/dev/media#\x00,subj_role=^\'}:/!++,uid=', @ANYRESDEC=0xee00, @ANYBLOB="2c61707072616971655f747970653d696d617369672c6673757569643d64640063303a66382d513530482d30356332dd14db39cfb3e3f5323369bd9b9427336438332c736d61636b6673666c6f6f723d2e23ff2d2b242dba2a5d7d2c7502003c", @ANYRES16=r8, @ANYBLOB=',permit_directio,\x00', @ANYBLOB="3eb88e99bad5ed7aa80360f76ce1c2b5007ca16bae6792e02dd3bfc589be1c62e657efb1086bf66b823adb85a4537e569464486a7361b9d39d16bdb056a9ea30bad0a286087d19f99dca59a73b46de509290514c59beeb03a5921495cfe4c85e91ae5d027aa66737e63bfdab015f4712494608a7eb2a95dd6b88b7f19dc92921ab93321065bd1be183e1a63f520c4e4e7cb451b7d352353b32365010f71ca729fc61cbb87b7bb21045559c5d6b71fdd524", @ANYRES32=r3, @ANYRES16=r0]) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) 16:14:49 executing program 1: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) 16:14:49 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000040)={"8a39c944a91bcde971d3564f5b91a2afdb69fd9f055f6f6ecfe1459567d1", 0x4, 0x0, 0x1, 0x80000000, 0x3, 0x3, 0x1, 0x4, [0x80, 0x80000001, 0x100, 0x5, 0x81, 0x5, 0xd597, 0x20, 0x200006, 0xf68, 0xfffffff9, 0xffff0001, 0xb2db, 0x1, 0x7d9, 0x62551023, 0x728, 0x5, 0xaaf8]}) 16:14:49 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:49 executing program 1: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r1 = getuid() r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r5 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r4}) r6 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r5, 0x7, &(0x7f0000000200)=r6, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r9 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r10 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000240)={r11, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r9, 0xc0347c03, &(0x7f00000008c0)={{r11, 0x0, 0x6, [0x82, 0x7]}, {r12, r13, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='taans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766e387820e", @ANYRES32=r1, @ANYBLOB=',dfltuid=', @ANYRESHEX=0xee00, @ANYBLOB=',obj_user=/dev/media#\x00,subj_role=^\'}:/!++,uid=', @ANYRESDEC=0xee00, @ANYBLOB="2c61707072616971655f747970653d696d617369672c6673757569643d64640063303a66382d513530482d30356332dd14db39cfb3e3f5323369bd9b9427336438332c736d61636b6673666c6f6f723d2e23ff2d2b242dba2a5d7d2c7502003c", @ANYRES16=r8, @ANYBLOB=',permit_directio,\x00', @ANYBLOB="3eb88e99bad5ed7aa80360f76ce1c2b5007ca16bae6792e02dd3bfc589be1c62e657efb1086bf66b823adb85a4537e569464486a7361b9d39d16bdb056a9ea30bad0a286087d19f99dca59a73b46de509290514c59beeb03a5921495cfe4c85e91ae5d027aa66737e63bfdab015f4712494608a7eb2a95dd6b88b7f19dc92921ab93321065bd1be183e1a63f520c4e4e7cb451b7d352353b32365010f71ca729fc61cbb87b7bb21045559c5d6b71fdd524", @ANYRES32=r3, @ANYRES16=r0]) 16:14:49 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000040)={"8a39c944a91bcde971d3564f5b91a2afdb69fd9f055f6f6ecfe1459567d1", 0x4, 0x0, 0x1, 0x80000000, 0x3, 0x3, 0x1, 0x4, [0x80, 0x80000001, 0x100, 0x5, 0x81, 0x5, 0xd597, 0x20, 0x200006, 0xf68, 0xfffffff9, 0xffff0001, 0xb2db, 0x1, 0x7d9, 0x62551023, 0x728, 0x5, 0xaaf8]}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)={0x0}) r5 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r5, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r1, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r2, r2, r3, r3, r2, r2, r4], 0x0, 0x7, 0x2}) 16:14:49 executing program 1: openat$sysctl(0xffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r8 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r9 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r8, 0xc0347c03, &(0x7f00000008c0)={{r10, 0x0, 0x6, [0x82, 0x7]}, {r11, r12, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) 16:14:49 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r1 = getuid() r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000640)={0x0}) r3 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, 0x0) r4 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r5 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r4}) r6 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r5, 0x7, &(0x7f0000000200)=r6, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r9 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r10 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r10, 0xc01c7c02, &(0x7f0000000240)={r11, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r9, 0xc0347c03, &(0x7f00000008c0)={{r11, 0x0, 0x6, [0x82, 0x7]}, {r12, r13, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r8, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r8, 0xc01064c5, &(0x7f0000000640)={0x0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='taans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766e387820e", @ANYRES32=r1, @ANYBLOB=',dfltuid=', @ANYRESHEX=0xee00, @ANYBLOB=',obj_user=/dev/media#\x00,subj_role=^\'}:/!++,uid=', @ANYRESDEC=0xee00, @ANYBLOB="2c61707072616971655f747970653d696d617369672c6673757569643d64640063303a66382d513530482d30356332dd14db39cfb3e3f5323369bd9b9427336438332c736d61636b6673666c6f6f723d2e23ff2d2b242dba2a5d7d2c7502003c", @ANYRES16=r8, @ANYBLOB=',permit_directio,\x00', @ANYBLOB="3eb88e99bad5ed7aa80360f76ce1c2b5007ca16bae6792e02dd3bfc589be1c62e657efb1086bf66b823adb85a4537e569464486a7361b9d39d16bdb056a9ea30bad0a286087d19f99dca59a73b46de509290514c59beeb03a5921495cfe4c85e91ae5d027aa66737e63bfdab015f4712494608a7eb2a95dd6b88b7f19dc92921ab93321065bd1be183e1a63f520c4e4e7cb451b7d352353b32365010f71ca729fc61cbb87b7bb21045559c5d6b71fdd524", @ANYRES32=r3, @ANYRES16=r0]) 16:14:49 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r8 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r9 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r8, 0xc0347c03, &(0x7f00000008c0)={{r10, 0x0, 0x6, [0x82, 0x7]}, {r11, r12, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)={0x0}) r5 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r5, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r1, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r2, r2, r3, r3, r2, r2, r4], 0x0, 0x7, 0x2}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r7 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r8 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc01c7c02, &(0x7f0000000240)={r9, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r7, 0xc0347c03, &(0x7f00000008c0)={{r9, 0x0, 0x6, [0x82, 0x7]}, {r10, r11, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) 16:14:49 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r6 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000240)={r7, 0x0, 0x0}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r1, r2], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r6 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r1, r2], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) 16:14:49 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 16:14:49 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000002c0)) 16:14:49 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)) 16:14:49 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) 16:14:50 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)) 16:14:50 executing program 0: syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 0: syz_open_dev$dri(0x0, 0x2, 0x80040) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) 16:14:50 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) 16:14:50 executing program 0: syz_open_dev$dri(0x0, 0x2, 0x80040) 16:14:50 executing program 3: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 0: syz_open_dev$dri(0x0, 0x2, 0x80040) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r5 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r5, 0xc01064c5, &(0x7f0000000640)={0x0}) 16:14:50 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) 16:14:50 executing program 3: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 0: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x80040) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) 16:14:50 executing program 1: syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) 16:14:50 executing program 3: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 0: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x80040) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) 16:14:50 executing program 1: syz_open_dev$dri(0x0, 0x2, 0x80040) 16:14:50 executing program 0: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x80040) 16:14:50 executing program 3: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) 16:14:50 executing program 1: syz_open_dev$dri(0x0, 0x2, 0x80040) 16:14:50 executing program 3: openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 0: syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x0) 16:14:50 executing program 1: syz_open_dev$dri(0x0, 0x2, 0x80040) 16:14:50 executing program 3: openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000002c0)) 16:14:50 executing program 1: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x80040) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) r4 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200)=r4, 0x1) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) 16:14:50 executing program 1: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x80040) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r8 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r9 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r8, 0xc0347c03, &(0x7f00000008c0)={{r10, 0x0, 0x6, [0x82, 0x7]}, {r11, r12, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) 16:14:50 executing program 1: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x80040) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r2 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200)=r2, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x0) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r2, r3], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000002c0)) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r2 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200)=r2, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r3 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r2}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000640)={0x0}) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, 0x0) r3 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r4 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e, 0x0, r3}) r5 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r4, 0x7, &(0x7f0000000200)=r5, 0x1) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) r6 = openat$drirender128(0xffffff9c, &(0x7f0000000140), 0x541300, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f0000000640)={0x0}) r7 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r8 = syz_open_dev$media(&(0x7f0000000240), 0x1, 0x30040) r9 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r9, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000280)=[{0x80000000}, {}], 0x2, 0x0, &(0x7f0000000680)=[{}, {}], 0x4, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000500)=[{}]}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000880)={0x80000000, &(0x7f0000000600), &(0x7f0000000800)=[{}, {{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r8, 0xc0347c03, &(0x7f00000008c0)={{r10, 0x0, 0x6, [0x82, 0x7]}, {r11, r12, 0x4, [0x2, 0x2]}, 0x5, [0x40]}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r7, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r7, 0xc01064c5, &(0x7f0000000640)={0x0}) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) r2 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200)=r2, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x280) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x80040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000280)={&(0x7f0000000200)=[0x0, r3, r4], &(0x7f0000000240)=[0x80000000, 0x90d5], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000002c0)={0x0}) r6 = openat$sequencer(0xffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r6, 0x5404) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f0000000340)={&(0x7f0000000300)=[r3, r3, r4, r4, r3, r3, r5], 0x0, 0x7, 0x2}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000100)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r3 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000200)=r3, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SEQ_PANIC(0xffffffffffffffff, 0x5111) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r1 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r2 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000200)=r2, 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000040), 0x44982, 0x0) getrusage(0x0, &(0x7f00000001c0)) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0], 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r2}) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r2 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000200)=r2, 0x1) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SEQ_PANIC(0xffffffffffffffff, 0x5111) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000040), 0x44982, 0x0) getrusage(0x0, &(0x7f00000001c0)) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0], 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r2}) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, 0x0) r2 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$SNDCTL_SEQ_PANIC(0xffffffffffffffff, 0x5111) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) r1 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r2 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000200)=r2, 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000040), 0x44982, 0x0) getrusage(0x0, &(0x7f00000001c0)) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0], 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r2}) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r1 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000040), 0x44982, 0x0) getrusage(0x0, &(0x7f00000001c0)) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02064c3, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0], 0x1, 0x1}) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) r1 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x541b, 0x0) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000040), 0x44982, 0x0) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x541b, 0x0) 16:14:50 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) r1 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 3: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x541b, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 3: r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) getuid() r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 3: r0 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x20000) r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: r0 = io_uring_setup(0x0, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 3: r0 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, 0x0) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 0: r0 = io_uring_setup(0x0, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, 0x0) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 0: r0 = io_uring_setup(0x0, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x541b, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, 0x0) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 0: r0 = io_uring_setup(0x0, &(0x7f0000000180)={0x0, 0xc320, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x541b, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0x0, 0x10, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: getrusage(0x0, 0x0) 16:14:50 executing program 3: openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0x541b, 0x0) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: getrusage(0x0, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x17e}) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x60100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r0, 0xc01064c5, &(0x7f0000000640)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r0, 0xc01064c1, &(0x7f0000000100)) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x200840) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0x2, 0x0) getrusage(0x0, &(0x7f00000001c0)) 16:14:50 executing program 1: getrusage(0x0, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) r1 = eventfd2(0x7, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r2, 0x15, &(0x7f0000000940)=[{0x2, 0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/179, 0xb3}, {&(0x7f0000000280)=""/91, 0x5b}], &(0x7f0000000340)=[0x81, 0x7fff]}, {0x3, 0x1, 0x0, &(0x7f0000000440)=[{&(0x7f0000000380)=""/13, 0xd}, {&(0x7f00000003c0)}, {&(0x7f0000000400)=""/37, 0x25}], &(0x7f0000000480)=[0xffffffffffffa73f, 0x8, 0x3]}, {0x0, 0x1, 0x0, &(0x7f00000004c0), &(0x7f0000000500)=[0x5]}, {0x0, 0x0, 0x0, &(0x7f0000000540), &(0x7f0000000580)}, {0x4, 0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/53, 0x35}, {&(0x7f0000000600)=""/155, 0x9b}, {&(0x7f00000006c0)=""/201, 0xc9}, {&(0x7f00000007c0)=""/222, 0xde}], &(0x7f0000000900)=[0x0, 0x72f1b604, 0x9, 0x7000000000000000, 0xc0c6, 0x200]}], 0x5) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000180)={0x1, "6fb43e15ba640b2dab61b582ffbf7fe03cffee9bbac83b867ef9ca2ad9e2ad8a"}) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x54101, 0x0) r6 = openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f0000000280)) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) r1 = eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200)=r1, 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r2, 0x15, &(0x7f0000000940)=[{0x2, 0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/179, 0xb3}, {&(0x7f0000000280)=""/91, 0x5b}], &(0x7f0000000340)=[0x81, 0x7fff]}, {0x3, 0x1, 0x0, &(0x7f0000000440)=[{&(0x7f0000000380)=""/13, 0xd}, {&(0x7f00000003c0)}, {&(0x7f0000000400)=""/37, 0x25}], &(0x7f0000000480)=[0xffffffffffffa73f, 0x8, 0x3]}, {0x0, 0x1, 0x0, &(0x7f00000004c0), &(0x7f0000000500)=[0x5]}, {0x0, 0x0, 0x0, &(0x7f0000000540), &(0x7f0000000580)}, {0x4, 0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/53, 0x35}, {&(0x7f0000000600)=""/155, 0x9b}, {&(0x7f00000006c0)=""/201, 0xc9}, {&(0x7f00000007c0)=""/222, 0xde}], &(0x7f0000000900)=[0x0, 0x72f1b604, 0x9, 0x7000000000000000, 0xc0c6, 0x200]}], 0x5) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000180)={0x1, "6fb43e15ba640b2dab61b582ffbf7fe03cffee9bbac83b867ef9ca2ad9e2ad8a"}) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0x0, 0x10, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: io_uring_setup(0x5de6, &(0x7f0000000180)) r0 = eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200)=r0, 0x1) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x17e}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x54101, 0x0) r6 = openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f0000000280)) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r2, 0x15, &(0x7f0000000940)=[{0x2, 0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/179, 0xb3}, {&(0x7f0000000280)=""/91, 0x5b}], &(0x7f0000000340)=[0x81, 0x7fff]}, {0x3, 0x1, 0x0, &(0x7f0000000440)=[{&(0x7f0000000380)=""/13, 0xd}, {&(0x7f00000003c0)}, {&(0x7f0000000400)=""/37, 0x25}], &(0x7f0000000480)=[0xffffffffffffa73f, 0x8, 0x3]}, {0x0, 0x1, 0x0, &(0x7f00000004c0), &(0x7f0000000500)=[0x5]}, {0x0, 0x0, 0x0, &(0x7f0000000540), &(0x7f0000000580)}, {0x4, 0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/53, 0x35}, {&(0x7f0000000600)=""/155, 0x9b}, {&(0x7f00000006c0)=""/201, 0xc9}, {&(0x7f00000007c0)=""/222, 0xde}], &(0x7f0000000900)=[0x0, 0x72f1b604, 0x9, 0x7000000000000000, 0xc0c6, 0x200]}], 0x5) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000180)={0x1, "6fb43e15ba640b2dab61b582ffbf7fe03cffee9bbac83b867ef9ca2ad9e2ad8a"}) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 2: io_uring_setup(0x5de6, &(0x7f0000000180)) r0 = eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200)=r0, 0x1) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r2, 0x15, &(0x7f0000000940)=[{0x2, 0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/179, 0xb3}, {&(0x7f0000000280)=""/91, 0x5b}], &(0x7f0000000340)=[0x81, 0x7fff]}, {0x3, 0x1, 0x0, &(0x7f0000000440)=[{&(0x7f0000000380)=""/13, 0xd}, {&(0x7f00000003c0)}, {&(0x7f0000000400)=""/37, 0x25}], &(0x7f0000000480)=[0xffffffffffffa73f, 0x8, 0x3]}, {0x0, 0x1, 0x0, &(0x7f00000004c0), &(0x7f0000000500)=[0x5]}, {0x0, 0x0, 0x0, &(0x7f0000000540), &(0x7f0000000580)}, {0x4, 0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/53, 0x35}, {&(0x7f0000000600)=""/155, 0x9b}, {&(0x7f00000006c0)=""/201, 0xc9}, {&(0x7f00000007c0)=""/222, 0xde}], &(0x7f0000000900)=[0x0, 0x72f1b604, 0x9, 0x7000000000000000, 0xc0c6, 0x200]}], 0x5) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 2: io_uring_setup(0x5de6, &(0x7f0000000180)) r0 = eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200)=r0, 0x1) 16:14:50 executing program 0: io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x54101, 0x0) r6 = openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f0000000280)) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 0: io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$drirender128(0xffffff9c, &(0x7f0000000300), 0x54101, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:50 executing program 0: io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:50 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:50 executing program 2: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000200), 0x1) 16:14:50 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:50 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:50 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040), 0x5, 0x80200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) r2 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x21, 0x4, 0xda7e, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x21, 0x4, 0xda7e, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x21, 0x4, 0xda7e, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x21, 0x4, 0xda7e, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, 0x0, 0x1) 16:14:51 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) socketpair(0x21, 0x4, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, 0x0, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: socketpair(0x21, 0x4, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, 0x0, 0x1) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, 0x0, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: socketpair(0x0, 0x4, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, 0x0, 0x1) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, 0x0, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x0, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x0, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x0, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: socketpair(0x0, 0x4, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x0, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: socketpair(0x0, 0x4, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = io_uring_setup(0x5de6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, 0x0, 0x1) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: socketpair(0x21, 0x0, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 0: io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, 0x0, 0x1) 16:14:51 executing program 2: socketpair(0x21, 0x0, 0x0, &(0x7f0000000080)) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, 0x0, 0x1) 16:14:51 executing program 2: socketpair(0x21, 0x0, 0x0, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: socketpair(0x21, 0x0, 0x0, 0x0) 16:14:51 executing program 0: io_uring_setup(0x5de6, &(0x7f0000000180)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, 0x0, 0x1) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: socketpair(0x21, 0x0, 0x0, 0x0) 16:14:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 1: syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:51 executing program 1: syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:51 executing program 1: syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 0: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080), 0x0, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: socketpair(0x0, 0x4, 0xda7e, &(0x7f0000000080)) 16:14:51 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = syz_io_uring_setup(0x1cc9, &(0x7f0000000080)={0x0, 0x87fe, 0x80, 0x2, 0x279}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 16:14:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r1, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x800, 0x404000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000040)={0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f00000000c0)={&(0x7f0000000240)=[r4, r5, r5], 0x3}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x3, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$nci(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$KVM_S390_UCAS_MAP(0xffffffffffffffff, 0x4018ae50, &(0x7f0000000080)={0x200, 0x10001, 0xc39}) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000040)={0x101, 0x2}) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, &(0x7f0000000040)={{0x80000000, 0x0, 0x600}}) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) r1 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = openat$drirender128(0xffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r0, 0xc01064c1, &(0x7f0000000140)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)={0x0, 0x0, r1}) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 2: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 1: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 2: openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 1: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 2: openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) 16:14:51 executing program 0: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:51 executing program 1: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:51 executing program 2: openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) 16:14:51 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:51 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x101240, 0x0) 16:14:52 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) 16:14:52 executing program 1: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 0: openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) 16:14:52 executing program 1: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) 16:14:52 executing program 0: openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) 16:14:52 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) 16:14:52 executing program 1: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 0: openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) 16:14:52 executing program 3: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x101240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 0: r0 = openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) 16:14:52 executing program 0: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000200)) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) 16:14:52 executing program 1: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 1: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(&(0x7f0000000180)={0x20071026, 0xffffffffffffffff}, &(0x7f00000001c0)={0x6, 0x7, 0x2, 0x744, 0x1}) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 2: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x2, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x3ff, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:52 executing program 0: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) 16:14:52 executing program 2: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:52 executing program 0: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000240)={r2, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:52 executing program 0: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0xe1, &(0x7f00000007c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0x9b, 0x60, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd198, 0xad}, [@feature_unit={0x11, 0x24, 0x6, 0x6, 0x4, 0x5, [0x1, 0x2, 0x7, 0x5, 0x7], 0x78}, @feature_unit={0xb, 0x24, 0x6, 0x5, 0x4, 0x2, [0xa, 0x8]}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6e00, 0x9, 0x98, "cf55ef98ec7a950b49"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x50, "6180929bc8"}, @as_header={0x7, 0x24, 0x1, 0x60, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x40, 0x0, 0x6, {0x7, 0x25, 0x1, 0x1, 0x0, 0xcf}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0x1, 0x42, "c3", "8b5fb8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x4}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3b, 0x1, "", "b16c"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xbd4, 0x1f, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x0, 0x8d, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3a, 0x1}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0xbc, 0x7, 0x80, 0x40, 0x6}, 0x1d, &(0x7f00000008c0)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0x45, 0x3, 0x7, 0x0, 0x9, [0xffff0f, 0xff00, 0x28]}]}, 0x6, [{0xc0, &(0x7f0000000900)=@string={0xc0, 0x3, "941273589339ce2bbb316cfc0081707e27521475e8872200f509d18bb6d986cc5b7cca64fad8aa277df982215f20c5600acc10b5554c81fb28ed8c51b23f69e03ad8e28f174eae9e534a3d2a01ec15e4a25cb4029745e168d1970be448dd9eab7dedcebc578247edee389b2ec1713a08062b1ca74f8a7c05edf949391310e6e3053b9622c3b654f5c25129443ce5d70ff104c1e09aed67fefdc594e345856445398c2c86adbd394ae50523c13ecc1502ac39d379229cba6d3c803bbe0a38"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x100a}}, {0x21, &(0x7f00000011c0)=ANY=[@ANYBLOB="21036b67d58ed41fbfe0578bc12be3161d118f0dc403ae1c83b4d7752c4ce99e19a0989c0f16932a6007d66a8709492dca08260b556aea7e26d1425a2ff495c5353731b7203c5e3860b7ca534b06cee9b6bc7965b5c499cb71bcffcb24876c04953ec90a67b5091fd756fda72ce5fac3d7bfcae8b15ff1121ef1a7f1c86f63f8824efd08b6"]}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x812}}, {0xeb, &(0x7f0000000ac0)=@string={0xeb, 0x3, "c2b2f4b2432620c2ccc8af30e510d8981e675bba05586ccbb9e1c9482c2648c0c67a27ac4e3193ce944b4177a763fe9683fd2a0652bae74dee1893d0ba8905b2e87a8fbf678324654a551d99f3201a82cba1217a6a865facb6c2c8b79342210811fc4a0e744a7d3b07ca503b29955483f9689d2dead2aab9796d5c42183d9f535fec9678f812cc53b7082d11af22dc1e1e47f9260f6740ec2d885a45f06edf547b255957cfdf0e2e36209336497ad99a1c38d59459ac0f76e493199e3b0f163aef8dad3c111a206ff0ddadeac84d265cebc149e296bdeee693bc824552d079ad2b2a86755158285d27"}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000440)={{r3, 0x0, 0x0, [0x7fff]}, {r10, 0x0, 0x0, [0x8001, 0x6]}, 0x0, [0xc0000000, 0xfffffd3e]}) r11 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000002c0), 0x28c103, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r11, 0xc0487c04, &(0x7f00000003c0)={0x0, 0x2aaaaaaaaaaa82c, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000480)=[{}, {}, {}]}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:52 executing program 0: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:52 executing program 0: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:52 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 365.298372][ T5206] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 365.548432][ T5206] usb 7-1: Using ep0 maxpacket: 8 [ 365.669156][ T5206] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 365.673634][ T5206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 16:14:55 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0xe1, &(0x7f00000007c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0x9b, 0x60, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd198, 0xad}, [@feature_unit={0x11, 0x24, 0x6, 0x6, 0x4, 0x5, [0x1, 0x2, 0x7, 0x5, 0x7], 0x78}, @feature_unit={0xb, 0x24, 0x6, 0x5, 0x4, 0x2, [0xa, 0x8]}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6e00, 0x9, 0x98, "cf55ef98ec7a950b49"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x50, "6180929bc8"}, @as_header={0x7, 0x24, 0x1, 0x60, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x40, 0x0, 0x6, {0x7, 0x25, 0x1, 0x1, 0x0, 0xcf}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0x1, 0x42, "c3", "8b5fb8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x4}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3b, 0x1, "", "b16c"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xbd4, 0x1f, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x0, 0x8d, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3a, 0x1}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0xbc, 0x7, 0x80, 0x40, 0x6}, 0x1d, &(0x7f00000008c0)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0x45, 0x3, 0x7, 0x0, 0x9, [0xffff0f, 0xff00, 0x28]}]}, 0x6, [{0xc0, &(0x7f0000000900)=@string={0xc0, 0x3, "941273589339ce2bbb316cfc0081707e27521475e8872200f509d18bb6d986cc5b7cca64fad8aa277df982215f20c5600acc10b5554c81fb28ed8c51b23f69e03ad8e28f174eae9e534a3d2a01ec15e4a25cb4029745e168d1970be448dd9eab7dedcebc578247edee389b2ec1713a08062b1ca74f8a7c05edf949391310e6e3053b9622c3b654f5c25129443ce5d70ff104c1e09aed67fefdc594e345856445398c2c86adbd394ae50523c13ecc1502ac39d379229cba6d3c803bbe0a38"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x100a}}, {0x21, &(0x7f00000011c0)=ANY=[@ANYBLOB="21036b67d58ed41fbfe0578bc12be3161d118f0dc403ae1c83b4d7752c4ce99e19a0989c0f16932a6007d66a8709492dca08260b556aea7e26d1425a2ff495c5353731b7203c5e3860b7ca534b06cee9b6bc7965b5c499cb71bcffcb24876c04953ec90a67b5091fd756fda72ce5fac3d7bfcae8b15ff1121ef1a7f1c86f63f8824efd08b6"]}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x812}}, {0xeb, &(0x7f0000000ac0)=@string={0xeb, 0x3, "c2b2f4b2432620c2ccc8af30e510d8981e675bba05586ccbb9e1c9482c2648c0c67a27ac4e3193ce944b4177a763fe9683fd2a0652bae74dee1893d0ba8905b2e87a8fbf678324654a551d99f3201a82cba1217a6a865facb6c2c8b79342210811fc4a0e744a7d3b07ca503b29955483f9689d2dead2aab9796d5c42183d9f535fec9678f812cc53b7082d11af22dc1e1e47f9260f6740ec2d885a45f06edf547b255957cfdf0e2e36209336497ad99a1c38d59459ac0f76e493199e3b0f163aef8dad3c111a206ff0ddadeac84d265cebc149e296bdeee693bc824552d079ad2b2a86755158285d27"}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000440)={{r3, 0x0, 0x0, [0x7fff]}, {r10, 0x0, 0x0, [0x8001, 0x6]}, 0x0, [0xc0000000, 0xfffffd3e]}) r11 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000002c0), 0x28c103, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r11, 0xc0487c04, &(0x7f00000003c0)={0x0, 0x2aaaaaaaaaaa82c, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000480)=[{}, {}, {}]}) 16:14:55 executing program 0: r0 = openat$sw_sync(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:55 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x80046601, 0x0) 16:14:55 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:55 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:55 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x402c582b, 0x0) 16:14:55 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 368.048357][ T5206] usb 7-1: string descriptor 0 read error: -71 [ 368.051016][ T5206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 368.054486][ T5206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 16:14:55 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) [ 368.078563][ T5206] usb 7-1: can't set config #1, error -71 [ 368.082569][ T5206] usb 7-1: USB disconnect, device number 14 [ 368.438307][ T5206] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 368.678336][ T5206] usb 7-1: Using ep0 maxpacket: 8 [ 368.798374][ T5206] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 368.802060][ T5206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 16:14:58 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0xe1, &(0x7f00000007c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0x9b, 0x60, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd198, 0xad}, [@feature_unit={0x11, 0x24, 0x6, 0x6, 0x4, 0x5, [0x1, 0x2, 0x7, 0x5, 0x7], 0x78}, @feature_unit={0xb, 0x24, 0x6, 0x5, 0x4, 0x2, [0xa, 0x8]}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6e00, 0x9, 0x98, "cf55ef98ec7a950b49"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x50, "6180929bc8"}, @as_header={0x7, 0x24, 0x1, 0x60, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x40, 0x0, 0x6, {0x7, 0x25, 0x1, 0x1, 0x0, 0xcf}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0x1, 0x42, "c3", "8b5fb8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x4}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3b, 0x1, "", "b16c"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xbd4, 0x1f, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x0, 0x8d, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3a, 0x1}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0xbc, 0x7, 0x80, 0x40, 0x6}, 0x1d, &(0x7f00000008c0)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0x45, 0x3, 0x7, 0x0, 0x9, [0xffff0f, 0xff00, 0x28]}]}, 0x6, [{0xc0, &(0x7f0000000900)=@string={0xc0, 0x3, "941273589339ce2bbb316cfc0081707e27521475e8872200f509d18bb6d986cc5b7cca64fad8aa277df982215f20c5600acc10b5554c81fb28ed8c51b23f69e03ad8e28f174eae9e534a3d2a01ec15e4a25cb4029745e168d1970be448dd9eab7dedcebc578247edee389b2ec1713a08062b1ca74f8a7c05edf949391310e6e3053b9622c3b654f5c25129443ce5d70ff104c1e09aed67fefdc594e345856445398c2c86adbd394ae50523c13ecc1502ac39d379229cba6d3c803bbe0a38"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x100a}}, {0x21, &(0x7f00000011c0)=ANY=[@ANYBLOB="21036b67d58ed41fbfe0578bc12be3161d118f0dc403ae1c83b4d7752c4ce99e19a0989c0f16932a6007d66a8709492dca08260b556aea7e26d1425a2ff495c5353731b7203c5e3860b7ca534b06cee9b6bc7965b5c499cb71bcffcb24876c04953ec90a67b5091fd756fda72ce5fac3d7bfcae8b15ff1121ef1a7f1c86f63f8824efd08b6"]}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x812}}, {0xeb, &(0x7f0000000ac0)=@string={0xeb, 0x3, "c2b2f4b2432620c2ccc8af30e510d8981e675bba05586ccbb9e1c9482c2648c0c67a27ac4e3193ce944b4177a763fe9683fd2a0652bae74dee1893d0ba8905b2e87a8fbf678324654a551d99f3201a82cba1217a6a865facb6c2c8b79342210811fc4a0e744a7d3b07ca503b29955483f9689d2dead2aab9796d5c42183d9f535fec9678f812cc53b7082d11af22dc1e1e47f9260f6740ec2d885a45f06edf547b255957cfdf0e2e36209336497ad99a1c38d59459ac0f76e493199e3b0f163aef8dad3c111a206ff0ddadeac84d265cebc149e296bdeee693bc824552d079ad2b2a86755158285d27"}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000440)={{r3, 0x0, 0x0, [0x7fff]}, {r10, 0x0, 0x0, [0x8001, 0x6]}, 0x0, [0xc0000000, 0xfffffd3e]}) r11 = openat$ubi_ctrl(0xffffff9c, &(0x7f00000002c0), 0x28c103, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r11, 0xc0487c04, &(0x7f00000003c0)={0x0, 0x2aaaaaaaaaaa82c, 0x0, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000480)=[{}, {}, {}]}) 16:14:58 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x5451, &(0x7f0000000040)) 16:14:58 executing program 0: openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) 16:14:58 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:58 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:14:58 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:14:58 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 371.068547][ T5206] usb 7-1: string descriptor 0 read error: -71 [ 371.071589][ T5206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 371.075747][ T5206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 16:14:58 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x8933, 0x0) [ 371.100886][ T5206] usb 7-1: can't set config #1, error -71 [ 371.110994][ T5206] usb 7-1: USB disconnect, device number 15 [ 371.458971][ T5206] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 371.698338][ T5206] usb 7-1: Using ep0 maxpacket: 8 [ 371.818467][ T5206] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 371.823310][ T5206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 16:15:01 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:01 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 1) 16:15:01 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) 16:15:01 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0xe1, &(0x7f00000007c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0x9b, 0x60, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd198, 0xad}, [@feature_unit={0x11, 0x24, 0x6, 0x6, 0x4, 0x5, [0x1, 0x2, 0x7, 0x5, 0x7], 0x78}, @feature_unit={0xb, 0x24, 0x6, 0x5, 0x4, 0x2, [0xa, 0x8]}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6e00, 0x9, 0x98, "cf55ef98ec7a950b49"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x50, "6180929bc8"}, @as_header={0x7, 0x24, 0x1, 0x60, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x40, 0x0, 0x6, {0x7, 0x25, 0x1, 0x1, 0x0, 0xcf}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0x1, 0x42, "c3", "8b5fb8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x4}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3b, 0x1, "", "b16c"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xbd4, 0x1f, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x0, 0x8d, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3a, 0x1}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0xbc, 0x7, 0x80, 0x40, 0x6}, 0x1d, &(0x7f00000008c0)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0x45, 0x3, 0x7, 0x0, 0x9, [0xffff0f, 0xff00, 0x28]}]}, 0x6, [{0xc0, &(0x7f0000000900)=@string={0xc0, 0x3, "941273589339ce2bbb316cfc0081707e27521475e8872200f509d18bb6d986cc5b7cca64fad8aa277df982215f20c5600acc10b5554c81fb28ed8c51b23f69e03ad8e28f174eae9e534a3d2a01ec15e4a25cb4029745e168d1970be448dd9eab7dedcebc578247edee389b2ec1713a08062b1ca74f8a7c05edf949391310e6e3053b9622c3b654f5c25129443ce5d70ff104c1e09aed67fefdc594e345856445398c2c86adbd394ae50523c13ecc1502ac39d379229cba6d3c803bbe0a38"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x100a}}, {0x21, &(0x7f00000011c0)=ANY=[@ANYBLOB="21036b67d58ed41fbfe0578bc12be3161d118f0dc403ae1c83b4d7752c4ce99e19a0989c0f16932a6007d66a8709492dca08260b556aea7e26d1425a2ff495c5353731b7203c5e3860b7ca534b06cee9b6bc7965b5c499cb71bcffcb24876c04953ec90a67b5091fd756fda72ce5fac3d7bfcae8b15ff1121ef1a7f1c86f63f8824efd08b6"]}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x812}}, {0xeb, &(0x7f0000000ac0)=@string={0xeb, 0x3, "c2b2f4b2432620c2ccc8af30e510d8981e675bba05586ccbb9e1c9482c2648c0c67a27ac4e3193ce944b4177a763fe9683fd2a0652bae74dee1893d0ba8905b2e87a8fbf678324654a551d99f3201a82cba1217a6a865facb6c2c8b79342210811fc4a0e744a7d3b07ca503b29955483f9689d2dead2aab9796d5c42183d9f535fec9678f812cc53b7082d11af22dc1e1e47f9260f6740ec2d885a45f06edf547b255957cfdf0e2e36209336497ad99a1c38d59459ac0f76e493199e3b0f163aef8dad3c111a206ff0ddadeac84d265cebc149e296bdeee693bc824552d079ad2b2a86755158285d27"}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000440)={{r3, 0x0, 0x0, [0x7fff]}, {r10, 0x0, 0x0, [0x8001, 0x6]}, 0x0, [0xc0000000, 0xfffffd3e]}) openat$ubi_ctrl(0xffffff9c, &(0x7f00000002c0), 0x28c103, 0x0) [ 374.079525][T19336] FAULT_INJECTION: forcing a failure. [ 374.079525][T19336] name failslab, interval 1, probability 0, space 0, times 0 16:15:01 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 374.085117][T19336] CPU: 1 PID: 19336 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 16:15:01 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) [ 374.089753][T19336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 374.094531][T19336] Call Trace: [ 374.096116][T19336] [ 374.097436][T19336] dump_stack_lvl+0x125/0x1b0 [ 374.099541][T19336] should_fail_ex+0x496/0x5b0 [ 374.101525][T19336] should_failslab+0x9/0x20 [ 374.103539][T19336] kmem_cache_alloc+0x33a/0x3b0 [ 374.105579][T19336] getname_flags.part.0+0x50/0x4d0 16:15:01 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 374.107569][T19336] getname+0x90/0xe0 [ 374.109543][T19336] do_sys_openat2+0x100/0x1e0 [ 374.111786][T19336] ? build_open_flags+0x690/0x690 [ 374.114004][T19336] __ia32_compat_sys_openat+0x16e/0x200 16:15:01 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 1) [ 374.116869][T19336] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 374.118580][ T5206] usb 7-1: string descriptor 0 read error: -71 [ 374.119712][T19336] ? ksys_write+0x1a7/0x250 [ 374.119742][T19336] ? rcu_is_watching+0x12/0xb0 [ 374.119765][T19336] __do_fast_syscall_32+0x61/0xe0 [ 374.119784][T19336] do_fast_syscall_32+0x33/0x70 16:15:01 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 2) 16:15:01 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 374.119803][T19336] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 374.119827][T19336] RIP: 0023:0xf7f4f579 [ 374.119841][T19336] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 374.119859][T19336] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 374.119878][T19336] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 374.119889][T19336] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 374.119900][T19336] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 374.119931][T19336] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 374.119942][T19336] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 374.119960][T19336] [ 374.134889][T19348] FAULT_INJECTION: forcing a failure. [ 374.134889][T19348] name failslab, interval 1, probability 0, space 0, times 0 [ 374.136553][ T5206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 374.137709][T19348] CPU: 2 PID: 19348 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 374.142633][T19350] FAULT_INJECTION: forcing a failure. [ 374.142633][T19350] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 374.145606][ T5206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.148502][T19348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 374.148514][T19348] Call Trace: [ 374.148520][T19348] [ 374.148525][T19348] dump_stack_lvl+0x125/0x1b0 [ 374.148544][T19348] should_fail_ex+0x496/0x5b0 [ 374.148562][T19348] should_failslab+0x9/0x20 [ 374.178649][ T5206] usb 7-1: can't set config #1, error -71 [ 374.178806][T19348] __kmem_cache_alloc_node+0x2fd/0x350 [ 374.189789][ T5206] usb 7-1: USB disconnect, device number 16 [ 374.193104][T19348] ? tomoyo_realpath_from_path+0xb9/0x710 [ 374.213315][T19348] ? lock_acquire+0x464/0x510 [ 374.215426][T19348] ? tomoyo_realpath_from_path+0xb9/0x710 [ 374.217738][T19348] __kmalloc+0x4f/0x100 [ 374.219459][T19348] tomoyo_realpath_from_path+0xb9/0x710 [ 374.221801][T19348] ? reacquire_held_locks+0x4b0/0x4b0 [ 374.224298][T19348] ? tomoyo_profile+0x47/0x60 [ 374.226494][T19348] tomoyo_path_number_perm+0x243/0x590 [ 374.228930][T19348] ? tomoyo_path_number_perm+0x1eb/0x590 [ 374.231452][T19348] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 374.234180][T19348] ? rcu_is_watching+0x12/0xb0 [ 374.236375][T19348] ? reacquire_held_locks+0x4b0/0x4b0 [ 374.238631][T19348] ? rcu_is_watching+0x12/0xb0 [ 374.240878][T19348] ? __fget_files+0x279/0x410 [ 374.243117][T19348] security_file_ioctl+0x72/0xb0 [ 374.245457][T19348] __do_compat_sys_ioctl+0x5d/0x330 [ 374.247904][T19348] __do_fast_syscall_32+0x61/0xe0 [ 374.250288][T19348] do_fast_syscall_32+0x33/0x70 [ 374.252488][T19348] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 374.255323][T19348] RIP: 0023:0xf7f61579 [ 374.257169][T19348] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 374.265719][T19348] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 374.269004][T19348] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 374.271933][T19348] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 374.274966][T19348] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 374.278139][T19348] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 374.281035][T19348] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 374.284643][T19348] [ 374.286111][T19350] CPU: 1 PID: 19350 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 374.287224][T19348] ERROR: Out of memory at tomoyo_realpath_from_path. [ 374.290626][T19350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 374.290639][T19350] Call Trace: [ 374.290646][T19350] [ 374.290652][T19350] dump_stack_lvl+0x125/0x1b0 [ 374.290675][T19350] should_fail_ex+0x496/0x5b0 [ 374.290693][T19350] strncpy_from_user+0x38/0x300 [ 374.290715][T19350] getname_flags.part.0+0x93/0x4d0 [ 374.290741][T19350] getname+0x90/0xe0 [ 374.290765][T19350] do_sys_openat2+0x100/0x1e0 [ 374.290782][T19350] ? build_open_flags+0x690/0x690 [ 374.290804][T19350] __ia32_compat_sys_openat+0x16e/0x200 [ 374.290823][T19350] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 374.290839][T19350] ? ksys_write+0x1a7/0x250 [ 374.290860][T19350] ? rcu_is_watching+0x12/0xb0 [ 374.290879][T19350] __do_fast_syscall_32+0x61/0xe0 [ 374.290898][T19350] do_fast_syscall_32+0x33/0x70 [ 374.290914][T19350] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 374.290939][T19350] RIP: 0023:0xf7f4f579 [ 374.290952][T19350] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 374.290969][T19350] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 374.290986][T19350] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 374.290997][T19350] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 374.291008][T19350] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 374.291018][T19350] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 374.291029][T19350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 374.291044][T19350] [ 374.549367][ T5206] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 374.838467][ T5206] usb 7-1: Using ep0 maxpacket: 8 [ 374.958448][ T5206] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 374.962569][ T5206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 16:15:04 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0xe1, &(0x7f00000007c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0x9b, 0x60, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd198, 0xad}, [@feature_unit={0x11, 0x24, 0x6, 0x6, 0x4, 0x5, [0x1, 0x2, 0x7, 0x5, 0x7], 0x78}, @feature_unit={0xb, 0x24, 0x6, 0x5, 0x4, 0x2, [0xa, 0x8]}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6e00, 0x9, 0x98, "cf55ef98ec7a950b49"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x50, "6180929bc8"}, @as_header={0x7, 0x24, 0x1, 0x60, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x40, 0x0, 0x6, {0x7, 0x25, 0x1, 0x1, 0x0, 0xcf}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0x1, 0x42, "c3", "8b5fb8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x4}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3b, 0x1, "", "b16c"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xbd4, 0x1f, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x0, 0x8d, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3a, 0x1}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0xbc, 0x7, 0x80, 0x40, 0x6}, 0x1d, &(0x7f00000008c0)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0x45, 0x3, 0x7, 0x0, 0x9, [0xffff0f, 0xff00, 0x28]}]}, 0x6, [{0xc0, &(0x7f0000000900)=@string={0xc0, 0x3, "941273589339ce2bbb316cfc0081707e27521475e8872200f509d18bb6d986cc5b7cca64fad8aa277df982215f20c5600acc10b5554c81fb28ed8c51b23f69e03ad8e28f174eae9e534a3d2a01ec15e4a25cb4029745e168d1970be448dd9eab7dedcebc578247edee389b2ec1713a08062b1ca74f8a7c05edf949391310e6e3053b9622c3b654f5c25129443ce5d70ff104c1e09aed67fefdc594e345856445398c2c86adbd394ae50523c13ecc1502ac39d379229cba6d3c803bbe0a38"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x100a}}, {0x21, &(0x7f00000011c0)=ANY=[@ANYBLOB="21036b67d58ed41fbfe0578bc12be3161d118f0dc403ae1c83b4d7752c4ce99e19a0989c0f16932a6007d66a8709492dca08260b556aea7e26d1425a2ff495c5353731b7203c5e3860b7ca534b06cee9b6bc7965b5c499cb71bcffcb24876c04953ec90a67b5091fd756fda72ce5fac3d7bfcae8b15ff1121ef1a7f1c86f63f8824efd08b6"]}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x812}}, {0xeb, &(0x7f0000000ac0)=@string={0xeb, 0x3, "c2b2f4b2432620c2ccc8af30e510d8981e675bba05586ccbb9e1c9482c2648c0c67a27ac4e3193ce944b4177a763fe9683fd2a0652bae74dee1893d0ba8905b2e87a8fbf678324654a551d99f3201a82cba1217a6a865facb6c2c8b79342210811fc4a0e744a7d3b07ca503b29955483f9689d2dead2aab9796d5c42183d9f535fec9678f812cc53b7082d11af22dc1e1e47f9260f6740ec2d885a45f06edf547b255957cfdf0e2e36209336497ad99a1c38d59459ac0f76e493199e3b0f163aef8dad3c111a206ff0ddadeac84d265cebc149e296bdeee693bc824552d079ad2b2a86755158285d27"}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000000440)={{r3, 0x0, 0x0, [0x7fff]}, {r10, 0x0, 0x0, [0x8001, 0x6]}, 0x0, [0xc0000000, 0xfffffd3e]}) 16:15:04 executing program 1: r0 = syz_open_dev$media(0x0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:04 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 3) 16:15:04 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 2) [ 377.103077][T19356] FAULT_INJECTION: forcing a failure. [ 377.103077][T19356] name failslab, interval 1, probability 0, space 0, times 0 16:15:04 executing program 1: r0 = syz_open_dev$media(0x0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 377.103229][T19357] FAULT_INJECTION: forcing a failure. [ 377.103229][T19357] name failslab, interval 1, probability 0, space 0, times 0 [ 377.108050][T19356] CPU: 3 PID: 19356 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 377.108065][T19356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 377.108070][T19356] Call Trace: [ 377.108075][T19356] [ 377.124055][T19356] dump_stack_lvl+0x125/0x1b0 [ 377.125746][T19356] should_fail_ex+0x496/0x5b0 [ 377.127453][T19356] should_failslab+0x9/0x20 [ 377.129353][T19356] kmem_cache_alloc+0x33a/0x3b0 [ 377.131299][T19356] alloc_empty_file+0x73/0x1d0 [ 377.133356][T19356] path_openat+0xdc/0x29c0 [ 377.135455][T19356] ? __ia32_compat_sys_openat+0x16e/0x200 [ 377.138023][T19356] ? __do_fast_syscall_32+0x61/0xe0 [ 377.140401][T19356] ? do_fast_syscall_32+0x33/0x70 [ 377.142699][T19356] ? entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 377.145563][T19356] ? path_lookupat+0x770/0x770 [ 377.147773][T19356] do_filp_open+0x1de/0x430 [ 377.149798][T19356] ? may_open_dev+0xf0/0xf0 [ 377.151884][T19356] ? expand_files+0x442/0x910 [ 377.153993][T19356] ? _raw_spin_unlock+0x28/0x40 [ 377.156174][T19356] ? alloc_fd+0x2da/0x6c0 16:15:04 executing program 1: r0 = syz_open_dev$media(0x0, 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:04 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 377.158088][T19356] do_sys_openat2+0x176/0x1e0 [ 377.160446][T19356] ? build_open_flags+0x690/0x690 [ 377.162753][T19356] __ia32_compat_sys_openat+0x16e/0x200 [ 377.165196][T19356] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 377.167675][T19356] ? ksys_write+0x1a7/0x250 [ 377.169776][T19356] ? rcu_is_watching+0x12/0xb0 [ 377.172015][T19356] __do_fast_syscall_32+0x61/0xe0 [ 377.174352][T19356] do_fast_syscall_32+0x33/0x70 [ 377.176644][T19356] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 377.179575][T19356] RIP: 0023:0xf7f4f579 [ 377.181452][T19356] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 377.190337][T19356] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 377.194324][T19356] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 377.198300][T19356] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 377.201638][T19356] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 377.205994][T19356] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 377.210353][T19356] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 377.214245][T19356] [ 377.215694][T19357] CPU: 2 PID: 19357 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 377.220624][T19357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 377.223977][T19357] Call Trace: [ 377.225118][T19357] [ 377.226332][T19357] dump_stack_lvl+0x125/0x1b0 [ 377.228002][T19357] should_fail_ex+0x496/0x5b0 16:15:04 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 377.228522][ T5206] usb 7-1: string descriptor 0 read error: -71 [ 377.229781][T19357] should_failslab+0x9/0x20 [ 377.229794][T19357] __kmem_cache_alloc_node+0x2fd/0x350 [ 377.229809][T19357] ? tomoyo_encode2+0x100/0x3d0 [ 377.232738][ T5206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 377.234296][T19357] ? tomoyo_encode2+0x100/0x3d0 [ 377.236741][ T5206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.238666][T19357] __kmalloc+0x4f/0x100 [ 377.238680][T19357] tomoyo_encode2+0x100/0x3d0 [ 377.238694][T19357] ? rcu_is_watching+0x12/0xb0 [ 377.238705][T19357] tomoyo_encode+0x29/0x50 [ 377.238718][T19357] tomoyo_realpath_from_path+0x196/0x710 [ 377.238733][T19357] ? tomoyo_profile+0x47/0x60 [ 377.238744][T19357] tomoyo_path_number_perm+0x243/0x590 [ 377.238757][T19357] ? tomoyo_path_number_perm+0x1eb/0x590 [ 377.238770][T19357] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 377.238783][T19357] ? ksys_write+0x12f/0x250 [ 377.238794][T19357] ? reacquire_held_locks+0x4b0/0x4b0 [ 377.238811][T19357] ? reacquire_held_locks+0x4b0/0x4b0 [ 377.238823][T19357] ? bit_wait_timeout+0x160/0x160 [ 377.238835][T19357] ? __fget_files+0x279/0x410 [ 377.238846][T19357] ? __fget_files+0x279/0x410 [ 377.238856][T19357] security_file_ioctl+0x72/0xb0 [ 377.238867][T19357] __do_compat_sys_ioctl+0x5d/0x330 [ 377.238878][T19357] __do_fast_syscall_32+0x61/0xe0 [ 377.238888][T19357] do_fast_syscall_32+0x33/0x70 [ 377.238897][T19357] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 377.238910][T19357] RIP: 0023:0xf7f61579 [ 377.238918][T19357] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 377.238928][T19357] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 377.238939][T19357] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 377.238945][T19357] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 377.238950][T19357] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 377.238956][T19357] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 377.238962][T19357] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 377.238970][T19357] [ 377.239496][T19357] ERROR: Out of memory at tomoyo_realpath_from_path. [ 377.268785][ T5206] usb 7-1: can't set config #1, error -71 [ 377.325893][ T5206] usb 7-1: USB disconnect, device number 17 [ 377.678345][ T5206] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 377.918319][ T5206] usb 7-1: Using ep0 maxpacket: 8 [ 378.038595][ T5206] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 378.043267][ T5206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 378.200821][ T1347] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.203364][ T1347] ieee802154 phy1 wpan1: encryption failed: -22 16:15:07 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:07 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 4) 16:15:07 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 3) [ 380.128085][T19372] FAULT_INJECTION: forcing a failure. 16:15:07 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0xe1, &(0x7f00000007c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0x9b, 0x60, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd198, 0xad}, [@feature_unit={0x11, 0x24, 0x6, 0x6, 0x4, 0x5, [0x1, 0x2, 0x7, 0x5, 0x7], 0x78}, @feature_unit={0xb, 0x24, 0x6, 0x5, 0x4, 0x2, [0xa, 0x8]}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x6e00, 0x9, 0x98, "cf55ef98ec7a950b49"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x50, "6180929bc8"}, @as_header={0x7, 0x24, 0x1, 0x60, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x40, 0x0, 0x6, {0x7, 0x25, 0x1, 0x1, 0x0, 0xcf}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0x1, 0x42, "c3", "8b5fb8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x4}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3b, 0x1, "", "b16c"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xbd4, 0x1f, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x0, 0x8d, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3a, 0x1}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0xbc, 0x7, 0x80, 0x40, 0x6}, 0x1d, &(0x7f00000008c0)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0x45, 0x3, 0x7, 0x0, 0x9, [0xffff0f, 0xff00, 0x28]}]}, 0x6, [{0xc0, &(0x7f0000000900)=@string={0xc0, 0x3, "941273589339ce2bbb316cfc0081707e27521475e8872200f509d18bb6d986cc5b7cca64fad8aa277df982215f20c5600acc10b5554c81fb28ed8c51b23f69e03ad8e28f174eae9e534a3d2a01ec15e4a25cb4029745e168d1970be448dd9eab7dedcebc578247edee389b2ec1713a08062b1ca74f8a7c05edf949391310e6e3053b9622c3b654f5c25129443ce5d70ff104c1e09aed67fefdc594e345856445398c2c86adbd394ae50523c13ecc1502ac39d379229cba6d3c803bbe0a38"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x100a}}, {0x21, &(0x7f00000011c0)=ANY=[@ANYBLOB="21036b67d58ed41fbfe0578bc12be3161d118f0dc403ae1c83b4d7752c4ce99e19a0989c0f16932a6007d66a8709492dca08260b556aea7e26d1425a2ff495c5353731b7203c5e3860b7ca534b06cee9b6bc7965b5c499cb71bcffcb24876c04953ec90a67b5091fd756fda72ce5fac3d7bfcae8b15ff1121ef1a7f1c86f63f8824efd08b6"]}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x812}}, {0xeb, &(0x7f0000000ac0)=@string={0xeb, 0x3, "c2b2f4b2432620c2ccc8af30e510d8981e675bba05586ccbb9e1c9482c2648c0c67a27ac4e3193ce944b4177a763fe9683fd2a0652bae74dee1893d0ba8905b2e87a8fbf678324654a551d99f3201a82cba1217a6a865facb6c2c8b79342210811fc4a0e744a7d3b07ca503b29955483f9689d2dead2aab9796d5c42183d9f535fec9678f812cc53b7082d11af22dc1e1e47f9260f6740ec2d885a45f06edf547b255957cfdf0e2e36209336497ad99a1c38d59459ac0f76e493199e3b0f163aef8dad3c111a206ff0ddadeac84d265cebc149e296bdeee693bc824552d079ad2b2a86755158285d27"}}]}) [ 380.128085][T19372] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 380.130386][T19374] FAULT_INJECTION: forcing a failure. [ 380.130386][T19374] name failslab, interval 1, probability 0, space 0, times 0 [ 380.134236][T19372] CPU: 3 PID: 19372 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 380.141565][T19372] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 380.145291][T19372] Call Trace: [ 380.146525][T19372] [ 380.147609][T19372] dump_stack_lvl+0x125/0x1b0 16:15:07 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 380.149572][T19372] should_fail_ex+0x496/0x5b0 [ 380.151845][T19372] _copy_from_user+0x30/0xf0 [ 380.154005][T19372] sw_sync_ioctl+0x144/0xc80 [ 380.156078][T19372] ? reacquire_held_locks+0x4b0/0x4b0 [ 380.158453][T19372] ? bit_wait_timeout+0x160/0x160 [ 380.160646][T19372] ? __fget_files+0x279/0x410 [ 380.162729][T19372] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 380.165530][T19372] ? __fget_files+0x279/0x410 [ 380.167255][T19372] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 380.169647][T19372] compat_ptr_ioctl+0x71/0xa0 [ 380.171369][T19372] ? vfs_fileattr_get+0xc0/0xc0 [ 380.173133][T19372] __do_compat_sys_ioctl+0x2bf/0x330 [ 380.175048][T19372] __do_fast_syscall_32+0x61/0xe0 [ 380.176867][T19372] do_fast_syscall_32+0x33/0x70 [ 380.178656][T19372] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 380.180928][T19372] RIP: 0023:0xf7f61579 [ 380.182441][T19372] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 380.189366][T19372] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 380.192805][T19372] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 16:15:07 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:07 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 380.196316][T19372] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 380.199501][T19372] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 380.202418][T19372] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 380.205478][T19372] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 380.208408][T19372] [ 380.209595][T19374] CPU: 1 PID: 19374 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 380.210664][ T5206] usb 7-1: string descriptor 0 read error: -71 [ 380.213537][T19374] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 380.216011][ T5206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 380.220017][T19374] Call Trace: [ 380.220026][T19374] [ 380.220032][T19374] dump_stack_lvl+0x125/0x1b0 [ 380.220050][T19374] should_fail_ex+0x496/0x5b0 [ 380.220061][T19374] should_failslab+0x9/0x20 [ 380.220071][T19374] kmem_cache_alloc+0x33a/0x3b0 16:15:07 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 4) [ 380.220087][T19374] security_file_alloc+0x41/0x250 [ 380.220105][T19374] ? kmem_cache_alloc+0x34e/0x3b0 [ 380.220119][T19374] init_file+0xb9/0x2d0 [ 380.220131][T19374] alloc_empty_file+0x91/0x1d0 [ 380.220143][T19374] path_openat+0xdc/0x29c0 16:15:07 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 380.220157][T19374] ? __ia32_compat_sys_openat+0x16e/0x200 [ 380.220166][T19374] ? __do_fast_syscall_32+0x61/0xe0 [ 380.220175][T19374] ? do_fast_syscall_32+0x33/0x70 [ 380.220184][T19374] ? entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 380.220198][T19374] ? path_lookupat+0x770/0x770 [ 380.220212][T19374] do_filp_open+0x1de/0x430 [ 380.220226][T19374] ? may_open_dev+0xf0/0xf0 [ 380.220239][T19374] ? expand_files+0x442/0x910 [ 380.220252][T19374] ? _raw_spin_unlock+0x28/0x40 [ 380.220266][T19374] ? alloc_fd+0x2da/0x6c0 [ 380.220276][T19374] do_sys_openat2+0x176/0x1e0 [ 380.220285][T19374] ? build_open_flags+0x690/0x690 [ 380.220296][T19374] __ia32_compat_sys_openat+0x16e/0x200 [ 380.220306][T19374] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 380.223790][ T5206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.225086][T19374] ? ksys_write+0x1a7/0x250 [ 380.225110][T19374] ? rcu_is_watching+0x12/0xb0 [ 380.238617][ T5206] usb 7-1: can't set config #1, error -71 [ 380.239814][T19374] __do_fast_syscall_32+0x61/0xe0 [ 380.239829][T19374] do_fast_syscall_32+0x33/0x70 [ 380.239839][T19374] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 380.248634][ T5206] usb 7-1: USB disconnect, device number 18 [ 380.249233][T19374] RIP: 0023:0xf7f4f579 [ 380.261481][T19386] FAULT_INJECTION: forcing a failure. [ 380.261481][T19386] name failslab, interval 1, probability 0, space 0, times 0 [ 380.261599][T19374] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 380.300146][T19374] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 380.303172][T19374] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 380.306037][T19374] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 380.308897][T19374] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 380.311931][T19374] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 380.314803][T19374] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 380.317667][T19374] [ 380.318825][T19386] CPU: 2 PID: 19386 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 380.322617][T19386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 380.326251][T19386] Call Trace: [ 380.327471][T19386] [ 380.328578][T19386] dump_stack_lvl+0x125/0x1b0 [ 380.330300][T19386] should_fail_ex+0x496/0x5b0 [ 380.332005][T19386] should_failslab+0x9/0x20 [ 380.333657][T19386] __kmem_cache_alloc_node+0x2fd/0x350 [ 380.335661][T19386] ? sw_sync_ioctl+0x2a7/0xc80 [ 380.337411][T19386] kmalloc_trace+0x25/0xe0 16:15:07 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 5) 16:15:07 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 380.339110][T19386] sw_sync_ioctl+0x2a7/0xc80 [ 380.340996][T19386] ? reacquire_held_locks+0x4b0/0x4b0 [ 380.342946][T19386] ? bit_wait_timeout+0x160/0x160 [ 380.344745][T19386] ? __fget_files+0x279/0x410 [ 380.346473][T19386] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 380.347621][T19389] FAULT_INJECTION: forcing a failure. [ 380.347621][T19389] name failslab, interval 1, probability 0, space 0, times 0 [ 380.348854][T19386] ? __fget_files+0x279/0x410 [ 380.348868][T19386] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 380.348882][T19386] compat_ptr_ioctl+0x71/0xa0 [ 380.348893][T19386] ? vfs_fileattr_get+0xc0/0xc0 [ 380.348905][T19386] __do_compat_sys_ioctl+0x2bf/0x330 [ 380.362929][T19386] __do_fast_syscall_32+0x61/0xe0 [ 380.364749][T19386] do_fast_syscall_32+0x33/0x70 [ 380.366530][T19386] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 380.368809][T19386] RIP: 0023:0xf7f61579 [ 380.370301][T19386] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 380.377233][T19386] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 380.380239][T19386] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 380.383120][T19386] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 380.386006][T19386] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 380.388967][T19386] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 380.391843][T19386] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 380.394714][T19386] [ 380.395841][T19389] CPU: 1 PID: 19389 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 380.400447][T19389] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 380.404709][T19389] Call Trace: [ 380.406200][T19389] [ 380.407518][T19389] dump_stack_lvl+0x125/0x1b0 [ 380.409617][T19389] should_fail_ex+0x496/0x5b0 [ 380.411703][T19389] should_failslab+0x9/0x20 [ 380.413719][T19389] __kmem_cache_alloc_node+0x2fd/0x350 [ 380.416164][T19389] ? tomoyo_realpath_from_path+0xb9/0x710 [ 380.418692][T19389] ? tomoyo_realpath_from_path+0xb9/0x710 [ 380.421213][T19389] __kmalloc+0x4f/0x100 [ 380.423087][T19389] tomoyo_realpath_from_path+0xb9/0x710 [ 380.425537][T19389] tomoyo_check_open_permission+0x2aa/0x3b0 [ 380.428161][T19389] ? tomoyo_path_number_perm+0x590/0x590 [ 380.430513][T19389] ? rcu_is_watching+0x12/0xb0 [ 380.432237][T19389] ? make_vfsuid+0x108/0x160 [ 380.434176][T19389] ? hook_path_mknod+0x670/0x670 [ 380.436364][T19389] ? reacquire_held_locks+0x4b0/0x4b0 [ 380.438770][T19389] ? spin_bug+0x1d0/0x1d0 [ 380.440530][T19389] ? make_vfsgid+0x108/0x160 [ 380.442477][T19389] tomoyo_file_open+0xa8/0xd0 [ 380.444218][T19389] security_file_open+0x6a/0xe0 [ 380.446026][T19389] do_dentry_open+0x538/0x1730 [ 380.447774][T19389] ? may_open+0x1f2/0x400 [ 380.449361][T19389] path_openat+0x19af/0x29c0 [ 380.451062][T19389] ? path_lookupat+0x770/0x770 [ 380.452802][T19389] do_filp_open+0x1de/0x430 [ 380.454469][T19389] ? may_open_dev+0xf0/0xf0 [ 380.456128][T19389] ? expand_files+0x442/0x910 [ 380.457849][T19389] ? _raw_spin_unlock+0x28/0x40 [ 380.459625][T19389] ? alloc_fd+0x2da/0x6c0 [ 380.461205][T19389] do_sys_openat2+0x176/0x1e0 [ 380.462945][T19389] ? build_open_flags+0x690/0x690 [ 380.464771][T19389] __ia32_compat_sys_openat+0x16e/0x200 [ 380.466768][T19389] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 380.468738][T19389] ? ksys_write+0x1a7/0x250 [ 380.470403][T19389] ? rcu_is_watching+0x12/0xb0 [ 380.472150][T19389] __do_fast_syscall_32+0x61/0xe0 [ 380.473978][T19389] do_fast_syscall_32+0x33/0x70 [ 380.475746][T19389] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 380.478034][T19389] RIP: 0023:0xf7f4f579 [ 380.479506][T19389] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 380.486503][T19389] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 380.490176][T19389] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 380.493640][T19389] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 380.496998][T19389] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 380.499780][T19389] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 380.502656][T19389] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 380.505539][T19389] [ 380.507102][T19389] ERROR: Out of memory at tomoyo_realpath_from_path. [ 380.599214][ T5206] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 380.849023][ T5206] usb 7-1: Using ep0 maxpacket: 8 [ 380.968361][ T5206] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 380.972902][ T5206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 16:15:10 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r10, 0x0, 0x0}) 16:15:10 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:10 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 5) 16:15:10 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 6) [ 383.146868][T19397] FAULT_INJECTION: forcing a failure. [ 383.146868][T19397] name failslab, interval 1, probability 0, space 0, times 0 [ 383.147611][T19399] FAULT_INJECTION: forcing a failure. [ 383.147611][T19399] name failslab, interval 1, probability 0, space 0, times 0 16:15:10 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.151571][T19397] CPU: 1 PID: 19397 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.151585][T19397] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.151590][T19397] Call Trace: [ 383.151595][T19397] [ 383.166056][T19397] dump_stack_lvl+0x125/0x1b0 [ 383.167769][T19397] should_fail_ex+0x496/0x5b0 16:15:10 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) [ 383.169476][T19397] should_failslab+0x9/0x20 [ 383.171352][T19397] __kmem_cache_alloc_node+0x2fd/0x350 [ 383.173408][T19397] ? sync_file_alloc+0x3c/0x150 [ 383.175204][T19397] ? dma_fence_signal_timestamp_locked+0x2bf/0x500 [ 383.177561][T19397] kmalloc_trace+0x25/0xe0 [ 383.179187][T19397] sync_file_alloc+0x3c/0x150 16:15:10 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.180900][T19397] sync_file_create+0x17/0xf0 [ 383.182741][T19397] sw_sync_ioctl+0x76b/0xc80 [ 383.184409][T19397] ? bit_wait_timeout+0x160/0x160 [ 383.186298][T19397] ? __fget_files+0x279/0x410 [ 383.187995][T19397] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.190463][T19397] ? __fget_files+0x279/0x410 [ 383.192310][T19397] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.194710][T19397] compat_ptr_ioctl+0x71/0xa0 [ 383.196457][T19397] ? vfs_fileattr_get+0xc0/0xc0 [ 383.198226][T19397] __do_compat_sys_ioctl+0x2bf/0x330 [ 383.200165][T19397] __do_fast_syscall_32+0x61/0xe0 [ 383.202001][T19397] do_fast_syscall_32+0x33/0x70 16:15:10 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, 0x0}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.203740][T19397] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.206346][T19397] RIP: 0023:0xf7f61579 [ 383.207871][T19397] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.214782][T19397] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 16:15:10 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000240)={r8, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r6, 0xc0347c03, &(0x7f0000001180)={{r8, 0x0, 0x0, [0x3ff, 0x95]}, {r4, r9, 0x5, [0x9, 0x1]}, 0x2, [0x6, 0x100]}) [ 383.217893][T19397] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 383.220943][T19397] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.223923][T19397] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.227411][T19397] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.230950][T19397] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.234578][T19397] 16:15:10 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.236032][T19399] CPU: 3 PID: 19399 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.240221][T19399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.243949][T19399] Call Trace: [ 383.245211][T19399] [ 383.246336][T19399] dump_stack_lvl+0x125/0x1b0 [ 383.248100][T19399] should_fail_ex+0x496/0x5b0 [ 383.249882][T19399] should_failslab+0x9/0x20 [ 383.251559][T19399] __kmem_cache_alloc_node+0x2fd/0x350 [ 383.253590][T19399] ? tomoyo_encode2+0x100/0x3d0 [ 383.255454][T19399] ? tomoyo_encode2+0x100/0x3d0 [ 383.257229][T19399] __kmalloc+0x4f/0x100 [ 383.258806][T19399] tomoyo_encode2+0x100/0x3d0 [ 383.260541][T19399] ? rcu_is_watching+0x12/0xb0 [ 383.262358][T19399] tomoyo_encode+0x29/0x50 [ 383.263996][T19399] tomoyo_realpath_from_path+0x196/0x710 [ 383.266283][T19399] tomoyo_check_open_permission+0x2aa/0x3b0 [ 383.268441][T19399] ? tomoyo_path_number_perm+0x590/0x590 [ 383.270492][T19399] ? rcu_is_watching+0x12/0xb0 [ 383.272274][T19399] ? make_vfsuid+0x108/0x160 [ 383.274011][T19399] ? hook_path_mknod+0x670/0x670 [ 383.275954][T19399] ? reacquire_held_locks+0x4b0/0x4b0 [ 383.277906][T19399] ? spin_bug+0x1d0/0x1d0 [ 383.279540][T19399] ? make_vfsgid+0x108/0x160 [ 383.281248][T19399] tomoyo_file_open+0xa8/0xd0 [ 383.282992][T19399] security_file_open+0x6a/0xe0 [ 383.284753][T19399] do_dentry_open+0x538/0x1730 [ 383.286517][T19399] ? may_open+0x1f2/0x400 [ 383.288083][T19399] path_openat+0x19af/0x29c0 [ 383.289775][T19399] ? path_lookupat+0x770/0x770 [ 383.291512][T19399] do_filp_open+0x1de/0x430 [ 383.293172][T19399] ? may_open_dev+0xf0/0xf0 [ 383.294828][T19399] ? expand_files+0x442/0x910 [ 383.296712][T19399] ? _raw_spin_unlock+0x28/0x40 [ 383.298480][T19399] ? alloc_fd+0x2da/0x6c0 [ 383.300041][T19399] do_sys_openat2+0x176/0x1e0 [ 383.301778][T19399] ? build_open_flags+0x690/0x690 [ 383.303586][T19399] __ia32_compat_sys_openat+0x16e/0x200 [ 383.305728][T19399] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 383.307910][T19399] ? ksys_write+0x1a7/0x250 [ 383.309552][T19399] ? rcu_is_watching+0x12/0xb0 [ 383.311279][T19399] __do_fast_syscall_32+0x61/0xe0 [ 383.313092][T19399] do_fast_syscall_32+0x33/0x70 [ 383.314857][T19399] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.317414][T19399] RIP: 0023:0xf7f4f579 [ 383.318972][T19399] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.326021][T19399] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 383.328996][T19399] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 383.331969][T19399] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.334805][T19399] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.337835][T19399] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.340929][T19399] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.344091][T19399] [ 383.346672][ T5206] usb 7-1: string descriptor 0 read error: -71 [ 383.349726][ T5206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 383.353326][ T5206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.357063][T19399] ERROR: Out of memory at tomoyo_realpath_from_path. 16:15:10 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 6) [ 383.360977][ T5206] usb 7-1: can't set config #1, error -71 [ 383.364775][ T5206] usb 7-1: USB disconnect, device number 19 [ 383.368813][T19417] FAULT_INJECTION: forcing a failure. [ 383.368813][T19417] name failslab, interval 1, probability 0, space 0, times 0 [ 383.374401][T19417] CPU: 3 PID: 19417 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.379129][T19417] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.383762][T19417] Call Trace: [ 383.385311][T19417] [ 383.386719][T19417] dump_stack_lvl+0x125/0x1b0 [ 383.389083][T19417] should_fail_ex+0x496/0x5b0 [ 383.391356][T19417] ? __d_alloc+0x32/0xac0 [ 383.393396][T19417] should_failslab+0x9/0x20 [ 383.395557][T19417] kmem_cache_alloc_lru+0x3e6/0x630 [ 383.397994][T19417] ? kasan_save_stack+0x33/0x50 [ 383.400367][T19417] ? kasan_set_track+0x25/0x30 [ 383.402735][T19417] ? sync_file_alloc+0x3c/0x150 [ 383.405045][T19417] ? __d_alloc+0x32/0xac0 [ 383.407097][T19417] __d_alloc+0x32/0xac0 [ 383.409067][T19417] d_alloc_pseudo+0x1c/0x70 [ 383.411245][T19417] alloc_file_pseudo+0xdc/0x240 [ 383.413585][T19417] ? alloc_file+0x7f0/0x7f0 [ 383.415764][T19417] __anon_inode_getfile+0x136/0x3d0 [ 383.418239][T19417] ? __x64_compat_sys_epoll_pwait2+0x290/0x290 [ 383.421109][T19417] sync_file_alloc+0x65/0x150 [ 383.423360][T19417] sync_file_create+0x17/0xf0 [ 383.425587][T19417] sw_sync_ioctl+0x76b/0xc80 [ 383.427770][T19417] ? bit_wait_timeout+0x160/0x160 [ 383.430101][T19417] ? __fget_files+0x279/0x410 [ 383.432314][T19417] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.435378][T19417] ? __fget_files+0x279/0x410 [ 383.437600][T19417] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.440697][T19417] compat_ptr_ioctl+0x71/0xa0 [ 383.442894][T19417] ? vfs_fileattr_get+0xc0/0xc0 [ 383.445142][T19417] __do_compat_sys_ioctl+0x2bf/0x330 [ 383.447618][T19417] __do_fast_syscall_32+0x61/0xe0 [ 383.449982][T19417] do_fast_syscall_32+0x33/0x70 [ 383.452256][T19417] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.455182][T19417] RIP: 0023:0xf7f61579 [ 383.457103][T19417] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.465920][T19417] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 383.469379][T19417] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 383.473033][T19417] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.476188][T19417] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.479150][T19417] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.482827][T19417] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.486512][T19417] 16:15:10 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 7) 16:15:10 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) r4 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, 0x0) r6 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000000240)={r7, 0x0, 0x0}) ioctl$MEDIA_IOC_G_TOPOLOGY(r4, 0xc0487c04, &(0x7f0000001100)={0x0, 0x2, 0x0, &(0x7f0000000c40)=[{}, {}], 0x7, 0x0, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000001040)=[{}, {}, {}], 0x1, 0x0, &(0x7f00000010c0)=[{}]}) 16:15:10 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:10 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 7) 16:15:10 executing program 1: syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000040)={{r1, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:10 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000240)={r6, 0x0, 0x0}) [ 383.517437][T19425] FAULT_INJECTION: forcing a failure. [ 383.517437][T19425] name failslab, interval 1, probability 0, space 0, times 0 16:15:10 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) [ 383.519179][T19426] FAULT_INJECTION: forcing a failure. [ 383.519179][T19426] name failslab, interval 1, probability 0, space 0, times 0 16:15:10 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r5, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) [ 383.523262][T19425] CPU: 2 PID: 19425 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.534021][T19425] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.538688][T19425] Call Trace: [ 383.540399][T19425] [ 383.541778][T19425] dump_stack_lvl+0x125/0x1b0 [ 383.543970][T19425] should_fail_ex+0x496/0x5b0 [ 383.546126][T19425] should_failslab+0x9/0x20 [ 383.547771][T19425] kmem_cache_alloc+0x33a/0x3b0 [ 383.550003][T19425] alloc_empty_file+0x73/0x1d0 [ 383.552237][T19425] alloc_file+0x5e/0x7f0 [ 383.553848][T19425] alloc_file_pseudo+0x174/0x240 [ 383.556028][T19425] ? alloc_file+0x7f0/0x7f0 [ 383.557891][T19425] __anon_inode_getfile+0x136/0x3d0 [ 383.560308][T19425] ? __x64_compat_sys_epoll_pwait2+0x290/0x290 [ 383.563153][T19425] sync_file_alloc+0x65/0x150 [ 383.565258][T19425] sync_file_create+0x17/0xf0 [ 383.567135][T19425] sw_sync_ioctl+0x76b/0xc80 [ 383.569265][T19425] ? bit_wait_timeout+0x160/0x160 [ 383.571463][T19425] ? __fget_files+0x279/0x410 [ 383.573217][T19425] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.575965][T19425] ? __fget_files+0x279/0x410 [ 383.578040][T19425] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.580512][T19425] compat_ptr_ioctl+0x71/0xa0 [ 383.582279][T19425] ? vfs_fileattr_get+0xc0/0xc0 [ 383.584030][T19425] __do_compat_sys_ioctl+0x2bf/0x330 [ 383.586193][T19425] __do_fast_syscall_32+0x61/0xe0 [ 383.588021][T19425] do_fast_syscall_32+0x33/0x70 [ 383.589784][T19425] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.592043][T19425] RIP: 0023:0xf7f61579 [ 383.593514][T19425] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.600643][T19425] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 383.603736][T19425] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 383.606871][T19425] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.610034][T19425] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.613038][T19425] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.616446][T19425] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.619376][T19425] [ 383.620516][T19426] CPU: 3 PID: 19426 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.625292][T19426] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.630008][T19426] Call Trace: [ 383.631572][T19426] [ 383.632964][T19426] dump_stack_lvl+0x125/0x1b0 [ 383.635159][T19426] should_fail_ex+0x496/0x5b0 [ 383.637340][T19426] should_failslab+0x9/0x20 [ 383.639472][T19426] __kmem_cache_alloc_node+0x2fd/0x350 [ 383.642078][T19426] ? virtual_ncidev_open+0x49/0x220 [ 383.644496][T19426] kmalloc_trace+0x25/0xe0 [ 383.646597][T19426] virtual_ncidev_open+0x49/0x220 [ 383.649053][T19426] ? virtual_ncidev_read+0x4e0/0x4e0 [ 383.651530][T19426] misc_open+0x3da/0x4c0 [ 383.653485][T19426] ? misc_devnode+0x120/0x120 [ 383.655611][T19426] chrdev_open+0x277/0x700 [ 383.657787][T19426] ? __unregister_chrdev+0x100/0x100 [ 383.660241][T19426] ? fsnotify_perm.part.0+0x25d/0x630 [ 383.662772][T19426] ? fsnotify_perm.part.0+0x268/0x630 [ 383.665266][T19426] do_dentry_open+0x88b/0x1730 [ 383.667500][T19426] ? __unregister_chrdev+0x100/0x100 [ 383.669945][T19426] ? may_open+0x1f2/0x400 [ 383.671961][T19426] path_openat+0x19af/0x29c0 [ 383.674143][T19426] ? path_lookupat+0x770/0x770 [ 383.676380][T19426] do_filp_open+0x1de/0x430 [ 383.678510][T19426] ? may_open_dev+0xf0/0xf0 [ 383.680635][T19426] ? expand_files+0x442/0x910 [ 383.682866][T19426] ? _raw_spin_unlock+0x28/0x40 [ 383.685144][T19426] ? alloc_fd+0x2da/0x6c0 [ 383.687177][T19426] do_sys_openat2+0x176/0x1e0 [ 383.689386][T19426] ? build_open_flags+0x690/0x690 [ 383.691725][T19426] __ia32_compat_sys_openat+0x16e/0x200 [ 383.694224][T19426] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 383.696764][T19426] ? ksys_write+0x1a7/0x250 [ 383.698890][T19426] ? rcu_is_watching+0x12/0xb0 [ 383.701095][T19426] __do_fast_syscall_32+0x61/0xe0 [ 383.703447][T19426] do_fast_syscall_32+0x33/0x70 [ 383.705716][T19426] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.708646][T19426] RIP: 0023:0xf7f4f579 [ 383.710553][T19426] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.718923][T19426] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 383.722686][T19426] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 383.726168][T19426] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.729691][T19426] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.733020][T19426] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.736543][T19426] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.740091][T19426] 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) 16:15:11 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 8) 16:15:11 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 8) 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) [ 383.758193][T19442] FAULT_INJECTION: forcing a failure. [ 383.758193][T19442] name failslab, interval 1, probability 0, space 0, times 0 [ 383.759322][T19441] FAULT_INJECTION: forcing a failure. [ 383.759322][T19441] name failslab, interval 1, probability 0, space 0, times 0 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) [ 383.764803][T19442] CPU: 1 PID: 19442 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.773170][T19442] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.779937][T19442] Call Trace: [ 383.782500][T19442] [ 383.784054][T19442] dump_stack_lvl+0x125/0x1b0 [ 383.786339][T19442] should_fail_ex+0x496/0x5b0 [ 383.788592][T19442] should_failslab+0x9/0x20 [ 383.790729][T19442] kmem_cache_alloc+0x33a/0x3b0 [ 383.792761][T19442] security_file_alloc+0x41/0x250 [ 383.794758][T19442] ? kmem_cache_alloc+0x34e/0x3b0 [ 383.796868][T19442] init_file+0xb9/0x2d0 [ 383.798418][T19442] alloc_empty_file+0x91/0x1d0 [ 383.800186][T19442] alloc_file+0x5e/0x7f0 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.801778][T19442] alloc_file_pseudo+0x174/0x240 [ 383.803815][T19442] ? alloc_file+0x7f0/0x7f0 [ 383.805524][T19442] __anon_inode_getfile+0x136/0x3d0 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) [ 383.807444][T19442] ? __x64_compat_sys_epoll_pwait2+0x290/0x290 [ 383.809879][T19442] sync_file_alloc+0x65/0x150 [ 383.811609][T19442] sync_file_create+0x17/0xf0 [ 383.813335][T19442] sw_sync_ioctl+0x76b/0xc80 [ 383.815070][T19442] ? bit_wait_timeout+0x160/0x160 [ 383.817024][T19442] ? __fget_files+0x279/0x410 [ 383.818776][T19442] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.821199][T19442] ? __fget_files+0x279/0x410 [ 383.822962][T19442] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 383.825539][T19442] compat_ptr_ioctl+0x71/0xa0 [ 383.827324][T19442] ? vfs_fileattr_get+0xc0/0xc0 [ 383.829135][T19442] __do_compat_sys_ioctl+0x2bf/0x330 [ 383.831100][T19442] __do_fast_syscall_32+0x61/0xe0 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.832958][T19442] do_fast_syscall_32+0x33/0x70 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) [ 383.834962][T19442] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.837674][T19442] RIP: 0023:0xf7f61579 [ 383.839197][T19442] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.846846][T19442] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 383.849976][T19442] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 383.852980][T19442] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.856056][T19442] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.859052][T19442] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.862045][T19442] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.864986][T19442] [ 383.866188][T19441] CPU: 2 PID: 19441 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 383.870921][T19441] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 383.875486][T19441] Call Trace: [ 383.877073][T19441] [ 383.878477][T19441] dump_stack_lvl+0x125/0x1b0 [ 383.880682][T19441] should_fail_ex+0x496/0x5b0 [ 383.882916][T19441] should_failslab+0x9/0x20 [ 383.885055][T19441] __kmem_cache_alloc_node+0x2fd/0x350 [ 383.887608][T19441] ? nci_allocate_device+0x105/0x430 [ 383.890110][T19441] kmalloc_trace+0x25/0xe0 [ 383.892194][T19441] nci_allocate_device+0x105/0x430 [ 383.894592][T19441] virtual_ncidev_open+0x6f/0x220 [ 383.896942][T19441] ? virtual_ncidev_read+0x4e0/0x4e0 [ 383.899395][T19441] misc_open+0x3da/0x4c0 [ 383.901353][T19441] ? misc_devnode+0x120/0x120 [ 383.903551][T19441] chrdev_open+0x277/0x700 [ 383.905620][T19441] ? __unregister_chrdev+0x100/0x100 [ 383.907580][T19441] ? fsnotify_perm.part.0+0x25d/0x630 [ 383.909506][T19441] ? fsnotify_perm.part.0+0x268/0x630 [ 383.911415][T19441] do_dentry_open+0x88b/0x1730 [ 383.913127][T19441] ? __unregister_chrdev+0x100/0x100 [ 383.915029][T19441] ? may_open+0x1f2/0x400 [ 383.916587][T19441] path_openat+0x19af/0x29c0 [ 383.918263][T19441] ? path_lookupat+0x770/0x770 [ 383.919987][T19441] do_filp_open+0x1de/0x430 [ 383.921657][T19441] ? may_open_dev+0xf0/0xf0 [ 383.923338][T19441] ? expand_files+0x442/0x910 [ 383.925054][T19441] ? _raw_spin_unlock+0x28/0x40 [ 383.926851][T19441] ? alloc_fd+0x2da/0x6c0 [ 383.928424][T19441] do_sys_openat2+0x176/0x1e0 [ 383.930202][T19441] ? build_open_flags+0x690/0x690 [ 383.932177][T19441] __ia32_compat_sys_openat+0x16e/0x200 [ 383.934230][T19441] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 383.936247][T19441] ? ksys_write+0x1a7/0x250 [ 383.937894][T19441] ? rcu_is_watching+0x12/0xb0 [ 383.939629][T19441] __do_fast_syscall_32+0x61/0xe0 [ 383.941445][T19441] do_fast_syscall_32+0x33/0x70 [ 383.943217][T19441] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 383.945474][T19441] RIP: 0023:0xf7f4f579 [ 383.946950][T19441] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 383.953774][T19441] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 383.956761][T19441] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 383.959602][T19441] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 383.962455][T19441] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 383.965278][T19441] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 383.968093][T19441] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 383.970926][T19441] 16:15:11 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 9) 16:15:11 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 9) 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{0x80000000, 0x0, 0x6, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000240)={r3, 0x0, 0x0}) [ 383.987262][T19461] FAULT_INJECTION: forcing a failure. 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x0, [0x2, 0x77bfe58e]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 383.987262][T19461] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 383.989420][T19462] FAULT_INJECTION: forcing a failure. 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') r2 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)}) [ 383.989420][T19462] name failslab, interval 1, probability 0, space 0, times 0 [ 383.993986][T19461] CPU: 2 PID: 19461 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 384.002164][T19461] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 384.006533][T19461] Call Trace: [ 384.007999][T19461] [ 384.009289][T19461] dump_stack_lvl+0x125/0x1b0 [ 384.011362][T19461] should_fail_ex+0x496/0x5b0 [ 384.013434][T19461] _copy_to_user+0x30/0xb0 [ 384.015400][T19461] sw_sync_ioctl+0x7f7/0xc80 [ 384.017475][T19461] ? bit_wait_timeout+0x160/0x160 [ 384.019736][T19461] ? __fget_files+0x279/0x410 [ 384.021851][T19461] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 384.024802][T19461] ? __fget_files+0x279/0x410 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) [ 384.026904][T19461] ? trace_event_raw_event_sync_timeline+0x350/0x350 [ 384.030103][T19461] compat_ptr_ioctl+0x71/0xa0 [ 384.032182][T19461] ? vfs_fileattr_get+0xc0/0xc0 [ 384.034360][T19461] __do_compat_sys_ioctl+0x2bf/0x330 [ 384.036709][T19461] __do_fast_syscall_32+0x61/0xe0 [ 384.038950][T19461] do_fast_syscall_32+0x33/0x70 [ 384.041110][T19461] entry_SYSENTER_compat_after_hwframe+0x70/0x82 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') [ 384.043928][T19461] RIP: 0023:0xf7f61579 [ 384.045908][T19461] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 384.054372][T19461] RSP: 002b:00000000f7f5c5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 384.058061][T19461] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0285700 [ 384.061209][T19461] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.064662][T19461] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.068160][T19461] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 384.071476][T19461] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.074931][T19461] [ 384.076315][T19462] CPU: 0 PID: 19462 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 16:15:11 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) (fail_nth: 10) [ 384.081161][T19462] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 384.086014][T19462] Call Trace: [ 384.087501][T19462] [ 384.088891][T19462] dump_stack_lvl+0x125/0x1b0 [ 384.091063][T19462] should_fail_ex+0x496/0x5b0 [ 384.093231][T19462] should_failslab+0x9/0x20 [ 384.095352][T19462] __kmem_cache_alloc_node+0x2fd/0x350 [ 384.097820][T19462] ? nfc_allocate_device+0x15b/0x5e0 [ 384.098470][T19472] FAULT_INJECTION: forcing a failure. [ 384.098470][T19472] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 384.100201][T19462] kmalloc_trace+0x25/0xe0 [ 384.107105][T19462] nfc_allocate_device+0x15b/0x5e0 [ 384.109496][T19462] ? __init_swait_queue_head+0xca/0x150 [ 384.112096][T19462] nci_allocate_device+0x23b/0x430 [ 384.114034][T19462] virtual_ncidev_open+0x6f/0x220 [ 384.115892][T19462] ? virtual_ncidev_read+0x4e0/0x4e0 [ 384.117796][T19462] misc_open+0x3da/0x4c0 [ 384.119333][T19462] ? misc_devnode+0x120/0x120 [ 384.121482][T19462] chrdev_open+0x277/0x700 [ 384.123573][T19462] ? __unregister_chrdev+0x100/0x100 [ 384.126033][T19462] ? fsnotify_perm.part.0+0x25d/0x630 [ 384.128521][T19462] ? fsnotify_perm.part.0+0x268/0x630 [ 384.131073][T19462] do_dentry_open+0x88b/0x1730 [ 384.133338][T19462] ? __unregister_chrdev+0x100/0x100 [ 384.135818][T19462] ? may_open+0x1f2/0x400 [ 384.137855][T19462] path_openat+0x19af/0x29c0 [ 384.139782][T19462] ? path_lookupat+0x770/0x770 [ 384.141946][T19462] do_filp_open+0x1de/0x430 [ 384.144065][T19462] ? may_open_dev+0xf0/0xf0 [ 384.146168][T19462] ? expand_files+0x442/0x910 [ 384.148354][T19462] ? _raw_spin_unlock+0x28/0x40 [ 384.150601][T19462] ? alloc_fd+0x2da/0x6c0 [ 384.152612][T19462] do_sys_openat2+0x176/0x1e0 [ 384.154800][T19462] ? build_open_flags+0x690/0x690 [ 384.157110][T19462] __ia32_compat_sys_openat+0x16e/0x200 [ 384.159818][T19462] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 384.162373][T19462] ? ksys_write+0x1a7/0x250 [ 384.164469][T19462] ? rcu_is_watching+0x12/0xb0 [ 384.166683][T19462] __do_fast_syscall_32+0x61/0xe0 [ 384.169010][T19462] do_fast_syscall_32+0x33/0x70 [ 384.171257][T19462] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 384.174138][T19462] RIP: 0023:0xf7f4f579 [ 384.176019][T19462] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 384.184758][T19462] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 384.188440][T19462] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 384.191888][T19462] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.195338][T19462] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.198758][T19462] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 384.202227][T19462] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.205663][T19462] [ 384.207042][T19472] CPU: 2 PID: 19472 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 384.210960][T19472] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 384.214591][T19472] Call Trace: [ 384.215874][T19472] [ 384.216948][T19472] dump_stack_lvl+0x125/0x1b0 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2, 0x0, 0x0, [0x2]}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) r1 = openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r1, 0x4068aea3, &(0x7f0000000300)={0xa3, 0x0, &(0x7f0000000040)}) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') [ 384.218665][T19472] should_fail_ex+0x496/0x5b0 16:15:11 executing program 3: openat$drirender128(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, 0x0) capset(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) (fail_nth: 10) [ 384.220570][T19472] _copy_to_user+0x30/0xb0 [ 384.222477][T19472] simple_read_from_buffer+0xd0/0x150 [ 384.224456][T19472] proc_fail_nth_read+0x1b0/0x290 [ 384.226448][T19472] ? proc_sessionid_read+0x290/0x290 [ 384.228359][T19472] ? security_file_permission+0xdc/0x100 [ 384.230445][T19472] ? proc_sessionid_read+0x290/0x290 [ 384.232343][T19472] vfs_read+0x1ce/0x930 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2}, {0x80000000, 0x0, 0x7, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 384.233892][T19472] ? kernel_read+0x1b0/0x1b0 [ 384.235861][T19472] ? __fget_files+0x279/0x410 [ 384.237540][T19472] ksys_read+0x12f/0x250 [ 384.238437][T19478] FAULT_INJECTION: forcing a failure. [ 384.238437][T19478] name failslab, interval 1, probability 0, space 0, times 0 [ 384.238957][T19472] ? vfs_write+0xe40/0xe40 [ 384.245109][T19472] ? rcu_is_watching+0x12/0xb0 [ 384.246995][T19472] __do_fast_syscall_32+0x61/0xe0 [ 384.248815][T19472] do_fast_syscall_32+0x33/0x70 [ 384.250589][T19472] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 384.252885][T19472] RIP: 0023:0xf7f61579 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') 16:15:11 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000000c0)=[{}, {{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000040)={{r2}, {0x80000000, 0x0, 0x0, [0x3ff, 0x7]}, 0x10000000, [0x8, 0x6]}) [ 384.254391][T19472] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 384.261937][T19472] RSP: 002b:00000000f7f5c5e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 384.264972][T19472] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f7f5c670 [ 384.268625][T19472] RDX: 000000000000000f RSI: 00000000f7353ff4 RDI: 0000000000000000 [ 384.272370][T19472] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 16:15:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') [ 384.275530][T19472] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 384.279049][T19472] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.282614][T19472] [ 384.283990][T19478] CPU: 0 PID: 19478 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 384.288567][T19478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 384.292799][T19478] Call Trace: [ 384.294283][T19478] 16:15:11 executing program 0: r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "0706b7c84d84125c4e78874e16281d66a6b5226b76488e4f9ee7cac827f6dee6"}) [ 384.295595][T19478] dump_stack_lvl+0x125/0x1b0 [ 384.297882][T19478] should_fail_ex+0x496/0x5b0 [ 384.299959][T19478] should_failslab+0x9/0x20 [ 384.301970][T19478] __kmem_cache_alloc_node+0x2fd/0x350 [ 384.304351][T19478] ? kvasprintf_const+0x66/0x190 [ 384.306534][T19478] ? kvasprintf_const+0x66/0x190 [ 384.308710][T19478] __kmalloc_node_track_caller+0x50/0x100 [ 384.311226][T19478] kvasprintf+0xbd/0x150 [ 384.313092][T19478] ? bust_spinlocks+0xe0/0xe0 [ 384.315148][T19478] ? rcu_is_watching+0x12/0xb0 [ 384.317265][T19478] kvasprintf_const+0x66/0x190 [ 384.319402][T19478] kobject_set_name_vargs+0x5a/0x130 [ 384.321727][T19478] dev_set_name+0xc8/0x100 [ 384.323721][T19478] ? device_initialize+0x510/0x510 [ 384.325983][T19478] nfc_allocate_device+0x206/0x5e0 [ 384.328217][T19478] nci_allocate_device+0x23b/0x430 [ 384.330470][T19478] virtual_ncidev_open+0x6f/0x220 [ 384.332687][T19478] ? virtual_ncidev_read+0x4e0/0x4e0 [ 384.334935][T19478] misc_open+0x3da/0x4c0 [ 384.336764][T19478] ? misc_devnode+0x120/0x120 [ 384.338822][T19478] chrdev_open+0x277/0x700 [ 384.341016][T19478] ? __unregister_chrdev+0x100/0x100 [ 384.343355][T19478] ? fsnotify_perm.part.0+0x25d/0x630 [ 384.345708][T19478] ? fsnotify_perm.part.0+0x268/0x630 [ 384.348084][T19478] do_dentry_open+0x88b/0x1730 [ 384.350179][T19478] ? __unregister_chrdev+0x100/0x100 [ 384.352494][T19478] ? may_open+0x1f2/0x400 [ 384.354398][T19478] path_openat+0x19af/0x29c0 [ 384.356436][T19478] ? path_lookupat+0x770/0x770 [ 384.358543][T19478] do_filp_open+0x1de/0x430 [ 384.360535][T19478] ? may_open_dev+0xf0/0xf0 [ 384.362517][T19478] ? expand_files+0x442/0x910 [ 384.364509][T19478] ? _raw_spin_unlock+0x28/0x40 [ 384.366643][T19478] ? alloc_fd+0x2da/0x6c0 [ 384.368485][T19478] do_sys_openat2+0x176/0x1e0 [ 384.370526][T19478] ? build_open_flags+0x690/0x690 [ 384.372678][T19478] __ia32_compat_sys_openat+0x16e/0x200 [ 384.375003][T19478] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 384.377307][T19478] ? ksys_write+0x1a7/0x250 [ 384.379288][T19478] ? rcu_is_watching+0x12/0xb0 [ 384.381320][T19478] __do_fast_syscall_32+0x61/0xe0 [ 384.383528][T19478] do_fast_syscall_32+0x33/0x70 [ 384.385629][T19478] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 384.388377][T19478] RIP: 0023:0xf7f4f579 [ 384.390180][T19478] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 384.398528][T19478] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 384.402181][T19478] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 384.405622][T19478] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.409053][T19478] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.412475][T19478] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 384.415916][T19478] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.419354][T19478] [ 384.423714][T19478] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 384.428830][T19478] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 384.432460][T19478] CPU: 0 PID: 19478 Comm: syz-executor.3 Not tainted 6.6.0-rc1-syzkaller-00115-g9fdfb15a3dbf #0 [ 384.436355][T19478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 384.441477][T19478] RIP: 0010:strchr+0x1b/0xb0 [ 384.443632][T19478] Code: 54 ac f7 48 8b 74 24 08 48 8b 14 24 eb 89 90 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 48 89 fa 55 48 c1 ea 03 53 48 83 ec 10 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 51 0f b6 07 89 [ 384.452057][T19478] RSP: 0018:ffffc900068d7610 EFLAGS: 00010282 [ 384.454726][T19478] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc900049f2000 [ 384.458182][T19478] RDX: 0000000000000000 RSI: 0000000000000025 RDI: 0000000000000000 [ 384.461637][T19478] RBP: ffffc900068d76a0 R08: 0000000000000001 R09: 0000000000000000 [ 384.465107][T19478] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900068d76a0 [ 384.468572][T19478] R13: 0000000000000cc0 R14: ffff88801bd30100 R15: 0000000000000001 [ 384.472040][T19478] FS: 0000000000000000(0000) GS:ffff88802c600000(0063) knlGS:00000000f7f4ab40 [ 384.475916][T19478] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 384.478780][T19478] CR2: 00000000f737c0c4 CR3: 000000001d5af000 CR4: 0000000000350ef0 [ 384.482246][T19478] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 384.485690][T19478] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 384.489141][T19478] Call Trace: [ 384.490618][T19478] [ 384.491906][T19478] ? show_regs+0x8f/0xa0 [ 384.493702][T19478] ? die_addr+0x4f/0xd0 [ 384.495536][T19478] ? exc_general_protection+0x154/0x230 [ 384.497865][T19478] ? asm_exc_general_protection+0x26/0x30 [ 384.500265][T19478] ? strchr+0x1b/0xb0 [ 384.502043][T19478] ? __mutex_unlock_slowpath+0x165/0x640 [ 384.504488][T19478] kvasprintf_const+0x25/0x190 [ 384.506582][T19478] kobject_set_name_vargs+0x5a/0x130 [ 384.508908][T19478] kobject_add+0x12a/0x240 [ 384.510870][T19478] ? kset_create_and_add+0x190/0x190 [ 384.513184][T19478] ? do_raw_spin_unlock+0x173/0x230 [ 384.515462][T19478] ? kobject_put+0xbe/0x440 [ 384.517448][T19478] device_add+0x290/0x1ac0 [ 384.519419][T19478] ? reacquire_held_locks+0x4b0/0x4b0 [ 384.521794][T19478] ? __fw_devlink_link_to_consumers.isra.0+0x270/0x270 [ 384.524758][T19478] ? lockdep_init_map_type+0x16d/0x7c0 [ 384.527180][T19478] nfc_register_device+0x41/0x3c0 [ 384.529391][T19478] nci_register_device+0x7f4/0xb80 [ 384.531638][T19478] ? nci_init_complete_req+0x410/0x410 [ 384.534042][T19478] ? lockdep_init_map_type+0x16d/0x7c0 [ 384.536427][T19478] virtual_ncidev_open+0x147/0x220 [ 384.538667][T19478] ? virtual_ncidev_read+0x4e0/0x4e0 [ 384.540971][T19478] misc_open+0x3da/0x4c0 [ 384.542842][T19478] ? misc_devnode+0x120/0x120 [ 384.544895][T19478] chrdev_open+0x277/0x700 [ 384.546856][T19478] ? __unregister_chrdev+0x100/0x100 [ 384.549112][T19478] ? fsnotify_perm.part.0+0x25d/0x630 [ 384.551428][T19478] ? fsnotify_perm.part.0+0x268/0x630 [ 384.553777][T19478] do_dentry_open+0x88b/0x1730 [ 384.555880][T19478] ? __unregister_chrdev+0x100/0x100 [ 384.558195][T19478] ? may_open+0x1f2/0x400 [ 384.559753][T19478] path_openat+0x19af/0x29c0 [ 384.561805][T19478] ? path_lookupat+0x770/0x770 [ 384.563892][T19478] do_filp_open+0x1de/0x430 [ 384.565898][T19478] ? may_open_dev+0xf0/0xf0 [ 384.567892][T19478] ? expand_files+0x442/0x910 [ 384.569953][T19478] ? _raw_spin_unlock+0x28/0x40 [ 384.572100][T19478] ? alloc_fd+0x2da/0x6c0 [ 384.573969][T19478] do_sys_openat2+0x176/0x1e0 [ 384.575950][T19478] ? build_open_flags+0x690/0x690 [ 384.578075][T19478] __ia32_compat_sys_openat+0x16e/0x200 [ 384.580454][T19478] ? __x64_compat_sys_open+0x1d0/0x1d0 [ 384.582686][T19478] ? ksys_write+0x1a7/0x250 [ 384.584574][T19478] ? rcu_is_watching+0x12/0xb0 [ 384.586544][T19478] __do_fast_syscall_32+0x61/0xe0 [ 384.588602][T19478] do_fast_syscall_32+0x33/0x70 [ 384.590724][T19478] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 384.593483][T19478] RIP: 0023:0xf7f4f579 [ 384.595274][T19478] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 384.603636][T19478] RSP: 002b:00000000f7f4a5ac EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 384.607032][T19478] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000080 [ 384.610490][T19478] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.613937][T19478] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.617387][T19478] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 384.620832][T19478] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.624297][T19478] [ 384.625655][T19478] Modules linked in: [ 384.628866][T19478] ---[ end trace 0000000000000000 ]--- [ 384.630951][T19478] RIP: 0010:strchr+0x1b/0xb0 [ 384.632827][T19478] Code: 54 ac f7 48 8b 74 24 08 48 8b 14 24 eb 89 90 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 48 89 fa 55 48 c1 ea 03 53 48 83 ec 10 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 51 0f b6 07 89 [ 384.641091][T19478] RSP: 0018:ffffc900068d7610 EFLAGS: 00010282 [ 384.643340][T19478] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc900049f2000 [ 384.646197][T19478] RDX: 0000000000000000 RSI: 0000000000000025 RDI: 0000000000000000 [ 384.650297][T19478] RBP: ffffc900068d76a0 R08: 0000000000000001 R09: 0000000000000000 [ 384.653778][T19478] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900068d76a0 [ 384.656682][T19478] R13: 0000000000000cc0 R14: ffff88801bd30100 R15: 0000000000000001 [ 384.659672][T19478] FS: 0000000000000000(0000) GS:ffff88802c800000(0063) knlGS:00000000f7f4ab40 [ 384.662899][T19478] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 384.665262][T19478] CR2: 000000c00021a168 CR3: 000000001d5af000 CR4: 0000000000350ee0 [ 384.668189][T19478] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 384.671804][T19478] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 384.674749][T19478] Kernel panic - not syncing: Fatal exception [ 384.677652][T19478] Kernel Offset: disabled [ 384.679246][T19478] Rebooting in 86400 seconds.. VM DIAGNOSIS: 16:15:11 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000051 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff849be025 RDI=ffffffff92556d40 RBP=ffffffff92556d00 RSP=ffffc900068d6ff8 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=6572617764726148 R12=0000000000000000 R13=0000000000000051 R14=ffffffff849bdfc0 R15=0000000000000000 RIP=ffffffff849be04f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff88802c600000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f737c0c4 CR3=000000001d5af000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6033ca810d235656 1c847530638c796e ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 94974b34ea66cf54 584fae6d7e811184 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a45ed1f85b94243d 27a94b18f9395b3e ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 1824e9ee2e8e9945 6984683754b3d17b ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000034400 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 bbc5d2fe003060e2 00000000000000e9 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 002af2dfbc4a2050 cd23768ccd17e7ae ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 bbea2ee6000000e9 00000000000000e9 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000e9 008807f200000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4866272b4d353e16 d2f8324dbad4f27e ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a041593d09999168 a83801f0e93fb261 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=000000e9cfbfa886 RBX=ffff88802c728240 RCX=00000000000006e0 RDX=00000000000000e9 RSI=ffff88802c728240 RDI=000000000005329d RBP=000000000005329d RSP=ffffc900037d7b10 R8 =0000000000000005 R9 =000000000000003f R10=0000000000000019 R11=0000000000000000 R12=0000000000000001 R13=0000000000000019 R14=0000000000000001 R15=ffff88802c72b940 RIP=ffffffff8137e147 RFL=00000003 [------C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff88802c700000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000057727480 CR3=0000000059e77000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000249454 RBX=0000000000000002 RCX=ffffffff8a3f00ae RDX=ffffed1005906dbe RSI=ffffffff8ae928a0 RDI=ffffffff8162d78e RBP=ffffed1002857480 RSP=ffffc90000467e10 R8 =0000000000000000 R9 =ffffed1005906dbd R10=ffff88802c836deb R11=0000000000000000 R12=0000000000000002 R13=ffff8880142ba400 R14=ffffffff8ece2590 R15=0000000000000000 RIP=ffffffff8a3f12ff RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802c800000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000c00021a168 CR3=000000001d5af000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000000 RBX=0000000000000001 RCX=ffffffff813208a9 RDX=ffff888014ad8000 RSI=0000000000000100 RDI=0000000000000001 RBP=ffffc900005a78e0 RSP=ffffc900005a7840 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=1ffff1100c463247 R12=ffffc900005a7850 R13=ffffffff817571e0 R14=ffffc900005a7910 R15=ffff888014ad8000 RIP=ffffffff8187c8d2 RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802c900000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f7354170 CR3=0000000059e77000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000