)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0xb8000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r6) ioctl$sock_FIOGETOWN(r6, 0x8903, &(0x7f0000000280)) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc, 0x1, 'ingress\x00'}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x24}}, 0x0) 05:02:20 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 172.835490] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 05:02:20 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x0) [ 172.941800] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:20 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) prlimit64(r0, 0xe, &(0x7f0000000100)={0x7fffffff, 0x89}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x1, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000000500)=[{{&(0x7f0000000340)=@nfc_llcp, 0x80, &(0x7f0000000540)=[{&(0x7f00000003c0)=""/82, 0x52}], 0x1}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfffffd93}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f00000005c0)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @ipv4={[], [], @loopback}, @local}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x2, 0x3, 0x0, 0xdecc0e58992a718b, 0x80000000}}) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x0) 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:20 executing program 2: socket$inet_sctp(0x2, 0x0, 0x84) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00'}) lseek(0xffffffffffffffff, 0x7ffffc, 0x1) faccessat(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x101) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRESDEC=r2, @ANYBLOB="000b00010067726574617000000c000280080001006e55e8a93d6c5669fbe03157d0d98e79aa06e229c6a780d8a193104dbe1b08345fc5db0bad39b411c336169db35086d9bb933987a5f9186c2648b2cd3332b2897c7d70cb73d80af68f5ebcfaea03ec8a162d61a637e264c37edfbf0af9c595ea59764fae9018fdffe4c252a5d75122fd929fd27b629c6e2ad5344d144a62bc0f51288b288026c89069ab5a792a8d70993c5e25bd780cd576fdb061b8e4aed288b0996819d68687952aeb6a226b0a3fb78d6c84382365d08ebfb0581e9b2ea035d575da82324e2c35084148cd6a42aad32ddcff8e2625a7694736560641fde183747f4e77e0c0fa4bed2a3dc3", @ANYRES64, @ANYBLOB="7ae50e37aecba0d13c7d4c2fbfba880b0147eb3100000000000000a9d5c425f4c0d445fecbb658df209f96f0627618eb5ab06992b5dffd4994f9a3bd4a972aa133d2d85e17b6df617f7401245e1a7f5272faefb59812211d21aca7b5432c249d0a94dd6d38a0ab02e88a04a47c845d192bf267aa8016400f13a5910f5c955131da71d268b16b7409fc0e40bba7a174adde454fba6dcadfcba0e06675acb60d177018c4d8e4c7f2e24f4360723813ad1fea07ef3f036ca58e4e45c67965442d", @ANYRESDEC, @ANYRESDEC=r4], 0x44}, 0x1, 0x0, 0x0, 0x2000c011}, 0x0) r7 = socket(0x200000000000011, 0x3, 0x0) getsockopt$packet_buf(r7, 0x107, 0x12, &(0x7f0000651000)=""/234, &(0x7f0000000100)=0xea) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x0) 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 173.274490] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) [ 173.407146] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) 05:02:20 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000002c0)=[@textreal={0x8, &(0x7f0000000000)="0f22270fc76ca7baa00066ed66b91e0100000f320f20d8b135200000000f20d80f22d8f30fbcf80f3581d90c0066f2ba5f57160fc77c01", 0x37}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_NMI(r2, 0xae9a) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000000c0)={0x0, @can, @xdp={0x2c, 0x2, 0x0, 0x14}, @isdn={0x22, 0x5, 0x0, 0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='virt_wifi0\x00'}) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000002c40)=[{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)="caa01580fb", 0x5}], 0x1}], 0x1, 0x0) setsockopt$RDS_RECVERR(0xffffffffffffffff, 0x114, 0x5, &(0x7f0000000080), 0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) 05:02:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) 05:02:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 173.696371] kvm: emulating exchange as write 05:02:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) 05:02:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) 05:02:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000200)) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000200)) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x0, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:22 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000580)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0x1c0, 0xc0, 0xc0, 0xc0, 0x0, 0x288, 0x2d0, 0x2d0, 0x2d0, 0x288, 0x4, 0x0, {[{{@ip={@rand_addr, @empty, 0x0, 0x0, '\x00', 'syzkaller0\x00', {}, {}, 0x1}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@icmp={{0x28, 'icmp\x00'}, {0x0, "bd38"}}]}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'vxcan1\x00', 'veth0_to_hsr\x00'}, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}}}, {{@uncond, 0x0, 0x130, 0x158, 0x0, {}, [@common=@unspec=@string={{0xc0, 'string\x00'}, {0x0, 0x370f, 'bm\x00', "9426a6f8e655a1092027027303b21c30ede1cbe70859dbc2a7c4e466d4312684259b63bcab9c2b060070e3ba84ba9a61bfe1d16b6155833697c536713465aa01b96ef6a93cc4414e13418a2f088bf9c41186d6a1d52b438f1f2ae7f75ae2b086d69314bca15afae5d120a2198b2966aa9e1c9fdce048b18a386028dbb5063e87", 0xd}}]}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000300)='fd/3\x00') write$cgroup_type(r6, &(0x7f0000000000)='threaded\x00', 0x9) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(r5, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r7}}) r8 = dup(0xffffffffffffffff) r9 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r8, @ANYBLOB="00fa08ffff000000001ceecee049422a7371b47f71963627f0305cbc0c5a3894e694d081439cb38f0a5ce86c4bd14b1121366cdd88c55a9bb604c379f0cf64eced90d41524e2582f47762e08e8c774ff228d9c844bc902ec61a5e966e11ebfd87a323656ea514175cff723a1b264f4bbc79ecc0d6e973bb19ec4bdd30fad166efbd154877ce351d5cc2ef03c3f9e291ad6842c4ff6cd3de196896b57e308a1ff4610a5551013a23bfc597653f5ad1f820cb28462", @ANYRESHEX=r10, @ANYBLOB=',k']) fchown(0xffffffffffffffff, r7, r10) connect$inet(r5, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r5, 0x0, 0x30005, 0x0) [ 174.768335] ip_tables: iptables: counters copy to user failed while replacing table 05:02:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000200)) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x0, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x0, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) 05:02:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x284600) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') r6 = syz_open_dev$dri(&(0x7f0000000300)='/dev/dri/card#\x00', 0x0, 0x0) r7 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r7, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r6, 0x40086424, &(0x7f0000000040)={r8}) ioctl$DRM_IOCTL_GET_CTX(0xffffffffffffffff, 0xc0086423, &(0x7f00000002c0)={r8}) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000422}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x74, r5, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x3}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3ff, 0x2}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x5, 0x2}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0xffffffffffffffff}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xfa4}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x7fffffff, 0x1}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x7ff, 0x3}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4005}, 0x4000000) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) 05:02:22 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) 05:02:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x422081, 0x100) mmap$usbmon(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2, 0x10, r1, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f00000000c0)) 05:02:22 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="ebe7f68fdb66732e666134000204015bf170fff80000", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000080)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0) write$binfmt_aout(r2, &(0x7f0000000300)=ANY=[], 0xe) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = syz_open_dev$dri(&(0x7f0000000300)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r4, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r3, 0x40086424, &(0x7f0000000040)={r5}) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000000)={r5, 0x4}) perf_event_open(&(0x7f0000000800)={0x2, 0x70, 0x0, 0x0, 0x0, 0x5, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, @perf_config_ext, 0x1c84}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000280)='./bus\x00') sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) creat(&(0x7f0000000780)='./bus\x00', 0x0) [ 175.635071] ubi0: attaching mtd0 05:02:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:23 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) [ 175.691916] ubi0: scanning is finished [ 175.708378] FAT-fs (loop4): invalid media value (0x00) [ 175.714014] ubi0: empty MTD device detected [ 175.744849] FAT-fs (loop4): Can't find a valid FAT filesystem 05:02:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:23 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:23 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x0) 05:02:23 executing program 5 (fault-call:5 fault-nth:0): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 176.034419] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 176.058097] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 176.074249] FAULT_INJECTION: forcing a failure. [ 176.074249] name failslab, interval 1, probability 0, space 0, times 1 [ 176.084734] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 176.107647] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 176.131511] CPU: 0 PID: 9301 Comm: syz-executor.5 Not tainted 4.14.184-syzkaller #0 [ 176.131547] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 176.139335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 176.139340] Call Trace: [ 176.139363] dump_stack+0x1b2/0x283 [ 176.139383] should_fail.cold+0x10a/0x154 [ 176.139400] should_failslab+0xd6/0x130 [ 176.139414] kmem_cache_alloc_node+0x25f/0x400 [ 176.139429] __alloc_skb+0x9a/0x4c0 [ 176.139443] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 176.139455] ? netlink_autobind.isra.0+0xa9/0x290 [ 176.139467] ? netlink_autobind.isra.0+0x1c5/0x290 [ 176.139481] netlink_sendmsg+0x921/0xbb0 [ 176.139495] ? nlmsg_notify+0x160/0x160 [ 176.139505] ? move_addr_to_kernel.part.0+0xf0/0xf0 [ 176.139523] ? security_socket_sendmsg+0x83/0xb0 [ 176.139535] ? nlmsg_notify+0x160/0x160 [ 176.139546] sock_sendmsg+0xb5/0x100 [ 176.139559] ___sys_sendmsg+0x70a/0x840 [ 176.139582] ? trace_hardirqs_on+0x10/0x10 [ 176.170158] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 176.173864] ? copy_msghdr_from_user+0x380/0x380 [ 176.173880] ? lock_downgrade+0x6e0/0x6e0 [ 176.173898] ? lock_acquire+0x170/0x3f0 [ 176.173910] ? lock_downgrade+0x6e0/0x6e0 [ 176.187521] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3638624677 [ 176.192104] ? __fget+0x226/0x360 [ 176.192118] ? __fget_light+0x199/0x1f0 [ 176.192131] ? sockfd_lookup_light+0xb2/0x160 [ 176.192144] __sys_sendmsg+0xa3/0x120 [ 176.207272] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 176.209899] ? SyS_shutdown+0x160/0x160 [ 176.209911] ? wait_for_completion_io+0x10/0x10 [ 176.209930] ? SyS_read+0x210/0x210 [ 176.209944] ? SyS_clock_settime+0x1a0/0x1a0 [ 176.219910] ubi0: background thread "ubi_bgt0d" started, PID 9299 [ 176.221596] SyS_sendmsg+0x27/0x40 [ 176.221608] ? __sys_sendmsg+0x120/0x120 [ 176.233792] ubi0: detaching mtd0 [ 176.237841] do_syscall_64+0x1d5/0x640 [ 176.237859] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 176.237871] RIP: 0033:0x45cb29 [ 176.330116] RSP: 002b:00007fca3e5bbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 176.337823] RAX: ffffffffffffffda RBX: 00000000004fdde0 RCX: 000000000045cb29 [ 176.345098] RDX: 0000000000000000 RSI: 0000000020000600 RDI: 0000000000000003 [ 176.352372] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 176.359669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 176.366939] R13: 000000000000091d R14: 00000000004d5e88 R15: 00007fca3e5bc6d4 [ 176.381014] ubi0: mtd0 is detached [ 176.384725] ubi0: attaching mtd0 [ 176.389969] ubi0: scanning is finished [ 176.511166] FAT-fs (loop4): invalid media value (0x00) [ 176.516477] FAT-fs (loop4): Can't find a valid FAT filesystem [ 176.548068] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 05:02:23 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:23 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x0) 05:02:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x42acc0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f0000000240)={0x0, &(0x7f00000001c0)}) r3 = msgget$private(0x0, 0x0) msgrcv(r3, &(0x7f0000000040)={0x0, ""/135}, 0xffffff1c, 0x0, 0x0) msgsnd(r3, &(0x7f0000000200)=ANY=[@ANYBLOB='?'], 0x2000, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r5}}) msgctl$IPC_SET(r3, 0x1, &(0x7f00000003c0)={{0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffb, 0xeaf, 0x100}) msgctl$MSG_STAT_ANY(r3, 0xd, &(0x7f0000000100)=""/53) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40086432, &(0x7f0000000080)=0x6) 05:02:24 executing program 4: write$FUSE_NOTIFY_POLL(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x11) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xa}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1d4, &(0x7f0000000200)=[{&(0x7f0000000080)="03f605020314af00031400000000000000000f0000000000000000000500000000004200000000000000000000000000000000000000000000000000200055aa", 0x40, 0x1c0}]) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f00000000c0)) [ 176.665099] ubi0: attaching mtd0 05:02:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x0) [ 176.706154] ubi0: scanning is finished [ 176.838162] ldm_validate_privheads(): Disk read failed. [ 176.844081] loop4: p2 < > p4 [ 176.866866] loop4: partition table partially beyond EOD, truncated [ 176.910533] loop4: p2 size 2 extends beyond EOD, truncated [ 176.918864] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 176.932592] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 176.942321] loop4: p4 size 2097152 extends beyond EOD, truncated [ 176.959525] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 05:02:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) [ 176.985055] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 177.009476] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 177.035862] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 177.055611] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 177.080563] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 177.092396] ldm_validate_privheads(): Disk read failed. [ 177.100854] loop4: p2 < > p4 [ 177.113894] loop4: partition table partially beyond EOD, truncated [ 177.130018] ubi0: background thread "ubi_bgt0d" started, PID 9337 05:02:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) 05:02:24 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 177.152921] loop4: p2 size 2 extends beyond EOD, truncated [ 177.185532] loop4: p4 size 2097152 extends beyond EOD, truncated [ 177.241793] ubi0: detaching mtd0 05:02:24 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010062720964676500000c00028008001b0000000100"], 0x3c}}, 0x0) [ 177.266694] ubi0: mtd0 is detached 05:02:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x24000011}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_TRY_EXT_CTRLS(r4, 0xc0205649, &(0x7f0000004540)={0x9f0000, 0x9, 0x0, r2, 0x0, &(0x7f0000004500)={0x9e0907, 0x6a1, [], @ptr=0x8}}) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r7) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b723000005000000522c35577caea4165566", @ANYRES32=r6, @ANYBLOB="e6aed6bfc5f2ffe94fef8ce1724ab770c83d74a07f9957601206440af5f4fb166031c8d6d4186aa1ef410101a49f4418999d562b6dc514daf0c5d5d6ce0f86d32c6b82ec06b67a58222823bf4b6a8c8e6267"], 0x1c}}, 0x0) 05:02:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) 05:02:24 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 177.311360] ldm_validate_privheads(): Disk read failed. [ 177.339873] loop4: p2 < > p4 [ 177.354639] loop4: partition table partially beyond EOD, truncated 05:02:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) [ 177.389546] loop4: p2 size 2 extends beyond EOD, truncated [ 177.413852] loop4: p4 size 2097152 extends beyond EOD, truncated [ 177.433686] ubi0: attaching mtd0 05:02:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$EVIOCGPHYS(r4, 0x80404507, &(0x7f0000000100)=""/48) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r5) ioctl$sock_bt_cmtp_CMTPCONNADD(r2, 0x400443c8, &(0x7f0000000080)={r5, 0x3}) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r6, 0x8983, &(0x7f0000000000)) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[], 0x1c}}, 0x20000080) [ 177.485880] ubi0: scanning is finished 05:02:24 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x3fffe, 0x66482) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) 05:02:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) 05:02:24 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) read$midi(r1, &(0x7f00000002c0)=""/4096, 0x1000) r2 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) readahead(r1, 0x9, 0x6) ftruncate(r2, 0x2008002) sendfile(r0, r2, 0x0, 0x200fff) 05:02:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_S_PRIORITY(r3, 0x40045644, 0x1) r4 = socket(0x23, 0x4, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) 05:02:24 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) r1 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) [ 177.758342] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 05:02:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000140)={0x418f66df05938265, 0xffff, 0xa3, r0, 0x0, &(0x7f0000000080)={0x9e0903, 0x1, [], @string=&(0x7f0000000000)=0x8}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r6, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$FUSE_DEV_IOC_CLONE(r4, 0x8004e500, &(0x7f0000000240)=r6) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 177.803898] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 177.833308] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 05:02:25 executing program 4: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300)='nl80211\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20108, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f0000000340)={@local}) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x64) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000002c0)={@local, @ipv4={[0x0, 0x0, 0x8], [], @dev}, @initdev={0xfe, 0x88, [0x0, 0x0, 0x0, 0x2], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x100, 0x0, 0x20c200a3, r3}) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x77a0100]}, @rand_addr=' \x01\x00', @loopback, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1040000, r3}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYRES16=r0, @ANYBLOB="000125bd7000fedbdf253100000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900800002000000000008000300", @ANYRES32=r3, @ANYBLOB="c2567cc83a621bf6666f0ae8e247b4371fa5de99425da1a9066df501d81abc70cbd5c1398d8e10b5545557dbac89cf34bc0e5a3b2a9535bd8d35080044d77962c4277b5dec678f0298ad64746476e11262514dacc458f3c6c9a83ef75fa80a2d0c21efbc0161795244c6040adf4bfd12faca2aaa49c05eb553223913768304f7bd0adff381c874c2223e7e8a47f6d3077f537039d14c56d674cb6b73b7bfa79cf6d83ae9799b51c280c548081d62d67d46080e143473db0efadb891c426ff53c4c94954c71b0a7d1c2a7edb4a1d44fef4184d9b7c0df8c809e222447bf11e9787e744bd10c8f6576"], 0x30}, 0x1, 0x0, 0x0, 0xb8e6ed9539689a14}, 0x10) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r4, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) [ 177.855340] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 177.881693] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 177.904025] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 177.927508] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 177.962996] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 177.990865] ubi0: background thread "ubi_bgt0d" started, PID 9406 05:02:25 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:25 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) inotify_add_watch(r2, &(0x7f0000000100)='./file0\x00', 0x0) close(r2) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r6, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SOUND_MIXER_READ_DEVMASK(r6, 0x80044dfe, &(0x7f0000000200)) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x76, &(0x7f0000000440)={r4}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000080)={r4, 0x6, 0x80}, 0x8) r7 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r7, 0x40405515, &(0x7f0000000000)) 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) [ 178.190699] ubi0: detaching mtd0 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) [ 178.222001] ubi0: mtd0 is detached 05:02:25 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x0, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 178.329475] ubi0: attaching mtd0 05:02:25 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x0, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 178.398320] ubi0: scanning is finished 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x0, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) 05:02:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000008c80)=0x0, &(0x7f0000008cc0)=0x4) getpeername$packet(r2, &(0x7f0000008d00)={0x11, 0x0, 0x0}, &(0x7f0000008d40)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r7, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000009740)={&(0x7f0000000000), 0xc, &(0x7f0000009700)={&(0x7f0000008d80)={0x964, 0x0, 0x300, 0x70bd26, 0x25dfdbff, {}, [{{0x8}, {0xc8, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x8000}}, {0x8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x5}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x7ff}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0xfffff801}}, {0x8}}}]}}, {{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x2f}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x24c, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0xfffffffa}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0xfe}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x34, 0x4, [{0xffff, 0x3f, 0x4, 0x7f}, {0xffff, 0x20, 0x1, 0xf31}, {0x1000, 0x4, 0x2, 0x401}, {0x3, 0x9, 0x8, 0xff}, {0x7, 0xd5, 0x3f, 0x5}, {0x5, 0x7f, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8, 0x1, r3}, {0x140, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r4}}}, {0x84, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x54, 0x4, [{0x8, 0x6, 0x0, 0x100}, {0x800, 0x1, 0xff, 0x4}, {0x9, 0x3f, 0x8, 0xfa}, {0x200, 0x7, 0x1f, 0x7}, {0x8ce6, 0x1, 0x2, 0x4}, {0x0, 0x3, 0x0, 0x3a}, {0x400, 0x3f, 0x20, 0x9}, {0x3f, 0x0, 0x5, 0xfffffff9}, {0x0, 0x20, 0x7, 0x800}, {0x894, 0xfa, 0xad, 0xffffffff}]}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r10}}}]}}]}, 0x964}}, 0x4004000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}]}, 0x1c}}, 0x0) [ 178.596602] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 178.609604] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 178.624211] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 178.639897] ubi0: VID header offset: 64 (aligned 64), data offset: 128 05:02:25 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) [ 178.668188] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 178.681299] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 178.708014] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:26 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 178.708865] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 178.732956] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 178.749010] ubi0: background thread "ubi_bgt0d" started, PID 9459 [ 178.763523] ubi0: detaching mtd0 [ 178.787223] ubi0: mtd0 is detached [ 178.792836] ubi0: attaching mtd0 [ 178.819911] ubi0: scanning is finished [ 178.848235] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 178.957180] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 178.964377] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 178.977034] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 178.985400] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 179.011493] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 179.017966] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 179.025435] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:26 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ubi_ctrl\x00', 0x240100, 0x0) ioctl$PPPIOCDISCONN(r0, 0x7439) r1 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f00000002c0)={0x6, @empty, 0x4e24, 0x2, 'none\x00', 0xa, 0x7fff, 0x27}, 0x2c) r6 = dup(r3) getsockname$packet(r6, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r6, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$CAN_RAW_FILTER(r6, 0x65, 0x1, &(0x7f0000000180)=[{}, {}, {}, {}], &(0x7f0000000200)=0x20) r7 = dup(r2) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r7, 0xc0bc5310, &(0x7f0000000080)) 05:02:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) 05:02:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:26 executing program 1: open(0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) setxattr$trusted_overlay_origin(0x0, &(0x7f0000000100)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) fanotify_init(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) readlink(0x0, &(0x7f0000000340)=""/225, 0xe1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000280)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x7, 0x8, 0x1, 0x3}) write$P9_RREADLINK(r1, &(0x7f0000000340)=ANY=[], 0x44) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) [ 179.074191] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 179.095553] ubi0: background thread "ubi_bgt0d" started, PID 9486 [ 179.095987] ubi0: detaching mtd0 [ 179.144056] ubi0: mtd0 is detached 05:02:26 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 179.173469] ubi0: attaching mtd0 [ 179.256269] ubi0: scanning is finished 05:02:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000080)=0x0) ptrace$peek(0x1, r3, &(0x7f00000000c0)) 05:02:26 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) 05:02:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x42000) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) [ 179.512348] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 179.525478] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 179.546060] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 179.560708] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 179.614924] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 179.634689] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 179.653827] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:26 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) dup2(r3, 0xffffffffffffffff) 05:02:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000080)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r4, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f00000000c0)={{0x4, 0x0, 0x8001, 0xfffffffd, 'syz0\x00', 0x400}, 0x1, 0x20, 0x375, r4, 0x0, 0x1000, 'syz1\x00', &(0x7f0000000080), 0x0, [], [0x8c92, 0x6a4e, 0x4, 0x9d5]}) 05:02:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) getsockname$packet(r8, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r8, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$PNPIPE_IFINDEX(r8, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'vxcan1\x00', r3}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000004c0)={&(0x7f0000000640)={0x2c4, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r9}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r10}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8, 0x1, r3}, {0x19c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0xed2b}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x2623}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x7}}}, {0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x3c, 0x4, [{0x45, 0x80, 0x5, 0x9}, {0x4, 0x9, 0x6, 0x7}, {0x1469, 0x9, 0x9, 0x4}, {0x3, 0x5, 0xfc, 0xfe}, {0x3, 0x4, 0xa0}, {0x8, 0x80, 0x9}, {0x7f, 0x8f, 0x2, 0x10001}]}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r3}}}]}}]}, 0x2c4}, 0x1, 0x0, 0x0, 0x20004040}, 0x8804) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:26 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 179.663582] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 179.674043] ubi0: background thread "ubi_bgt0d" started, PID 9527 [ 179.680590] ubi0: detaching mtd0 [ 179.695409] ubi0: mtd0 is detached [ 179.709973] ubi0: attaching mtd0 [ 179.727508] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 179.760876] ubi0: scanning is finished [ 179.855065] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 05:02:27 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_PCM_IOCTL_XRUN(r1, 0x4148, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000002840)=ANY=[@ANYBLOB="3320000016d67593920097e11fd06663870ee46a4ce1f1176d6f212ff8b4c791545052246aec30ca4e09c8beffbe3d78b02083d415accb76bfcd538ffb052b230088efc6f3311a659d888efefd715e53962e1152539ac286d742bfd407cd4097ecac3eee14256a3b9dc402391cf6350d9467f4f3a074cef2afd1932c7562055a195bcb44db78e6ebb3f2aec2e8d7ef2fbeeafe20c97ca394a78abfcb57702a879196678c0fa082dc93bb6eb77a768d57902c8f4a5e4f0d8ad249e853c2f63a693f209dd0c1b30d93fa804cbbbea137b592590b74d158974638f4c2645742910d3d66924b70a10e0da1397534224131421d44beda5ff9786c6601ff146e20ad91b30dae89d5a4f051f675631768514574d11211158e2bffc60d6fb20480bbb3ea54aec403de45ed766bf9e0bdbfc57ec9c92a157cdb5c74bea4a83d4e5d5ad1976653bb0c15ce7da441d8506d872d7b94f2ebfb9da3c09d7012b52cc97556e26edf489b9071f1e09091aa605f881833a49a647b0bd6ccaaa6", @ANYRESDEC, @ANYBLOB="000a00a88cb0c236fbd06ca4cbbbd79f0000", @ANYBLOB="5e03a2ca89f7ce9f659756d33161a962ca6105d2840c4a76f96ad9b35f5092aad6274cd33581c1e8d37caec7e01ef375846661924a262b8e38202cf88a33ff89e6f7daaa9bf2e5377f13634d4fa12b9f48e5b6c48c309d60924c8698687cf89a79485f2a13071f8db3e0fe932be22c10688e2d7b1431baa42f8f4e1e28fac71bb912d56ac979b11bb75d85c4dffdc12f5766bf39e1760216625df8553da9b51a2eb1b008677cdadbdfdc15c8317001a55bc18e903f050f8b19837f13850fa0f733aa019db6f631346e2c36a1f8924372bbdb6080f480935420fb91422c62c769f6fd390041ce43591d071c38b295768f5ee9dea370c1168e23d26da7e792a8d71aff0d0833177ff5802995e9e9858d75be1a5f1b14f5d07aeae755ca77eb16e7666d47bb52a43429a6e39100aa9fa44fdf4c9fc57019a5429a9a7c16ffed8053c73954b0dcbe96d8eaa796ca973f82b5d84817f122acb0d157fdfe011655f383b5962d3e512dd847f4101669813a8b2138089152ed47b5976822b2f328188bb1c68f07f30885408ff276d2951c5298f01e9efabfb810dc8a2ef1adb29203fe1d815efda56e6af62eb856a111c383426f787f63c81df1937013012411b95372cc6667ade10d23b711eaf79fc9ff2179965b1a3f69c7f07bdc8fab58f5ac07ad407d73a0691e643ea758e72298a7c47cdc57b9f7359cff3522a7cfd9664c673f38f4f50deb6dd1445ef4beb11fff631610457d36810cae79534a56de295ed91db67b36836202fe91f2237798180072bb838c32291f5bb8ed623174485250c68e132e5686733df4ccfce73d789a7d3954e10ead9a78f2466b633301e728509671e0b87a13a1e9f14b1668aed12f63c0b8bde5ba69b24a9ba4d1b2cdc375ba14e5614884dcc7d3af30891317e993111c8d0f172821521a341379b01f6f5dc81bdc7ee7f84895b29d485b9e923ffd54bda2460237238ad60cca897b3eef098dbb1dbbb7d8aa76d03d7e475111944ff3e563db5b93e3c113c8c8e6a13916c7c3c63d32a9308409e3780b3239156f37f26d3604a73cac81df217ba104503c5f425ddfab8e07c25fb277db15ffbd970bd74e0d9bf982854df17c5c5de274d2372ea05a49ba471bed773ee2e88080f8d7bba24cd992dcb778e29553b1edb4bac47ac7dcb280c5326aed9e110a694dacfae8c655ecfd0dfaf7355483efce54e45f2c25106fe11bb6ce90723bec8dc8ebd1aedd0b30fa18952796ba6c36fdbe78481b79a71e2b2c76bb567fc54ab443cd6e145e63c5aee8494de079f1ca23902ee981927055496bd8fe10b00dfe2146e9069c4ad1b4c7ffea6b42626f9f599c935553474157dd307574b8ae54be9991a8714419dc56c4492a98be85d4e7690405bd687f962a6a6287ec475357bb5c73ce321a5bb65bd1a3ef3d19bf033a24e7c8013af18bb763a5e11bebd54f33f8a562ffe284cc582af1d0df5046e8ef1623cf515f491b7303a7649270a88e4655813dd158a836b564fab0e2ddf31b7293d876a4de69e2c94c3245d6dc213cab980f4c6189f7a4336c77fbcf6a22c1b9d943b4f96227ff4ae20af867c879b377ae8074e4c3433556ed179dc37c09c585426bf149aacb9487677e7a982627ac8fad95d679bbd7fc3350544cd17443e1f6befd951e34a372921b345c8742ac75d9089c2aab22d6737f03e3e3cb457b144000096f399d0d2a8a2fdaa0d35d8d78d84d2accf6150c05261246e2c00f5c80068b5d066285297a25dba110fe47ee0ee8fe539816daf68fad528cb4a1205bcd08dacbd1964ef7da9e541a39a2db611ba2cc63e51cbfdd388eef862fb727b65fca72e7aef0bb00408430d568a11dcf8d3900ab73c236c3257607e669775a388f307f6b49009896dae0e6e903935be9265588020f6912156e8a05f8b425f758c341fcd46e8ebf68a3323b2ed6ae474638c077714f8b476fc3f9cd6757e9e425d795ec81b7a3841e8df09d080414015ff145063a43adebf7a426631ef65d2e79d99944675a514197897cf983bf3970864e4a446bf77de48a906f9f162b91dcc59c442dedfb57d13346559ab9b2733d8167a108ebda1d17a93d24a2c502378dc9c37696c672e76fbd2b30538802383fd4a7354959cb1bc1e9ee290e24eef17739b932782d3d19a84a4bd8192b8bc5522e59ee4fc3d26de01faca29d3e867b044b01743e5fb93864003515be64fae7667c75f85b1a58f209975704ce5b6d2626f1b6f73e0568db42cded8fd98ed2b0cbb2f3eca44d9e635c4ef1ac83d6271d535f234a3c50044a5a9ecdd12fe7139ffb478cbbe65ed451138bc1ce230c0e27f42f354ee446c2aed562e3c6a031fac892736b2c162953104bbbd4f1ea4debe2081dd1841e7cdf2117cec0f059a8f5d37f6b2571a991c9e349e6cbf5f4f453295c323f278df9645aa5e4d5727a977df40b8f3d4bc4a2d1bf9a0789336d377c2f7d0306aa0dfa3585e8ab30a5a21c5e295f3a59710c6d402ebf6cf07c859f5a767b21ca6532de7700be337b0a5d6aac319eed13c1cea3d860f01cc94ebcfcf6d040666f5af7befd6f7b0aa9dc7d3e12e3087d234e9f0b55cf456927475ca0250944e7820156627dde1c84bd32a6df59b41535d9b54ad61c42d1d17b401c8e30f30b98bacdb775e4ec5b37ed45c6bd78027f6e01efad226dc328922cbc575f9e3b565a12fea3954f8f525310f1a38cad2bf6816935fa5709f971fad9ebad0aa9550121a3eb985f2aeba6269cbadbeee147cb2e725a872de5f2378559c6e90dceed2b42ac21461820884bec180624caa29a6f94f3b699dc84abc968dda2dad2816219e22429cc7c4556dd27f8273c724c7e8e6e490de550a8217c8dd293c399798ca338d49dd966bf81c548e9eaff45d9cbfdc96b0fd12a5c5c8a4ea31b2089fb88f63b3140aecafaaa93367164076e703452a8087845d2db1418b92f4ca17f76a0adccf3ba1412f3c58c709a7bd05fd965ddeb1ccb5a217d3ec70badcb5794d0d1eece6852e288f0c58d1daa946ba7538222658709918ae3c40c07d98a834c387c4e80e2404e675bd1c35da8eb21514705b7cb536e19fb875827a958de4d10b2d41dac78a73b63324bc75e8ab27a80ba7407f50d483936c3863a97d22090020c34a7ee78afaa8b784090045688adfcadc934b7fe92801b6933140dba3c1232f296c9a5e3d7fc5c8b5a0ead2f7dd4d49b13d6850f3b53208c9012b119e2752854549b60f36789c471bff03d7e2b3cb86cf8f7c8aa7d2ea2490867903dddde536f35fd3cf1f9083584014060c11eb39e7d07173486f6e3808995b21d6adf9c849eee37595315727b57c4bf495ed268ffa9d5da073eff285440b2317dec201b2bd65586a8514faad1213c7242150b3603c66fbe019036f5bbe8e0e1576b6791627894e991bf7fc88ef95ecfb6e356c9963041f971cf814ca436a03beba4058c465a8bec39cca9d097daa3dde5dcfebda7c5c70af762c37e58a5041d439fa640aa73c60dc2c2c5bd1d231ebe27dd98dd08058ba3a8de26d1174ea0d2bdc0aee84c37032446b5a127d0abbc8624ff5dc8bf5ee81833dbdd2f0556fc55e798dc887d299c357a70a89b7d0b32b6ae6bf4d1566f1f830dba7b956fb7a945490367380aa5973ba3eaf1954e2b95f5809762a881eddfcaf1f38bd68ce14e6a1d029bf1340197e93c5e537228d767bdaa44a651e9022c5d806638651b9dd35192dc226be28b4c0eaea51766e7d605fb1b67eb66f4f6d31ff2b72279062dac8a165e3694328cbdaaf0423f00f0657c1753bb73d60296ca3cf1090551a3a21218ff0285d63f36de0eec2ce493406ac210d666756465ab3876090526ca4ed5a1ae8bb133938e78b3967249444c6e1d3321c7d70b4d942d962b95cc544fa0e22f2697b160e51584530c85e92c8d2ce912fd7ba8e2ff2f51efce77b5cf9daf28d366de034c6d7a947c9591da164062511d5bdf9a135d42f2319142c2aade5e0345ca88cefbf7dd8b160efbbc65060daf48ad9cd2b163e5d4da4e39366b0dff823fa2afbca9959a18b784adc9f0e761e7effb9a9bd76f8c48d71cf977b173ffb8e919d68cb9cea53e9e8d50e7f0fcd7db8d11cfbd18dbd7db8314b92cd4baaff03e9639f8463fd52af41010ebbf57fe086e0c4c3411d51239a4f131e625bf8a851799813257f774f0ce238f067c80a967625b77d16b847f1510e54cec5439d4f29c3ffcf681a03bba32e1c859aff8ec8a48e4c496e73759fe37b526a83f00344fff8a8d2f696ec6281627ea1595e249ffb2e609ee7bf616577ec5db0736d1c3cc24fda28035295aba3e289a208566775306b842ddc1f333429e73f755596fe6666e60fa86dabed008fff454077fc8027dc26da721ac04fc682ebfec228e7d55ae82056e4abafd9be9f92104da5e3bb8bc0864a20d8569f38231ea5f8bf8f63d5d3cd79477235499287d518da1122e7f316f9884cb5e103ec5c1ab48cb7d5fb48020d71436f623806f1727ffabc223e645e5be2d9ba1c72cb4f4e5039bc24c384c738b0fe72545d6a922e15085594e96f242c1de288340faa14d4f8ac86b981d7db9f438993d4d10cb23bf8a63523c0fd9eeb7a6e85c76960eda2499ead2b62699155e42fb2a19c316a928f865a92f65b066524500056b0491640731ef6638855c18b1e88ec5ba2df4656bf1bf9b763b86dcfa6418e59ad49331472ec1ebd43c1802916975704f6ce6d810bd3ca1c78c1a88363806d46eeb663495c1a85720aa32a3591f0807c2885075b4a919afba6668acfdae5049ea4f8ab770d6d4780e648c22e767ee7b00fd7018c2c575cc5a475bb91c71a8d46647cbbac01437807132c5fcf76680c23b9c55d3bd68add28a0ffc2dbca9c59adcf85bbe505d6bb8c1a525e8957bd7303be0e338a2aef383243428480d27e757b18eaec51c5801f958067f0b194e98f7297e982e9e367ac44273ab8e88b25174152994e0ddeb5f1e022c4e7027b0ec2731a08b1eea105942d1bf94a6619253d03c536808da0e1d2434b57d4ae8859df8795cd3b5f40ead7010a0e8b78f82531344cf3edab15746f86f68d8c5d9f1e6b820550675f9a1ddbad75e84fdc72751adca4ea49cfeb9fc3cd5178ba41565a2749a97028e1eaa568ba0205c18ad489aff1d19071550bcdfea73878b664f7de379a4a48db352905c3aef616a4465c428e2ae429ce30f171ee5b3c1b6bbb4a24c66a56f46c00ec793ff82eef432a4191384bfa4ca14c0dff72a283991019c0664c335c5f17cc22bbca6717dae898aa2014124be11ce972ea7eac0827000dc844b3bf0da0cff52bd6b30788a761790e5aca836ee4044776ab4d978c39382a2bfa874f58440bbe088ad820447120d9dc351b454e695702286d2a67b1d3220b548b899a6e675495860676bbb26f83f281109def31aaa223fbc79458e8d59dcef28c0a12410f3fd6515aa830849578f6cc14e5c4f2f2f2b0ee47494e07074e33fc2526b70e0f7cc9464632ca2867edeea166b0e792bfc09bf0e118f10fc380e013c0d542c117e720710585526f96486ca67637e4e37d6d5e1137b30770864fbaedb35784e941baca04cb8e671cd49edf4ba76bb510ca3db81b71eb4aab4924e51ac20d50d0f197fbed98eb19190e68fb0ed504e12c07c615397a3ca0afda095f1791d013f94d7d3940dfa01311b3b8d718459b182bc94cc138a3ddc623e866e7e11a7e8448bc2fdad253c3ee975f1502b6859846d504291194b406f272a30a78975f38c94371e371f1609f6daa36540489ca06a", @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0xc850) [ 179.991017] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 180.006215] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 180.024912] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 180.050331] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 180.066118] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 180.105662] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 180.128247] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 180.138144] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 180.149619] ubi0: background thread "ubi_bgt0d" started, PID 9564 05:02:27 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="04000000c0209c61a0fcb08e6ba533668bf5ac227a9bc361c732e6b4d715c71d445b4cd90068898ceaed10d057d2d39e22aecae29a7de6ef4c7c6f719de627fbbc22e39b9c8d1d99066e632569edcd361da27584ca6a869e05e745c7c5de69bf98558e21c6c59c8b02907ff0ecedba819ec38d", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) 05:02:27 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 180.164796] ubi0: detaching mtd0 [ 180.169909] ubi0: mtd0 is detached 05:02:27 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:27 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) dup2(r3, 0xffffffffffffffff) [ 180.266705] ubi0: attaching mtd0 05:02:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) dup3(r2, 0xffffffffffffffff, 0x0) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) io_cancel(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0x88, r5, &(0x7f0000000000)="0e99d60a863d7f73ffd97d247b44196febb3316cb8a30a44979a80aaa21041a255e35377cfaf859ac323056666d1de5e8119d36abd0150aa541afc9ed9960de8", 0x40, 0x7f, 0x0, 0x1, r7}, &(0x7f0000000140)) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x0) [ 180.322496] ubi0: scanning is finished 05:02:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) accept4$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14, 0x800) sendmsg$nl_route_sched(r5, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@gettfilter={0x34, 0x2e, 0x100, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x10, 0x52544b39b4810a04}, {0x2}, {0xd, 0xfff1}}, [{0x8, 0xb, 0x15}, {0x8, 0xb, 0xffffffff}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4044010) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) bind$packet(r2, &(0x7f0000000000)={0x11, 0x3, r3, 0x1, 0x3f}, 0x14) [ 180.590970] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 180.644665] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 180.676163] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-monitor\x00', 0x26c801, 0x0) r4 = dup(r3) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000240)=ANY=[@ANYBLOB="080000140800d0010800000009000000"]) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$FS_IOC_GETFSLABEL(r4, 0x81009431, &(0x7f0000000080)) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f0000000180)={0x1, 0x4}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r6, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'geneve1\x00', 0x20}) [ 180.706695] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 180.753996] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 180.790787] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x4}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x6}, @NFULA_CFG_CMD={0x5, 0x1, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x17f}]}, 0x34}, 0x1, 0x0, 0x0, 0x24040041}, 0x14) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x40010}, 0x4004) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00b819", @ANYRES16=r1, @ANYBLOB="b72300000000000000e30900000008000300", @ANYRES32=r5, @ANYBLOB], 0x1c}}, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f0000000080)) setsockopt$inet6_buf(r6, 0x29, 0x2b, &(0x7f0000000000)="78d5ab7d59f4b173bcc6c4", 0xb) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700)='nl80211\x00') setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000480)=@req3={0x6, 0x1, 0x7fff, 0x7978, 0xfffffffb, 0x8, 0x7f}, 0x1c) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYRES16=r8, @ANYBLOB="96af14a8128c6fefa8f1", @ANYRES64=r8], 0x6}, 0x1, 0x0, 0x0, 0x2004ccd1}, 0x4000810) sendmsg$NL80211_CMD_SET_KEY(r7, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="84000000", @ANYRES16=r8, @ANYBLOB="00082abd7000ffdbdf250a0000000900875da343e11dc09707000000000000000000400050800400060009000100cf49d3bda0000000040006000400060005000900000000000c09000000000100040002e602000700000000000800030005ac0f0011000700bb17bb06774ffffef3b6fead9300000010006e8004000100"], 0x84}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x3, 0x2) r1 = semget(0x3, 0x2, 0x420) semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000000080)=""/112) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x0, 0x6}) [ 180.835897] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 180.857953] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x43, 0x3, 0x0, 0x6, 'syz0\x00', 0x7}) [ 180.881003] ubi0: background thread "ubi_bgt0d" started, PID 9594 [ 180.887612] ubi0: detaching mtd0 [ 180.893015] ubi0: mtd0 is detached [ 180.901300] ubi0: attaching mtd0 05:02:28 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 180.953946] ubi0: scanning is finished 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvram\x00', 0x20000, 0x0) ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f00000002c0)={0x3, 0x6, 0x8, 0x0, &(0x7f00000000c0), 0x96, &(0x7f0000000100)=""/150, 0xf5, &(0x7f00000001c0)=""/245}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r5, 0x1, 0x0, 0x0, {{}, {}, {0x14}}}, 0x30}}, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r5, 0x800, 0x70bd28, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x884) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a000000080003003c64452d9b9d67f0d3ba31d163aff6999b5cad88b28cd31e7ee646d770f2589ce499d92855227fce8ee1991cc1249a20b57485ae60e3b6b6dfe00d191b8eb75b81a4ff3862d42c7528f62d5a75c49e2e3712301740e464599e17bd07855bc8cb68608381ad9e2376622e5502b1962ab1f8d3f9fcdcf6a036ce9c2de80b27ee1b3845981ea3499abe92147847f604bf610e0871f49fa8cd4d5ca0a590895a0ababb02c1be5d0351c32fa7e5709831d267a300"/211, @ANYRES32=r7, @ANYBLOB], 0x1c}}, 0x0) [ 181.136421] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 181.146815] ubi0: attaching mtd0 [ 181.187218] ubi0: scanning is finished [ 181.233053] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 181.243064] ubi0: attaching mtd0 [ 181.249177] ubi0: scanning is finished 05:02:28 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) dup2(r3, 0xffffffffffffffff) 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f0000000240)={0x2, 0x2}) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x20, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf000}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x120, r6, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0xbc, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5a1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xbd1a}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff84a552c9}]}, @TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_REF={0x8}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) getsockopt$SO_TIMESTAMP(r3, 0x1, 0x40, &(0x7f0000000280), &(0x7f00000002c0)=0x4) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000100)={0x15, 0x110, 0xfa00, {r7, 0xeb4, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}, @ib={0x1b, 0x9, 0x4, {"b24d8b180f54410ee8044413098019dc"}, 0x200, 0x7fff, 0x800}}}, 0x118) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:28 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x1000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x401, 0x684a00) ioctl$SCSI_IOCTL_DOORUNLOCK(r4, 0x5381) prctl$PR_SET_TIMERSLACK(0x1d, 0x9) r5 = dup(r3) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$ARPT_SO_GET_INFO(r5, 0x0, 0x60, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000140)=0x44) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="08003900080000000000000000004db96d130000000000000000"], 0x1c}}, 0x0) 05:02:28 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) dup2(r3, 0xffffffffffffffff) [ 181.296057] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 181.305953] ubi0: attaching mtd0 05:02:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000)='batadv\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x5, r2, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x90) [ 181.376440] ubi0: scanning is finished 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0xfffffffd, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_G_AUDIO(r4, 0x80345621, &(0x7f0000000080)) ioctl$KDADDIO(r2, 0x4b34, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 181.460281] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 181.535007] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 05:02:28 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x7d, 0x602000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x20, 0x0, 0x0, 0x2}) [ 181.613193] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 181.620560] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 181.629324] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 181.640068] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 181.650737] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 181.664602] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 181.687798] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 181.702449] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 05:02:29 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:29 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x8e000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0xfffffffd, 0x6, 0x0, 0x80000000}) 05:02:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000380)={{{@in=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000480)=0xe8) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r8}}) mount$9p_virtio(&(0x7f00000002c0)='syz\x00', &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x140000, &(0x7f0000000640)={'trans=virtio,', {[{@debug={'debug', 0x3d, 0x8}}, {@afid={'afid', 0x3d, 0x81}}], [{@smackfshat={'smackfshat'}}, {@subj_type={'subj_type', 0x3d, 'batadv\x00'}}, {@fowner_eq={'fowner', 0x3d, r6}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x65, 0x61, 0x39, 0x32, 0x34, 0x37, 0x34], 0x2d, [0x0, 0x62, 0x34, 0x36], 0x2d, [0x35, 0x65, 0x63, 0x61], 0x2d, [0x36, 0x35, 0x2, 0x61], 0x2d, [0x36, 0x35, 0x33, 0x36, 0x60, 0x38, 0x61, 0x8b13f4635d809b23]}}}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@subj_type={'subj_type', 0x3d, ',!+'}}, {@smackfsdef={'smackfsdef', 0x3d, '#'}}, {@seclabel='seclabel'}, {@appraise_type='appraise_type=imasig'}, {@fowner_lt={'fowner<', r8}}]}}) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0x1}, 0x44085) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b7230000f8bc020000000a000000635903001ebb25c8cfbc69ba8aca01003d2554752fde93aae58673635d85a425d970009536334810109c3e346d9f8f4b2ac4ee86559c3b941e5f88d23ec8f2389ca40200a131a4b2e7d19455cea637bfd87c00", @ANYRES32=r10, @ANYBLOB], 0x1c}}, 0x0) [ 181.712521] ubi0: background thread "ubi_bgt0d" started, PID 9689 [ 181.725101] ubi0: detaching mtd0 [ 181.739060] ubi0: mtd0 is detached [ 181.748889] ubi0: attaching mtd0 [ 181.808794] ubi0: scanning is finished [ 181.950186] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 181.959302] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 181.966079] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 181.973280] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 181.983212] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 181.989671] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 181.997300] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 182.006689] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 182.016214] ubi0: background thread "ubi_bgt0d" started, PID 9714 [ 182.018680] ubi: mtd0 is already attached to ubi0 [ 182.033094] ubi: mtd0 is already attached to ubi0 [ 182.040142] ubi0: detaching mtd0 05:02:29 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) r2 = semget$private(0x0, 0x20000000102, 0x0) semop(r2, &(0x7f00000000c0)=[{0x0, 0x0, 0xc00}, {0x0, 0x4}, {}], 0x3) semop(r2, &(0x7f0000000380)=[{0x2, 0xffff}], 0x1) semtimedop(r2, &(0x7f0000000000)=[{0x0, 0xec00}], 0x1, 0x0) semop(r2, &(0x7f0000000080)=[{0x0, 0x9}], 0x1) semctl$SEM_INFO(r2, 0x2, 0x13, &(0x7f00000000c0)=""/35) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000080)={0x6}) keyctl$unlink(0x9, 0x0, 0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:29 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:29 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$cec(&(0x7f0000000240)='/dev/cec#\x00', 0x3, 0x2) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4686d46bb0abee74) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) setsockopt$inet6_tcp_TLS_RX(r7, 0x6, 0x2, &(0x7f00000002c0)=@ccm_128={{0x304}, "abef8984089ce969", "a8344155234591b9dc4949ce74117989", "ec3a9da1", "a8cefa3c7e214482"}, 0x28) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000078000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) 05:02:29 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 182.053455] ubi0: mtd0 is detached [ 182.063426] ubi0: attaching mtd0 05:02:29 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$TCSETXF(r1, 0x5434, &(0x7f0000000080)={0x17ec, 0x2, [0xfeff, 0xbb, 0x25c0, 0xfff, 0x3], 0x7}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 182.110140] ubi0: scanning is finished 05:02:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=@RTM_NEWNSID={0x64, 0x58, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@NETNSA_PID={0x8}, @NETNSA_PID={0x8}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_FD={0x8}, @NETNSA_FD={0x8}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x3}, @NETNSA_FD={0x8}, @NETNSA_PID={0x8, 0x2, 0xffffffffffffffff}, @NETNSA_PID={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x5) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0000f8db5e84fc19c646c0336f38be", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r6, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}, &(0x7f0000000080)=0x10) r7 = dup(r4) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_LOG_STATUS(r7, 0x5646, 0x0) 05:02:29 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x0, 0x2}) 05:02:29 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x1}) [ 182.291630] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 182.300193] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 182.307723] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 182.314264] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 182.321884] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 182.335812] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 182.348226] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 182.368658] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 182.381192] ubi0: background thread "ubi_bgt0d" started, PID 9749 05:02:29 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 05:02:29 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000140)={0x0, 0xd205, 0x0, r0, 0x0, &(0x7f0000000080)={0x9d0901, 0x401, [], @string=&(0x7f0000000000)=0x80}}) r6 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r6) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="eb569963", @ANYRES16=0x0, @ANYBLOB="dd0700000000000000000f000000"], 0x14}}, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000580)={&(0x7f0000000640)={0x80, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x46}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}]}]}, 0x80}}, 0x40) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x4c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd, 0x87, 'l2_drops\x00'}, {0x5}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200080c5}, 0x40001) r7 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000004c0)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000540)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xa295, 0x3ff, 0xffff, 0x7ff, 0x2, 0x10000, 0x1}, &(0x7f0000000300)=0x9c) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}}, 0x0) [ 182.392640] ubi0: detaching mtd0 [ 182.408513] ubi0: mtd0 is detached [ 182.416313] ubi0: attaching mtd0 05:02:29 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000080)=""/96) r2 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000000)) [ 182.468603] ubi0: scanning is finished [ 182.651223] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 182.658514] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 182.665234] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 182.672349] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 182.679580] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 182.685810] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 182.694041] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 182.703654] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 182.713315] ubi0: background thread "ubi_bgt0d" started, PID 9777 [ 182.713618] ubi: mtd0 is already attached to ubi0 [ 182.725816] ubi: mtd0 is already attached to ubi0 [ 182.731073] ubi0: detaching mtd0 [ 182.737263] ubi0: mtd0 is detached [ 182.741335] ubi0: attaching mtd0 05:02:30 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:30 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f0000001380)=ANY=[@ANYRES16=r0, @ANYRES16, @ANYBLOB="180027bd7000fbdbdf2502000000060001004e2300008600000000000000000000000000ffffe00000f307000800ac1e00014f925ba2b54a9f938b7697f59d54b1b9ecf0dfc19f9fad4f330e1dcce938277d05bf6f8ab4fc0b47edf317329f7554819d34fb2598988fd1f33b3da5e36b5019e4b952075b510018240b0200"], 0x38}}, 0xc800) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x40200, 0x0) write$UHID_INPUT(r1, &(0x7f0000000200)={0x8, {"a97dea9c1127cf30b95d179bb1b442826c54dfb4dcfef03c43fe5110a26b6e0ff9749e9220a2e4d5f7bb8cd89b255a905bef58b899bbfe5834a0966c591b8330dabe8197887656be1be0ef09e2b3cb2644731669f46e702828580aadd8b1acfec7b8280e53ae199a5efe0780cfccf1be682f944237ca5b4a00a65c3e298882830542ff3d0313179d49654d05d402ed992c634c9abda9cd1d07937ca9fcb3cbd29e618f5b63b6f23450e800e0c224e73ac20f4d4ef427fb25ee2006cb2006fc5fd69ebbaf177e86bd26f26b3f29b31705ed0eb20a2e3000c04e0a5fc8ec1f18b40ef74a33c8ae138f24048078adaa3b0f9c5fe14e893819e9ee143cdc2d845e9c7f2c1e0d0c3f7df10bfc4e5c439070fb65b11a7c7e01c0e1bac962ad7f1fb4b7d99c14af0c6bf652e78664b6e31a546a8c0db4f6b964ff328f8b183cb8173facf19da657e8c192c5bc348c93e1c1206dc509c464707b06aedb27e182000020da6e36c0c2e897c304c09d4777c66a119a5f10b0c128f2b12a2138f8adf05fae63d93e10c0ade779796510eae3d56316b7cdf0740980ad6b4d6a5c90a7bead83aedeec2220c81621c7cdda4e64bf5be7c7a838180bb8dfebe258611f9958dd35657ed2a9adb0ae77238259d3e9b7245011b8cf1e6f0b704425c081263af1fda5c3c2f7c3aebff9b74d67e2b8f2e845747b5ed0af63fd810df13d26b8664ce44b13ac8fa1bb62be3efcf65f33cc820ce92af5dbf3af983bcccd26ac0bf774503d7df13e88294c99de6db56e09fdea08e915e11ce7ed315fb0cc943ad973e3d9b60faa621468cdc80b424fc0a7a73d8e8a6246fa581da9fdebb370327a6ce692b5c9ebb0a6d68b40abc00cf2c2933742838d2f4eea9cc1d8d4070211aeeae3357a0a0ffda3d1630cc7a9e6ae1093d34aef095231f7aa7bab40ae1afc7d43fe5994f0764f88fc7fd76b872d5a65735a8ad3c822f555168f393e4a1fd78826166b59ae7fd0476cbad27a49e060e1ee654a9c9e941314e0770cf978cadf98fd723aa85553b80c2283230d8e8b0d86fb3cdf96d2270f9181578d16bee0e48bb5a6b31813dced2c1219f0b65dda3d077b8b331f0e23f9de96e25ee32d1cfd2a53d37e6cc0c9b08a0b2e1ff9f2c091eb34ab8c552a8ba349b7594c592d781437f51c02bdf80d2c4fb09c44efd4d014b2871e1fe8536f8cb19da0e6b2f9578c9cd52c9c2b0a8f6507655d26eef7b0be8fbdfd578d1b7b052c25d74c2165896ea042b3ebfa5d2943fdf708b82bbb8d67c7910437a00617c3f35d36633e5634feeac8aa12f6e1a6f889e06b0e71fce3a6905f051ec759fa3ab3f877868647af0fdc66747b6542fee2b73eae523dffe7674f4f902706b9bf30926f5e6bfd9b82d80dd24d14ad75dca4d3c2c8f1865e89b4c26d6189f17646c8c28dcfee7077eb1bb545a8c08d74be492f5a977954e3992e494a108e7ac04cf5f9e4f205d20ebff9d75f59c0989ee1cda68e445a826686efe7e278238f248fe820967c7344ba73e6cbdd31514f17224f5108b01099c10f30071f3b917d1bc8bc8f4d31aa362cfb897bfe6b6a3395e21147145bdfe2a9598a591fe115c620e58315a0a029f414a3bbb6030e3ad47f59042f79beb6b9d6d3936c8a4b9c01dc7911312e56b884bff567daab6bbb464b692b2cc12541a58e17dba5285735753ddcff1632dd56c1e22f5d1377f1bbe8b20aa1103f382346933a72a213a9f7099490e97f781782594010955132840a3215b66301f67c2514e349926ce01c3d1dffa6d44f4f6e08a0a15b07f8c0c6f57a67c6cec442643b769ed2508e0fcf7c88af691460bf94d6c374ba21545fb66a3dfa919461b3b66c4fb26ea1e73caaf55f2db1f6ad1e9b3dd24c451eed5a1c2179e3dd9c0aa3b98902cfc8fae207bcc8247727b3d0a996c7cf7aa59be5add353a55a09f4cea83de708106a020507328b78578ec0a72a723f0cffa783de2c9d4dd590d1708e43bf9a1bb4a68eef628f63646022a2bb88c517e331eb0a89888d09950e08c9c2ce73468d55d4a8eff8cb540eb6d71ac8cda8d83bfc1bb4b1d2c4824004a2e4647359cc4d71a1bf1b10ce7fd663b837c6e88b5988d001dbb455fea35433d78ee08831423ee7a8d8275569251149d9aac03859bb7c49e1345b17f3131fc4f82fb4ba5ddf058347eb66fedf8d4f75a27ac73cc8eb8325adaeb6028b34bf879221520e11d2d5aadb0a70e587bc23fc2a2303bf1eb307d18a7c733550576a3bd285b87610229c5c01088c4ee30e97c0ab9f2ada922a01edea7d3f8bc74a3de2c0570e6822ebaa68a8eee6f63b4e14f15002d9c0ae0ff6c70941625ec8ca295924354fec85f4a593ef8e6657502d726578f1060ab704548f9b716b21b3df7b87af74ab6c995ed8f362f22ac41a0b245dca9716f478a97288de4fa75a62ffe9f1c71f2e23ad8b82948675d392e78ba22687b784059c4de1f02d57c2294aa2ff2f68e7b0849e45305b636e66fff2007fce4408bd3740b501344e82849210b0707a74056be679fe499325875cb24d6851fbc40e6291111ec135e15b6258b9c7405916b2b9ff5f0f7ebd9750c15ff994c84f71129a69906b12e6402d3cf5f0b9d2da602c1980e533965063f65c90736e57110f21d4267eb0c3f863fac953435e755e8f70e18f1509c8d33e788d0f0750f9a7f72016a23ee55f6589fd4e9c617849a685b1b58f2dfdc26568f17d0c5327f8da4fd253eb2a5841ebb2dce88278ca104f028395bf94b9d31c897e7928e9d756a23a801d413368d97e8e47a0fe18bf662e52994054dc81b9dc8be356d9e5db5677b26e49a163ba8a291865a171dfbd1c739616fb44a0b802877f1db9518daf0321d22370759b82771c66ecf7f309870e889707d6307ece0bd5dc3d7b4fe61f6647953dd313beb4fb6547d65921358d6cf3df2982bb5e5e9063f4fd6c31d8902bf990dc9b4559e8df80994ca6c0034ec8a0de529acbaccf53babf6782a61a0102ab842064733b617d7885bf0e4fa492334f41c3dc310683340be3caf9a9e093d318d856adaa7a982e7681f57b1844c6d88cc8492f287414903b70fae3d659857573c98971d44334ce4ce1dc26ce64be62ca600849630ec6b442f33e2bcc90108abcee2c5d27e995a7be9ac909417227ba16f949e8402cded0816d743edc4d2db0b6302b5aee64d248c21ded421ea40f347bad025bcf96084d79b87ebcf29e512395659c20b248f4489df8eb3e6d300836b2957e9009d47475d90f91b111fe2ee5d91fadfb4fd9f156e9258398de4ed0102d66c461809e414982da1a6841add7b3f4ab642e1f093f4fbdbab627b6d4d7bf93e140613a8b8a4343eeff4c99c0831c0da89b8adb81ad03a23d43fa93568a7c77b1f006de7185f5a2ffe1715bb7f58df75ea355ed50c8b815664622b27021ece9ca92550db9f856c6c6435475ad0d16499e63b3c09387fad168acefd38f2b5fd5a0e3095608d98532433e6c993cbbcf72eb352ec714d1bf173dbd916e2a066e192dd0bb7330b269e53727d910916cceb13710ec27268c445a7fbb119f5596d33667e6ba87eb2637b1b39bfa95459cea844e00ee8527d7f3ff55a00134bcafa02518fb5cb46c1c11d21b7113284486ab7133b3bfc472adf20421af8fc9d0645c37736002d7d093cde1cd7b5d7eb9a547c39cb065c43a296a62e77c8c47fec94b4a0aa7a8ced70cc6ceda7408b466d7f992b751b6fcbc03a6aa30e5f35521cf0bb4147fcb08a98c83dfdfb993e1b3bdd111b58403c5926dea3c785903a6e824e96d21e05fb44ce12bac12d278fb439c1b7dc666d7aff59879ef136d0358c475adf49b382e5f8fe642b938eb5209d592d6e4f6055645b885520af1518d102c700b1036c766354a48dda3e136667202fd1e466fda7a350c5f28ebdab23f1dd769f896fb6638613bb6c8b45562926a24ca0a9dc0d8bbfebbb973198eda6a5e53a8674a8d9764fc4cdb1ae73e806d9245476c8f517622464a13dbab9c25b2854fff9da5bb1bf3eca3432f5f79608cdcf6811b8d63cd4e66aa1956ebcf0f9a018dee20f5c5f77ffbcc88a222e0a36e2a99215eb1e72a59f1c320a9bfb919e239bd9d8a8f10485b8b7132dcb53be1f6f18306a92b620fcea5f90076a8637897e2b1c4ea38d61604a206dcefc557e09ab07e9c1894d150ff68f49b9fe56339894cd30230fcbe27a0633939dc67ef5f06c4dbe18256902513b00d928880fd337fa994510a87d4fce3c8caad2752ec63ad4505b9686ab48cb5b7fd035e43e904e9d794eee7e9d8c5e8342e6226ef2f2f27ed2beeb397faaf26cbe8358731614436219584a0aa80ca2fc3d741ebb757fa74a71a231b527fbc5e79cd0bf357a4cfef9899b36099600cea53f8b4f912d2753644f11db1d5b5a7431979e79daf1b8affe172cab882741e553a8de2cb0a87c9a5df9e77736ff5b37da7d3c087f8c3e2d82ada3a4677ac43dfc60ed5f2c531cc4226c0680fbd42d00ccd386337fe65caaac756e03e1c8b64e79e38c7e24424c0f75087f98787e83bdb3fcb703ed741e3289979cae6223c7a1fd774ba6a7a5a6ceef023cc95e84e74245d66dfe30c4de2b52794e79597d55c2ebd3d91726839911433666563bf0bd8c27635b5e9a0abef0a956aef27894a1340019928b0711662ff2c73af6bad4fb075ddcda752395c3387ec63d9e34ecf280fb6b22befc01db44e0bb46b6997afd60fe749294bdd09e50aa0172534511ae6f1a9c1aaaed48d0b42f196b7fad073db42f6b320a0d3c512930daee9b4ac3ced087ed0429cf211adf424ac7c67785b2f1c11f300fc59e4f128f98805c200065aafc982eda7c67930751d7146ca98edcf892ad9e9808febe45291265e0ecad936bcaf1168c3b05ef1a7a149716da1e9dacb92b88fb3b153bec2843ea8ee4c7e6837a8c76d931f7aaf0ec2bbd77bcd4d956ce2f81e7a24933ca5ab8dad5ca530aaff959043951fed44d4382e3d13f7a7a40127bdb43ad5e1d073c5f7519d39d6107ac952257a418146a088328283f8d94a7c349c380e14aba0aed22fa4ac2ad4f013ae17a90f419963f763cde62f7374e3d91c483babedf49d5de25dbff33d94929fda94717c3740b62a105a7f90e8ded09eeead1fee98d976e2d6e07da1d3965b0f7059da10cf03ed00bffc6180ae5c63b9f0b45873fd3747cf89a94d27e7428af3f352dfb853535898421ca35841bc65d37dd476454c9569c80ed1d2df2aa4d72382ded3fc5304212943afd733c3711c503697ae17de3a5ed21a6b01f4e1bf3e14597583993a7bf99e60fcb218e4fffb0f0a684f66560253dae8fc024e27112c5b7bb7eae4acf0d56365149c6b9f753d7838f8c741faea980b2b186c599f5c8f433aeea0f85f96d821fbbf7ed88675b24f453991fcbc25aadf195218a5c072f922f1ef07b268809991d29fc48cfb9ef94e7a8efbb55c234e8b8c4b627d05cfa2a117aebaa4e47e08d0c448c17eff155608d5907e1127274a4b95ff8109dafb1fd137175d9105fad8a356864c2bf1830b39dc17ac146c028bd96398dfaf50d76b196c1ba41990b1865383f512e4d6be52713d1d9ebcc1385ef9b06850f47327ad0f9528834ad357d85a5fc6cba35305e6ced7a37ea7c265982ed72d648470b1799b217833a1298b2e837f97d2795011db50085971dc7d2ca3f22766beb21e3eafc592f81015df8777704c2ec69a3cf79b5735653879cf9043678ac4236744d532ed89a0bc78a0ec913a559c860d43792721fbc9a1514c1d585d60a4adca57", 0x1000}}, 0x1006) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000100)=0x80000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x1, &(0x7f0000001440)=[0x2]}) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000001280)={0x2, {{0x2, 0x4e22, @rand_addr=0x64010102}}}, 0x88) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f0000001240)) 05:02:30 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:30 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 182.786302] ubi0: scanning is finished 05:02:30 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x202000) socket$inet_dccp(0x2, 0x6, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f0000000180)='y\x00', 0x2, 0x2) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r2 = dup3(r1, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f00000001c0)=0x7fffffff, 0x4) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0x80045500, &(0x7f00000000c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x0, 0x5, 0x0, 0x83}) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) r4 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x76, &(0x7f0000000440)={r5}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={r5, @in={{0x2, 0x4e24, @broadcast}}}, &(0x7f00000002c0)=0x84) [ 182.992504] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 183.000874] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 183.008043] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 183.014341] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 183.021187] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 183.027577] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:30 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 183.034914] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 183.044586] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 183.054278] ubi0: detaching mtd0 [ 183.054881] ubi0: background thread "ubi_bgt0d" started, PID 9806 [ 183.069913] ubi0: mtd0 is detached [ 183.081740] ubi0: attaching mtd0 [ 183.109043] ubi0: scanning is finished [ 183.180424] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 183.188797] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 183.195417] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 183.202170] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 183.209145] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 183.215325] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:30 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 183.222927] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 183.232583] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 183.242178] ubi0: background thread "ubi_bgt0d" started, PID 9816 [ 183.242405] ubi: mtd0 is already attached to ubi0 [ 183.253972] ubi: mtd0 is already attached to ubi0 [ 183.267717] ubi0: detaching mtd0 05:02:30 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:30 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 183.277882] ubi0: mtd0 is detached [ 183.297539] ubi0: attaching mtd0 [ 183.362716] ubi0: scanning is finished 05:02:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r6, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) getsockname$packet(r8, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r8, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockname$packet(r8, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0xfffffffffffffe35) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b723000000000000e4fff900000008000300462062917cc72fcf0bd215e088c07befcb816a312c", @ANYRES32=r9, @ANYBLOB="43be44dd4650e5b172bc9a31322b6e6d92dc61a161d7e775a6eb615faa4003c3cd797578e332977e1d267ca5b8d9316bd4c3968052be2bf7d47ea68e909090ab81aed1144405731f50108ab439df1dde83f7866059a107d9cf3c82766e7a2705cdcd2d5fe6c92854cc0c5676b5c9023f063737839229153b7d3520a8bb2669a23c87f287fe0b4b2277db337bd03460cd2a20e4e8607f3caf3e5c7e"], 0x1c}}, 0x0) 05:02:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockopt$inet_opts(r2, 0x0, 0x9, &(0x7f0000000000), &(0x7f0000000080)) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="948110b39440f1a6", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) [ 183.521351] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 183.531139] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 183.542967] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 183.550400] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 183.558819] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 05:02:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2, &(0x7f0000000000)=0x1ff, 0x3, 0x7) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:30 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000000)={'bond_slave_1\x00', {0x2, 0x4e24, @broadcast}}) [ 183.573848] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 183.582576] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 183.595798] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 183.606987] ubi0: background thread "ubi_bgt0d" started, PID 9846 [ 183.613460] ubi0: detaching mtd0 [ 183.632572] ubi0: mtd0 is detached 05:02:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB="dfefd3ca5103ed717c868679ba294348c56a87858d23bcb6a365597705000000000000007133c2e62fbb16f4288344fc459ef9a793407105c300d6360773bc32b8f303000000000000450b8e516c72082837334a6a727f1599fc5890b402660a68a9d1dd20c55cfc2c890293531a9c0abf75bce9c8a46f5af6f2c09b"], 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SG_SCSI_RESET(r5, 0x2284, 0x0) 05:02:30 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) [ 183.652996] ubi0: attaching mtd0 [ 183.706434] ubi0: scanning is finished 05:02:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x2180, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000006c0)={0x1c, r6, 0x31905e13403123b7, 0x0, 0x0, {0xc}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r6, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x20008040}, 0x20000000) ptrace$cont(0x20, r3, 0x0, 0x0) r7 = getpgrp(r3) timer_create(0x4, &(0x7f0000000000)={0x0, 0x21, 0x2, @tid=r7}, &(0x7f0000000080)) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}}, 0x0) 05:02:31 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xff, 'syz1\x00', 0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SG_GET_LOW_DMA(r2, 0x227a, &(0x7f0000000000)) 05:02:31 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) setxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=']^\x00', 0x3, 0x5) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_MODE_GETFB(r2, 0xc01c64ad, &(0x7f0000000080)={0x1, 0x5, 0x6, 0x7ff, 0x3, 0x7fff, 0x8}) [ 183.904608] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 183.921003] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 183.941783] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 183.955970] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 183.978410] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 183.991549] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 184.022118] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 184.033779] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 184.043895] ubi: mtd0 is already attached to ubi0 [ 184.046855] ubi0: background thread "ubi_bgt0d" started, PID 9881 [ 184.050551] ubi: mtd0 is already attached to ubi0 [ 184.062402] ubi0: detaching mtd0 05:02:31 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 184.093003] ubi0: mtd0 is detached [ 184.097338] ubi0: attaching mtd0 05:02:31 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) [ 184.186623] ubi0: scanning is finished 05:02:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x24) sendmmsg(r6, &(0x7f0000003e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, "f3"}], 0x18}}], 0x2, 0x0) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0)='wireguard\x00') sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x78, r7, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x400}, @WGDEVICE_A_PEERS={0x5c, 0x8, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e24, @multicast2}}]}, {0x18, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e21, @broadcast}}]}, {0x10, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x4}, @WGPEER_A_PROTOCOL_VERSION={0x8}]}, {0x18, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x8011}, 0x4048800) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x48, r7, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c='\xa0\xcb\x87\x9aG\xf5\xbcdL\x0ei?\xa6\xd01\xc7J\x15S\xb6\xe9\x01\xb9\xff/Q\x8cx\x04/\xb5B'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}]}, 0x48}, 0x1, 0x0, 0x0, 0x24000004}, 0x845) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:31 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x0, 0x3, 0x49, 0x0, '\x00', 0xfffffffc}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) r4 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x76, &(0x7f0000000440)={r5}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000000c0)={r5, @in={{0x2, 0x4e24, @empty}}, 0x0, 0xe4cc, 0x6, 0x7fff, 0x1, 0x5f36, 0x80}, &(0x7f0000000000)=0x9c) 05:02:31 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:31 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r3, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) getsockname$packet(r8, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r8, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r8, &(0x7f0000000600)={0x0, 0xfffffffffffffed9, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r0, 0x300, 0x70bd25, 0x0, {0xa}}, 0x14}}, 0x20000004) [ 184.401158] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 184.415610] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 184.436149] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 184.455269] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 184.465973] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 184.486538] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 05:02:31 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) [ 184.503828] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 184.523775] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 184.523887] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 184.523912] ubi0: background thread "ubi_bgt0d" started, PID 9918 [ 184.533731] ubi0: detaching mtd0 [ 184.569627] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 05:02:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000480)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000500)={0xa, 0x4, 0xfa00, {r5}}, 0xc) ioctl$SNDRV_PCM_IOCTL_STATUS32(r4, 0x806c4120, &(0x7f0000000240)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = openat$mice(0xffffffffffffff9c, &(0x7f0000000340)='/dev/input/mice\x00', 0x602) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r9}}) setsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f0000000380)={{{@in=@empty, @in=@empty, 0x4e24, 0x7, 0x4e22, 0xa26, 0xa, 0x20, 0xa0, 0x2b, r6, r9}, {0x6b92, 0xfffffffffffffffb, 0x0, 0x4, 0x3, 0x400, 0x6, 0xfffffffffffffffc}, {0xb6, 0x100000000, 0x0, 0x4}, 0xfffffffe, 0x6e6bba, 0x2, 0x1, 0x1}, {{@in=@private=0xa010100, 0x4d2, 0x32}, 0x2, @in6=@private1, 0x3506, 0x0, 0x1, 0x6, 0x80000000, 0x6, 0x2}}, 0xe8) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_BEACON(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000640)={0xba0, r10, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x6f}, @NL80211_ATTR_BEACON_HEAD={0x8c6, 0xe, "86b7f3ce354fed0cfe526dc744e59ac10ccba459e094401a6558b2be371bce8045b20de600b7e411ca5f27ed4fc84eff9e14accbbda9ff1b5f36567e6482d2deaa530ede01ef0a0abe1899195573fa638feafa366f0d8602f59d665bd83b0c25857ac9d0e01215e276d37820eff486fc3a62586ff52856f0bbe4ce613543f12b9ac297244cddb2200b92b66cdf00f8cfdb68aadead76881d128c31dc6723a682410f2b3f1b3d216008173c166a0af67aba5398d3ec512bad28fd5046b8a46b1b486a191d27cc975935d793c9f97a93a46385d3ac618c1ed244ecb16d1ea7d39faef366a81b590e2c889a0e4811e9c489bb975ffb781fdfc6ed05a448cde67e2e914db0f48aa9f73981bbd4156e2c56be74e1a98e0a2aa5f64f0c8646290a83b10dabf871c2f1b4f4a1b6c6e07c4c96d75f2fd60a9c029473678214b6e0bc6a03921daaffd3e26313b51ef3be5f753b7de73b7286cb1292f6eaea4f682860a246bda7d641059db7d991b7a196af3cc7755960729acf09e8e9728e9b12d9f94fc10cc9adb9169a8bb4cc9f48d6f57516e5ef267362c22a5ffc8e48b3d398f54525a3c37f5ec062c6db765c773297032c1b3dfd8b4c2e6c25dffb2c5dd948a39a168ef91d48e885435068db7a091eacdc65f221c4e3c2ce91b0bc163aa4854e33520ff0af3d3c9c078b82921bf3d316d2f5ffc837b38a737638bbc5d35f8af0db1fd961dc992536fda18c13c0d9438b9d8098e9aa8b5ea66b57c5d074231667ce563159bb388cf2aef4fd92a66cd62cb39864fb98a467c4ffabc2cde667e45434c3d66ded65940c7932e617c8ba89256b30b71a257f0b9e42a3d0c4feacca0e74c135db09a7d5b81e904857b1944dc222ae126201b6d546b81d314376d9b17ebd0d2867477351b31ab348997ceadb28f9edd6b8946a6315b5eaea231dad59c854c138fd047551cc351d14276108469358d4109dfaee6c4664bb78ddb7506da329b19606cd6c5f444e9cb2734c4dcece9fd578e76812713f75ff34363db04d10d77728894510c074ee9d43738219a47d1d0ebab9ce5db4c4b91a17b36e8316799814052a0752f1abd47f50f8dc3d69806b95737135c8eb51e4269fdc59787daea7e6ebb207d158f600a12f58996d9daa0b31db04061dc5abc5f3e1afffc414a9cb618bcba3b3fe75f18746d116f750a9ddf05a3668668573d267388a6095a00853fd7d670eb02802d8c45fa5da6dd820cce8a3de6914d27baf6e9dce9eda9ed17430590ad3c4a8893a5ad4f823f32548551c3cff71e476e62782365d4f5ca7462b8b0a81b8674dc6286b09dee17c2294463cfcaa84cf87e4c31f0864908968e8d9167be6deff8c241ff5731a73678c3519831209a19c75482dc02b4e8626471d90ac9e25a07eadfcf3429e7d0d332663f5c79d9ceb083b20717ce5f6461a0fe9a3c0d139188ebf7a9f30768fe505874395d611917736be178ad0abaed224e10497f98e90b91e4e2fa14c021ae578255a149907af95c99feaa6bdb769fd1ebcd1fc1a228b4242b9cd364785fda2d3dae79fcb29c37e2e2775aead4c1930a0e72bc8b65236cf8e9c83155e7af863a3213e88ece627f36d5794599d94d3c9f0d4a776fd415e17f607806fac00433b75075169d92bf2af3b89a735fd28ba5f08475a0b2c8a2a6406f0ef190d9afe17d8821376e3a63000c306906af92f088aab8a96557b1705525988a5750b77b9f8de4c8a97eb787d9db44644415139eaf325e5494241ea597cf25090fb7659a738624e400a67643390049462e7de65bb2a66fb7a252ec5a1113dd4713e86a447fe8dad68beb35ecb2784d52336180d2edf53a9b1f52bdcdffdd67a0cb33d44f8fba0f281d910e0f7a32a5dc32ed58340ca3288fdd13c224dc0563e8e87ea303983a29cd9dfb6d4f0e8f60773e74efbf381b94c73fba4f6311570d9fbf5ffa629579a2152c13b2787ffbadf81a9b53ad471e151c824739eeef94c63573589f62d41669be0d95202477bdca1cc74515c0008501fd3b2f5a4cfa5aeb17a2f7ccf3eb1b0b1244a6662f390e979c2565198fa94b8e0d610f34ab4e029c6df54c99e097563cc577ff95a811a24d4371312da159497afc1baf1f64c41463d819e16495ddd186e3b667f405c3df3d9781331d3a804e0a879cc15e81c9adecabdcdf1bc46384cfb42b721d849719821989146eb35d16776877f3a9a3ccbb3a8f519aa3281956c88c23507357e7c731ea7cdde8bca1e43bd832d7836817550275106cc529173f0967ec46fd80e55fc76b00b6de07754938c409ab0f0ec7fa771a6a35edee1f809fde2490c366d67d38864cba0ad784d399eb84c50cce1a64de980cdaccf204c963c66622c2334b899370a15ecf2f44cfd3898fafbdd448a35a9d814fa4fffd3e237be9edcb823fdcc245f287c9600de99dc7adb9d9c32812d6d8f20d04afb9db5f669c2f71b3e2237bd207de89d67fa4a0b4354c158717721a544e41456168a9ce8199be6e3a687caee737fc6d0a96625737967f0a9a5622de2f286ad30eb8186f31e5c7245e9e0a16e34b6fdf947f2c3e350bdce272ba3f93e97a30800e3131ef20d73f7b738f011f8e946539525a67bb6ca042060b171cc03191e2686c42c6d83c8ea92abc7850ab20e2f6b887cf86f6bbbac8910ea4c2a6eb536b0b5df0502fb4af4f87b177055cba8bfb18cbe34a2baf20e26ec3343e2e03ba10f99a91840ba78c92c476f0c0411185651ec9a53d5930ea2847ae38af728bef446267696e9d6174fcfecc63b91a891270fedd0b920553263950dce94d7c8195fcfa5ed9a00ec9eb503259ced60af17445ba4bcddef7e1bdc61e6158a858ff3a97416dece962ae4955709d44e19ed199641155e67aa6f9b0f3fb5885438451def4e04825a1749bee0cae33a8fdcef39441ea7c4a3625d0412a7262512a780c3fd55066fabbe1a634a1750414f783152a97e1e947ac3e0acff6944f97e2e9396ff90b1733e15b61d49457c9da44a45164bf1cf8aa4d5e74fded2af45a54fc780ffebb2c1c9f3b122dd85d381836dc2fffb21e587467b897a848e3546cb194ae552f132222abc64f0fa43a468a6628aad1a2ddab8edd6c3e8f0ffadbdbf335517e5a8e2608ae953587d7b93cfe001a7332cd5bd7a0a222971c73fbc6b"}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_SMPS_MODE={0x5}, @NL80211_ATTR_FTM_RESPONDER={0x290, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0xe4, 0x3, "7dc3137bf1521955e047ff969eafc190a4e09c6863db062e25df739c9309f8f10113e540e9419e680e77c863b35578986e9a854ee31c3791255b7dfc6468fc6b10098e1945799acb20fb2ee6495dd0c7feab9bbc01b9b6016f24a289c762f4bd16670095a93063dd7b93e210cbc36da2125dd0391798b28e1d0df3eadecb873dcbc47bdc501197f443c224bc8fe714847e7df833a484ac446ff104b0767bc2046607fb05f9a53889fd723cc72658c3039038e717d99de18768105af41534aa7ca8d4a0f10725719fad7a9bc633c8714184826d25dacff6a500e28d66dffa4eb6"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x80, 0x3, "066c1e6943572dc13a54f7fc7cc3248894a911c52ccd46578258dda453b76033e1b2826436f0f0cffaef36ceb0aecec6e627f864c2e32195d78085ea0613fe4cb21d7df5cb39d725b189181101b6f90996d1cca38596f78a1e91f73d3f73e9e308d547288019eac41713b06cae4af635f7b6a781e14370cfecc47172"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x9e, 0x3, "97c62d76d7e0500e53577c5efc53a0feedbb486b6403098b92606252942fe2706fe8f12d79bbbbc081e96b3f80b26e9c06ebe84ace3768d782d38468de639e0f8e86414500efad14aee5269080bd86e58866b6354655eb5a0220e95b56ee54fed0ad8cf8995f79c1c79aa32b95dc0dc17d8029e16b828ff14070352eeecd81198286b50fe94dbd4eb2ffc969fb3e0680f1ad9e8a22460b1fa7e9"}, @NL80211_FTM_RESP_ATTR_LCI={0x88, 0x2, "a354699474a9e22f720a7f0ca437f6caa28112f4b0242411d5dfb11039b81a3ea474f891c4223c0aad5ba8811d207623e5bdb137a8845dfd781e01e88fb00c351166a6fb3813c5b24b0484329a229c40c4c90d4c02c1a594d6c4e89f9d108ad7fda71880f2325f90a40dda255592c6097a0b63c180cfd252213998659f9bbcae76b61efc"}]}, @NL80211_ATTR_HIDDEN_SSID={0x8, 0x7e, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, 0x7a79}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x9}]}, 0xba0}, 0x1, 0x0, 0x0, 0x22008810}, 0x0) [ 184.660704] ubi0: mtd0 is detached [ 184.664916] ubi0: attaching mtd0 [ 184.707290] ubi0: scanning is finished [ 184.882483] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 184.897543] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 184.907419] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 184.913772] ubi0: VID header offset: 64 (aligned 64), data offset: 128 05:02:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000440)={0x24, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x440200, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) write$P9_RSTATFS(r7, &(0x7f0000000240)={0x43, 0x9, 0x2, {0x7f, 0x2, 0x4, 0x7ff, 0x7f, 0x7, 0x8, 0x7, 0x2}}, 0x43) r8 = dup(r5) getsockname$packet(r8, 0x0, 0x0) getsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f00000002c0)=[{}, {}, {}, {}, {}], &(0x7f0000000300)=0x28) ioctl$DRM_IOCTL_FREE_BUFS(r8, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000480)=[0x7ff, 0x0, 0x20cfb8]}) write$P9_RWRITE(r8, &(0x7f0000000080)={0xb, 0x77, 0x2, 0x80000000}, 0xb) ioctl$EXT4_IOC_SWAP_BOOT(r4, 0x6611) ioctl$SIOCX25GSUBSCRIP(0xffffffffffffffff, 0x89e0, &(0x7f0000000340)={'lo\x00', 0x5, 0xc4}) [ 184.957719] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 184.963947] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 184.985036] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:32 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 185.025859] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 185.055631] ubi0: background thread "ubi_bgt0d" started, PID 9948 [ 185.055648] ubi0: detaching mtd0 [ 185.087807] ubi0: mtd0 is detached [ 185.092550] ubi0: attaching mtd0 [ 185.097449] ubi0: scanning is finished 05:02:32 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f0000001400)={0xc023, 0x1}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) process_vm_writev(r3, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/25, 0x19}, {&(0x7f0000000100)=""/34, 0x22}], 0x2, &(0x7f0000001380)=[{&(0x7f0000000180)=""/171, 0xab}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/163, 0xa3}, {&(0x7f0000001300)=""/73, 0x49}], 0x4, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000015c0)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001580)={&(0x7f0000001500)={0x70, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xc0}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000840}, 0x4048800) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$VIDIOC_OVERLAY(r5, 0x4004560e, &(0x7f00000013c0)=0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$KIOCSOUND(r7, 0x4b2f, 0x4) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001480)={r5, 0x15, 0x0, 0x1f, &(0x7f0000001440)=[0x0, 0x0, 0x0], 0x3}, 0x20) 05:02:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="50000000040a010449321000000000000200000a0c008480080002405114a66a0c0002400000000000cd0b753b99220000050900030073797a320000000008000a400104000008000540ffffffff0800"], 0x50}, 0x1, 0x0, 0x0, 0x20040044}, 0x4049880) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, &(0x7f0000000080)) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="050308", @ANYRES32=r8, @ANYBLOB], 0x1c}}, 0x0) ioctl$sock_ifreq(r3, 0x8931, &(0x7f0000003400)={'macvtap0\x00', @ifru_addrs=@can={0x1d, r8}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000009e40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000009e00)={&(0x7f0000003440)=@newchain={0x6988, 0x64, 0x200, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x7, 0xf}, {0xf, 0x7}, {0x7, 0x2}}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x18, 0x2, [@TCA_RSVP_SRC={0x14, 0x3, @remote}]}}, @TCA_CHAIN={0x8, 0xb, 0x40}, @filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x42a4, 0x2, [@TCA_RSVP_CLASSID={0x8, 0x1, {0xe, 0xffe0}}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x80000000, 0x0, 0x8}, {0x3a, 0x1, 0x7}, 0x5c, 0x4, 0x2}}, @TCA_RSVP_ACT={0x128, 0x6, [@m_skbedit={0x124, 0x4, 0x0, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x44, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x7}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x8, 0x731525ba, 0x4, 0x80000001, 0x1000}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x5fbf}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x1, 0x22f, 0x20000000, 0x7, 0x3}}]}, {0xb5, 0x6, "4da5fbc142bfe97b75b54f71a71b23dcd38b35d0143a3f0f312fb0cebda1ab3c3c1c7878faa961ae9ea78758cf06a1085f85a523f538c8602affcefc76b199e7bb0fcfb2aa7cf82a69d0ca8613bc71fc3167867712d575ed6b4de9abb96992f7c319b2cbd1f1eef0e6e843e8ceaa66ec796dab611f1cbe355d9c81ec506761bd7954123be794241cd441d59389e2c14f23a8ed2dd5629864800079040b1f06b8f3cb5e8d5cbc07b4e4be8b4fccea368a4f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x1, 0xffff}}, @TCA_RSVP_DST={0x14, 0x2, @mcast2}, @TCA_RSVP_ACT={0x4134, 0x6, [@m_tunnel_key={0x118, 0x0, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x14, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e22}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0xd5, 0x6, "382a85cfe59f8df95deb971b094d787f1afc5b924c903bf2fa7243cb8bf905ee5ad984f5879c6bf576ca9d48a138e931a7423079f08b99c3f166db08fd688a6ab1557b5d34392277bb6e755a63fd3d0c784031887712a438c8a50830491016c200526d983de7b8172f9d7f1061706a3b97f39cb32d9c3487de93098c16e56e3416b03df1cc14c7004619f0cab44949506cb411d73e9cb76efc220d2e0f0fec16d6815ea3cd453f552e41524ecd36917cf0535692728664f01fa63ac707d08b9093bffd0576e99b8b2fe9f427305f4c060d"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x5704639d438f0363, 0x3}}}}, @m_gact={0x148, 0x8, 0x0, 0x0, {{0x9, 0x1, 'gact\x00'}, {0x40, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x3, 0x5, 0x2, 0x5, 0x7}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x137c, 0x5}}, @TCA_GACT_PARMS={0x18, 0x2, {0x800, 0xffffffff, 0xffffffffffffffff, 0xb04, 0x200}}]}, {0xdf, 0x6, "90586f10a68d8d290793054d5cb6cba0a40b32bbdfb7b57c4e00ef0d4e9a7744b0b8a1e01c6409b1f33e60ddf1e08fc77fdf5ee71cd47fafab83df46b17f09fdda569cf82ba512e2a57744279d7634843db45f03b2e363782a89096da85ced08f571f7de977dc3facb4f2e645c14639eefd0b987f8ddaecdaaa5ad6df8143b7b7b9d9a5a6e52e3e3a5f3a4bffe239469f5a0356a6c0dc512619e3d2c966d8516557336c487bd46430035c3bc7f3247865bd9b4ad1f24b51979d4476f382a7cd8b91f8c44e494444af3abcaccd10a38706f58e29df686682caca94e"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_pedit={0x3c20, 0x1f, 0x0, 0x0, {{0xa, 0x1, 'pedit\x00'}, {0x3b38, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{0x5, 0xf47, 0x2, 0x7, 0x5}, 0x4, 0x5, [{0x7, 0x7, 0x7, 0x6ceab759, 0x3, 0x3}, {0x7fff, 0x6, 0x0, 0x1, 0x9, 0x7ff}]}, [{0xfffffffc, 0x400, 0x4, 0xf6, 0x3}, {0x1, 0x5, 0x80, 0x0, 0xffffffff, 0x800}, {0x400, 0x19, 0x3, 0x1, 0x4}, {0x8, 0x8, 0x72, 0x3, 0x9, 0x401}, {0x7, 0x7, 0x1, 0x3, 0xff, 0x2}, {0x9, 0x6, 0x7, 0xfffffffe, 0x8001, 0xbe3}, {0x0, 0x7, 0x1, 0x7, 0x5, 0x8}, {0x8, 0x400000, 0x0, 0xff, 0x6efc8c92, 0x6e0}, {0x800, 0x63b, 0xffffffff, 0x9, 0x5, 0x8}, {0xfffff800, 0x84c0, 0x5, 0x8, 0x7}, {0x1f, 0xff, 0x2, 0x80, 0x19, 0x3d1a5c5d}, {0x0, 0x3f, 0x3f, 0xd148, 0x5a, 0xdbf}, {0x3, 0x1, 0x2, 0xa82, 0xccae}, {0x2353, 0x7fffffff, 0x3, 0x3, 0x1, 0x42e}, {0x401, 0x200, 0x8f9, 0x3ff, 0x1}, {0xfffffffa, 0x5, 0x4, 0xfffffffc, 0x8, 0x80000001}, {0x3, 0x4, 0x1, 0x1, 0x28de379e, 0x401}, {0x80000000, 0x0, 0x100, 0x8, 0xb5, 0x80000001}, {0x2, 0xffffffff, 0x5, 0x400, 0x7fffffff, 0x952}, {0x8001, 0x200, 0x7fffffff, 0x0, 0x8, 0x4}, {0x81, 0x1f, 0x9626, 0x9, 0x498d, 0x4}, {0x800, 0x8, 0xe8, 0xfffffff7, 0x0, 0x5}, {0xfffffc8a, 0x7a, 0xffffffff, 0x5000, 0xa9, 0x5}, {0xffff, 0x1, 0x3, 0x1f, 0x4, 0x5}, {0x2, 0x10001, 0x7f, 0xd8a, 0x9, 0xde2ffebe}, {0x10001, 0x63, 0x840, 0x1, 0x5, 0x5}, {0x3, 0x8001, 0x6, 0x3f, 0x3, 0x4}, {0x3, 0xfffffffe, 0x0, 0x0, 0x5, 0x2}, {0xffff, 0x8b0, 0x76, 0x80, 0x10000, 0x40}, {0x3, 0x7f, 0x69a, 0xb9df, 0x81, 0x3}, {0x5, 0x5, 0xfffffeaf, 0x7, 0x8, 0xfffffffa}, {0x260, 0xfffffffe, 0x100, 0x4, 0x0, 0x120}, {0x7, 0x8, 0x2, 0x3f, 0x4, 0x5}, {0x8, 0x4, 0x7, 0x5, 0x8, 0x7bc}, {0x15e, 0x0, 0x0, 0x9, 0x1, 0x7}, {0x3, 0x1ff, 0x1, 0x3ff, 0x0, 0x4}, {0xdbd9, 0xfffffffc, 0x1, 0x8, 0x1000, 0x1}, {0x5fc, 0x1f, 0x7fff, 0x7, 0x257, 0x3}, {0xe82, 0x1, 0x8, 0x401, 0xfffffffc}, {0x3f, 0x7, 0xff, 0xd5, 0x4, 0x3}, {0x8, 0x0, 0x0, 0x2, 0x7518, 0x2}, {0x3, 0x200, 0x1ff, 0x400, 0x7ff, 0xc06d}, {0x5, 0xfffffffc, 0x7, 0xfffffffb, 0x10001, 0x7}, {0x6, 0x4, 0x7a83, 0x77, 0x9, 0x9}, {0xca6, 0x8, 0x0, 0x6, 0x9, 0x10001}, {0x7fff, 0x8000, 0x7fff, 0x2c, 0x10001, 0x9}, {0x7, 0x7fffffff, 0x1fffe000, 0x7, 0x3, 0x1}, {0x4, 0x0, 0x779d, 0x0, 0x40, 0xffff}, {0x5, 0xf263, 0x6, 0x9, 0x6, 0x3}, {0x4, 0xffffffff, 0x7ff, 0x0, 0x3, 0x1}, {0x5, 0x0, 0xa9, 0xc7bf, 0x0, 0x7}, {0xd25b, 0x1, 0xddaa, 0x7, 0x1, 0x3}, {0x3, 0x0, 0x8, 0x0, 0x800, 0x4}, {0x4, 0x8, 0x10000, 0x7fff, 0x0, 0x4}, {0xfff, 0x0, 0x8, 0x5, 0x2c, 0x1ff}, {0x9, 0x4, 0x800, 0x400, 0x6, 0x4}, {0xffff, 0x81, 0x7, 0xa71, 0x8000, 0x7fffffff}, {0x80, 0x101, 0x6f1f, 0xfffffffa, 0x0, 0x9}, {0x9, 0x9, 0x7, 0x0, 0x0, 0x9}, {0x2, 0x2, 0x0, 0x4, 0x4, 0xffffffc1}, {0x401, 0x0, 0x0, 0x2, 0x0, 0x4}, {0x1, 0x2, 0x9, 0x3, 0x7, 0x7}, {0xeb58, 0x1a5e, 0x7, 0xfff, 0x400, 0x10001}, {0x2aba, 0x4, 0x9, 0x6, 0x80, 0x1}, {0x3, 0x52, 0x1, 0x5c, 0xb3ba, 0x431}, {0xffffffff, 0x6, 0x7, 0x80000001, 0x0, 0x1ff}, {0x9, 0x7ff, 0x5, 0x2, 0x61a, 0x1}, {0x4, 0x4, 0x9, 0x3, 0x4, 0x6}, {0x4, 0x4fd7, 0x4a, 0x0, 0x10000, 0x8}, {0x9d3, 0x0, 0x5a50, 0x1e4d37dd, 0xffffffff, 0x2}, {0x77bf, 0x6, 0x1ba, 0x8, 0x8, 0x3}, {0xa319, 0x3, 0xa9a, 0x8, 0x6c, 0x6}, {0x3, 0x73, 0x6, 0xfc4, 0x8, 0xff}, {0x6, 0x63, 0x1, 0x9, 0xc984, 0x7}, {0x5, 0x100, 0xb96, 0x5, 0x101, 0x7f}, {0x1f, 0x1, 0x3, 0x7, 0xfffffff9, 0x7}, {0x2, 0x3, 0x7, 0x3, 0x28000000, 0x8000}, {0xfffff47c, 0x0, 0x1, 0x4, 0x7f}, {0x3, 0x3, 0x3, 0x401, 0x800}, {0x0, 0x4, 0x39d, 0x5, 0x5, 0x68e7}, {0x80, 0x8, 0x200000, 0x7, 0x5, 0x2}, {0x0, 0x100, 0x6, 0xfffffff9, 0x400, 0x6}, {0xffffffff, 0x0, 0x400, 0xa4f, 0xe39, 0x9}, {0x0, 0x7, 0x0, 0x0, 0x5, 0x3}, {0x7fff, 0xf1, 0x3ff, 0x2, 0x3f, 0x7fffffff}, {0x6, 0x0, 0x20, 0x10, 0x6, 0x5}, {0x4, 0x5, 0xb489, 0x7f, 0x1000, 0x2bf}, {0x7fff, 0x40, 0xdac, 0x8000, 0x9, 0x6}, {0xfffffffd, 0x0, 0x1, 0x7, 0x1, 0x1000}, {0x840, 0x7789efdb, 0x400, 0x0, 0x0, 0x7}, {0x101, 0x3, 0xffffffc1, 0xfffffffc, 0x5, 0xa92}, {0x100, 0x400, 0x80000001, 0x0, 0x437, 0x4}, {0x7ff, 0x6, 0x0, 0x3, 0x1, 0xfffffffe}, {0x6, 0x1, 0x7, 0x5, 0x10001, 0x10001}, {0x1ff, 0x10001, 0x4, 0x0, 0x4, 0x171b1563}, {0x3ff, 0x0, 0x9d6, 0x800, 0xfff}, {0x8001, 0x873, 0x600000, 0x0, 0x3, 0xfffffff8}, {0x6, 0x81, 0x200, 0x101, 0x401, 0x3}, {0x9, 0xc32, 0x9, 0x4, 0x7, 0x2}, {0x5, 0x9, 0x8, 0x3, 0x40, 0x3}, {0x9, 0x5, 0x4, 0x3, 0x9, 0x1ff}, {0x4, 0xfffffff7, 0x47aa, 0x4, 0x3f, 0x50}, {0x0, 0x6d, 0xffffffff, 0x0, 0x7, 0x7fff}, {0x1, 0x9f, 0x6, 0x7ff, 0x400, 0xcab6}, {0x1, 0x1, 0x12e, 0x6, 0x9, 0x4}, {0x7, 0x1, 0x6, 0x4, 0x10000, 0x1}, {0x1ff, 0x5, 0x40, 0x80, 0xda62, 0x4}, {0x6, 0x7, 0x3, 0x0, 0x3, 0x9}, {0x2d, 0x3, 0x2000000, 0x10001, 0xffff, 0xc32}, {0x1000, 0x95f, 0x4, 0x400, 0x3, 0xfff}, {0x4, 0x7, 0x3ff, 0x200, 0xffe00, 0x9}, {0x0, 0x80000000, 0x4, 0xfffffffe, 0x7fffffff, 0x1}, {0xef, 0x6, 0x4, 0x40, 0x8, 0xd5dd}, {0xfffffffd, 0x6, 0x1a93, 0x9, 0x0, 0x80000000}, {0x4, 0x8, 0x8, 0x4, 0x5, 0x4}, {0x9, 0x1f, 0x200, 0x1, 0xfffff801, 0x81}, {0x6, 0x4, 0x4, 0x1, 0x7fffffff, 0xffff7fff}, {0x7, 0x1, 0x80000001, 0x0, 0x3ff, 0x689}, {0x147, 0xbf3a, 0x0, 0x5, 0x1, 0x3b82}, {0x8af3, 0x3, 0x3, 0x80, 0x4, 0x3}, {0x4, 0x1, 0x7, 0x9, 0xbb2d, 0x7fff}, {0x401, 0x0, 0x4, 0x3ff, 0xffffffff, 0x7fff}, {0x1, 0x3, 0x4, 0x9, 0x8, 0x7}, {0xffffffb8, 0x800, 0x7, 0x1, 0xce6e, 0x3ff}, {0x1, 0x4, 0x1, 0x6, 0x503f, 0x6}, {0x1, 0x7, 0x1b5, 0xff, 0x200, 0xd22b}, {0x3, 0x80, 0x400, 0x200, 0x3, 0x80000000}, {0x20, 0x52, 0x3, 0x9, 0xfff, 0x2}], [{0x1, 0x1}, {0x2}, {0x3}, {0x3, 0x1}, {}, {0x3}, {0x3}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x7, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x5}, {0x5, 0x1}, {}, {0x1}, {0x0, 0x1}, {0x4}, {0x7}, {0x4}, {0x2, 0x1}, {0x3}, {0x5, 0xaa2b86d0329cbdf5}, {0x2, 0x1}, {0x1}, {}, {0x2}, {0x5}, {0x0, 0x1}, {0x5}, {0x1, 0x1}, {0x5}, {0x4, 0x1}, {}, {0x3}, {0x4, 0x1}, {0x5}, {0x5, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {}, {0x4, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x3}, {0x7, 0x1}, {0x2, 0x1}, {0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x3}, {0x4}, {0x3}, {0x1}, {0x1}, {}, {0x5}, {0x2}, {0x3}, {0x0, 0x1}, {0x5}, {}, {0x3}, {0x4}, {}, {0xe36b647bff7073e2}, {0x1, 0x1}, {0x2, 0x1}, {0x56c26a2e0d70e223, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x4}, {0x3}, {0x0, 0x1}, {0x2}, {0x1}, {0x5}, {0x3, 0x1}, {0x3, 0x1}, {}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x3}, {0x6, 0x1}, {0x3}, {0x1}, {0x844a9e1835c859dc}, {0x6}, {0x5, 0x1}, {0x5}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x4, 0x3}, {0x4, 0x1}, {0x6, 0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x1, 0x2}, {}, {0x5, 0x1}, {0x2}, {0x2, 0x1}, {}, {0x5, 0x1}, {0x0, 0x1}, {0x1}, {0x3}, {0x4, 0x1}, {0x2}, {0x0, 0x1}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x1}, {0x4, 0x1}, {}, {0x1, 0x1}]}}, @TCA_PEDIT_PARMS_EX={0xe80, 0x4, {{{0x1, 0x1000, 0x3, 0x3f, 0x2}, 0x5, 0x1, [{0x9, 0x4, 0xf5b, 0x8, 0x3, 0x7fffffff}, {0x7f, 0x0, 0x3ff, 0x5d63, 0xa343, 0x4}, {0x1, 0x4, 0x1ff, 0x1, 0x6, 0x1a7}, {0x3, 0x1, 0x0, 0x3, 0x0, 0xb3}]}, [{0xabdd165d, 0x5, 0xfffffffe, 0xe4, 0x7f, 0x7}, {0xcaff, 0xfffffffa, 0xa49, 0x48000000, 0xa07, 0x2}, {0x6, 0x6, 0x7, 0x20, 0x5, 0x9}, {0x4, 0x866, 0x0, 0x8001, 0x2, 0x6}, {0x7fff, 0x3, 0x800, 0x9, 0x3, 0x9}, {0x1, 0x401, 0x4, 0x81, 0x1, 0xfffffffb}, {0x735, 0x60000000, 0x6, 0x1, 0x3f, 0xff}, {0x4, 0x5, 0xd48, 0x1ff, 0x6, 0x4}, {0xad, 0x0, 0x80000000, 0x8, 0x0, 0x788}, {0x0, 0x101, 0x3ff, 0x3f, 0x1, 0x9}, {0x2, 0x8, 0x3, 0x59a, 0x2, 0x7fffffff}, {0x76be, 0x7ed4, 0x80000000, 0xfffffff8, 0x1, 0x20}, {0xffffffff, 0xb1, 0x6, 0x9, 0xc5e, 0x401}, {0x7fff, 0x1, 0x6, 0x6, 0x3, 0x8}, {0x80000001, 0x1, 0x68b, 0x8b7, 0xce8a, 0x9}, {0xeb, 0x3, 0x2, 0x4, 0x4, 0xfffffffa}, {0x9, 0x10000, 0x10000, 0x7ff, 0xffffff00, 0x40}, {0x101, 0x590, 0x80, 0x10001, 0xffff, 0x70c}, {0xfffffff9, 0x0, 0x6, 0x7ff, 0x800, 0x7fffffff}, {0xff, 0x9, 0x468f, 0x8, 0xffffffff, 0x3}, {0x0, 0x0, 0x0, 0x5, 0xffffff3f, 0x8}, {0x7, 0x4, 0x100, 0x401, 0x7, 0xf75f}, {0x7, 0x6, 0x80, 0xfffff000, 0x5, 0x2}, {0x1, 0x3, 0x3, 0x8, 0x8, 0x3ff}, {0x3ff, 0x81, 0x200, 0x1cf2, 0x1, 0x200}, {0x5, 0x4, 0x7ff, 0xfffffff8, 0xff, 0x7}, {0x9, 0x5a, 0x9, 0xfffffffe, 0x20, 0x7}, {0x7fff, 0x4, 0x1, 0x4, 0x2, 0x5}, {0x0, 0x88, 0x1, 0x100, 0x56, 0x6fe}, {0x4, 0x5, 0x7, 0xf4, 0x4d02899e, 0x2}, {0x101, 0xffffffff, 0x20, 0x4d44, 0x7, 0x80000001}, {0x1ff, 0xfffffffc, 0x1, 0x6, 0x5, 0x7}, {0x80000000, 0x0, 0x5, 0x0, 0x6, 0x101}, {0xc136, 0x7, 0x5, 0x0, 0x9, 0x9}, {0x5, 0x3, 0x80a, 0x80000000, 0x81, 0x5}, {0x7, 0x7fffffff, 0x5, 0x80fe, 0x9a, 0x6}, {0x0, 0x200, 0xfffffffa, 0xffffffff, 0x0, 0x7f}, {0x10001, 0x1, 0x20, 0x200, 0xfffff60f, 0x7}, {0x1, 0x9, 0x1, 0x6, 0x3, 0x5}, {0x20, 0x4, 0x8001, 0x4, 0x9, 0x9}, {0x400, 0x7fff, 0x7ff, 0x1, 0x7, 0x100}, {0x80000000, 0x9, 0x4, 0x10001, 0x7fffffff, 0xdee}, {0x0, 0xc8c, 0x6, 0x7fff, 0x48, 0x1ff}, {0x0, 0x3ff, 0x3, 0x407e, 0x80, 0xeacb}, {0x10001, 0x33800, 0xfffffffc, 0x2, 0x695, 0xffffffff}, {0x0, 0x8001, 0x4, 0x5, 0x804, 0x8}, {0x4, 0x7, 0xeb9, 0x2, 0x8000000, 0x9}, {0xfff, 0x7, 0x1ff, 0x6, 0x7fff}, {0x80000001, 0x81, 0x5d, 0x7, 0xb29a, 0x9}, {0x2, 0x9, 0x5, 0x625e, 0x7, 0x9}, {0xff, 0x3ff, 0x3, 0x10001, 0x6, 0x20}, {0x3, 0x81, 0x9, 0x1, 0x4, 0x3f}, {0xfff, 0x2, 0xff, 0xffff, 0x7, 0x1}, {0x20, 0x5, 0x4, 0x8, 0x7, 0x36}, {0x7ff, 0x180, 0x7, 0x0, 0x100, 0x6}, {0x3ff, 0x6, 0x3ff, 0x8, 0x1, 0x1f}, {0x7, 0x0, 0x8, 0x100, 0x5, 0x5}, {0x3ff, 0x4, 0x34, 0x8, 0x8001, 0xffffffff}, {0x8a, 0x3e, 0xffff, 0x70000, 0x81, 0x1f}, {0x7fff, 0x1ff, 0x1, 0x3, 0x2, 0x4}, {0xffff8001, 0x4, 0x6f7, 0x1, 0x1e0949fe, 0x5}, {0x6, 0xca8, 0x3ff, 0x40, 0x1ff, 0x1ff}, {0x40, 0x1000, 0xffffffff, 0x9, 0x8, 0x114c}, {0x8, 0x448f, 0x7fff, 0x5ab, 0x80000001, 0x9}, {0x9, 0x0, 0x3, 0x80000000, 0x3, 0x1}, {0x6, 0x6, 0x6, 0x10000, 0x1e, 0x9e}, {0x100, 0x1ff, 0x8, 0x0, 0x7ff}, {0x5, 0x7, 0xfffffe00, 0x9d19, 0x7fffffff, 0xffffff77}, {0x0, 0x7, 0x80, 0x80000001, 0x4}, {0x3ff, 0x80000001, 0x9, 0x8001, 0x2, 0x4}, {0x1, 0x0, 0x6, 0x2, 0xe33, 0x16f9db01}, {0x1fe, 0xfffffffb, 0x3, 0x72, 0x7}, {0x2, 0xdd, 0xfffffeff, 0x10000, 0x200, 0x7}, {0x58cf, 0x6, 0x400, 0x3, 0x1000, 0x28}, {0x5ec, 0x4, 0x4, 0xc, 0x0, 0x5}, {0x2, 0x10001, 0x7, 0x3c, 0x1, 0x8c8}, {0x3, 0x80000000, 0x7fffffff, 0x7f, 0x64, 0x3}, {0xffffffff, 0x1, 0x7, 0x800, 0x3, 0x100}, {0x6, 0x8, 0x8, 0x0, 0x0, 0x4}, {0x5, 0xfff, 0x59f, 0x1, 0x3dc, 0x8001}, {0x400, 0xe96000, 0x8, 0x0, 0xffff7fff, 0x101}, {0x9, 0x3, 0x400, 0xd7c, 0xed97, 0xfffffffe}, {0x5, 0x5, 0x695, 0xffffff4f, 0x3, 0x2}, {0x800, 0x1000, 0x7, 0x7fff, 0x3, 0xc29c}, {0xfff, 0x3, 0x5, 0x0, 0x6, 0x20}, {0x1ff, 0xc7c5, 0x7, 0x9, 0x6, 0x5742606b}, {0x400, 0x5f8, 0x401, 0x0, 0xdb5c, 0x8}, {0x0, 0x0, 0x6, 0x11d, 0x3, 0x9}, {0x81, 0xffff, 0x5, 0x6, 0x2, 0x4}, {0x6, 0x3, 0x2, 0x7, 0x7fffffff}, {0x4, 0xfff, 0x8, 0x2, 0xffffff01, 0x7}, {0x80000001, 0x8000, 0x800000, 0x80000001, 0x2, 0x8}, {0x2, 0x81, 0xb0, 0x1, 0x7, 0x80}, {0x5, 0x20, 0x8, 0x3, 0xcf, 0x6}, {0x2, 0x68, 0xfada, 0x7, 0x80000000, 0x1}, {0x1, 0x3f, 0x3, 0x4, 0xfff, 0xfffffff9}, {0xa48, 0x4, 0x8, 0x0, 0x8, 0x1}, {0x2, 0x3, 0x80000000, 0x0, 0x1, 0xd0}, {0x7fff000, 0x7fffffff, 0x20, 0x1f, 0x7, 0x4}, {0x2, 0x1ff, 0x40, 0x3, 0x8, 0x81}, {0x1000, 0x7, 0x0, 0x8, 0x1}, {0x5, 0x3, 0x1f, 0x9, 0x4, 0x9}, {0xb85, 0x101, 0x0, 0x1, 0x9, 0xfffffff7}, {0x9, 0xb8e, 0xfffffffd, 0x80000000, 0x7, 0xf6}, {0x0, 0x10000, 0x8001, 0xfffff800, 0x3}, {0x2, 0x8, 0x4, 0x3a, 0x2, 0x3}, {0xf93d, 0x1ff, 0x40, 0x80000000, 0x7, 0x10000}, {0x2, 0x7, 0xce0, 0x7c385789, 0x4, 0x20}, {0x7, 0xfffffc00, 0x2, 0x94, 0x5, 0xffffffff}, {0x8, 0xfffffffa, 0xa692, 0x4a82805b, 0x101, 0x40}, {0x5, 0x3, 0x9, 0x5, 0x2, 0x4}, {0x1, 0x1, 0x81, 0x9, 0x5, 0x3}, {0x4ae, 0x7, 0xffffffff, 0x2, 0x9, 0x6}, {0x0, 0x390f, 0x8, 0x2, 0x3, 0x4}, {0x9, 0x12, 0x3, 0x7f02fab3, 0x3cb6, 0x1}, {0x0, 0x2, 0x6cb, 0x0, 0x6, 0x207d}, {0x2, 0x200, 0x20, 0x7f, 0x6, 0xc27e}, {0x4, 0x6c58000, 0x8001, 0x4ca, 0x80, 0x1}, {0xa7, 0xc6, 0x10000000, 0x8000, 0x1ff, 0x8001}, {0xe6, 0xcc, 0x1, 0xac0, 0x7fffffff, 0xbbe0}, {0x200000, 0x1, 0x0, 0x101, 0xff}, {0x3, 0xc1b6, 0xf, 0x1, 0x8c, 0x8}, {0x7f, 0x9, 0x3c8d, 0xf9, 0x9, 0x8}, {0x4, 0x3, 0xbe, 0x6, 0x7ff, 0x9}, {0x8000, 0x1, 0x9, 0x4, 0x0, 0x8000}, {0x8, 0x1, 0x2, 0x80, 0x2, 0xffff0001}, {0x20000000, 0x0, 0x5, 0x9d, 0x1, 0x59f}, {0x100, 0x4, 0x7, 0x7, 0xf, 0x7}], [{0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x3}, {0x4}, {0x0, 0x1}, {0x3}, {}, {}, {0x2}, {0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {}, {0x4}, {0x5}, {0x5}, {0x2}, {0x0, 0x1}, {0x0, 0x1}, {0x5}, {0x1}, {0x1, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x3, 0x1}, {0x5}, {0x2}, {0x5, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2}, {0x2, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x1}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x5, 0x1}, {0x4}, {0x4, 0x1}, {0x6}, {0x1, 0x1}, {0x2}, {0x5, 0x1}, {0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x5}, {0x5, 0x1}, {0x2}, {0x4}, {0x5, 0x1}, {0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {0x3}, {0x0, 0x1}, {0x2}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {0x1}, {}, {0x3}, {0x3}, {0x1, 0x1}, {0x5}, {0x3}, {0x3}, {0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x2}, {0x2, 0x1}, {0x2}, {0x1}, {0x5}, {0x5}, {0x0, 0x1}, {0x4, 0x1}, {}, {0x2, 0x1}, {0x5}, {0x0, 0x1}, {0x2}, {0x2, 0x1}, {0x0, 0x1}, {0x5}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x55c2e8715ac90ffd, 0x1}, {}, {0x1}, {0x4}, {0x5}, {0x0, 0x1}, {0x0, 0x1}, {0x4}, {0x4}, {0x4}, {0x1, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x1}], 0x1}}, @TCA_PEDIT_PARMS_EX={0xe38, 0x4, {{{0x5, 0x6, 0x5, 0x1, 0x9}, 0x1, 0x3, [{0x8000, 0xffffffff, 0x2, 0xfffffffa, 0x5, 0x20}]}, [{0x2, 0x1ff, 0x7, 0xfffffff8, 0xe081, 0x101}, {0x6, 0x5a0, 0x6, 0x1000, 0x1, 0x8}, {0xba, 0x9, 0x29d, 0x0, 0x6, 0x5}, {0x401, 0x308, 0x200, 0x6, 0x5, 0x9}, {0x2, 0xf2, 0x800, 0x1, 0x9, 0x3f}, {0x1, 0x0, 0x5, 0x4, 0x1}, {0x1, 0x7, 0x80000000, 0xf28d, 0x5, 0x1}, {0x3128, 0xb4, 0x9, 0x7, 0xffffffff, 0x382c}, {0x5, 0x9, 0x7, 0x1, 0x5, 0x4}, {0x7ab8, 0x3, 0x6, 0x800000, 0x7, 0x2}, {0x8, 0x81, 0x9, 0x3, 0x7, 0x7}, {0x3, 0x7ff, 0x3, 0x3, 0x7ff, 0x1f}, {0x9, 0x100, 0x8, 0x17, 0xfffffffe, 0x1000}, {0x6, 0x2, 0x3, 0x9, 0x62, 0x6}, {0x3ff, 0x7, 0x1ff, 0x2, 0x0, 0x8}, {0x9, 0x26, 0xffffff81, 0x200, 0x80000001, 0x81}, {0x3, 0x5, 0x0, 0xfffffff7, 0x2, 0x88}, {0x400, 0x81, 0x0, 0xfffeffff, 0x7, 0x2}, {0x101, 0x3, 0x628, 0xb0b, 0x3, 0x4}, {0x794, 0x5, 0x188, 0x0, 0x5a, 0xf1}, {0x2, 0x0, 0x1, 0x7f, 0x200, 0xfffffe01}, {0x0, 0xa000, 0x9, 0x7, 0x8, 0x7}, {0xffff, 0x6, 0x1, 0x6, 0x22ff, 0x2}, {0x4b, 0x5, 0x735, 0x3, 0x4, 0x10001}, {0x2, 0x7, 0x8001, 0x1, 0x8001, 0x7f}, {0x80000001, 0x8000, 0x0, 0x8742, 0x8, 0x2}, {0x7fffffff, 0x8ac, 0xfffffffd, 0x3, 0x5, 0x3}, {0x1, 0x4, 0x7f, 0x100, 0x80000001, 0x6}, {0x7ff, 0x2c, 0x7d7c, 0x0, 0x0, 0x300}, {0x175e44c4, 0xfff, 0x8, 0x3, 0xd92, 0x82}, {0x20, 0x8, 0x7, 0x8225, 0x5, 0x7f}, {0x40, 0x1, 0x3, 0x8001, 0x3f, 0x9}, {0x2, 0x7, 0x8, 0x0, 0x8, 0x9}, {0x4, 0x5, 0x10001, 0x9, 0xba, 0xb8}, {0x1000, 0x9, 0x8, 0x4, 0x0, 0x1}, {0xa9, 0x3ff, 0x20e, 0x3, 0x2}, {0x0, 0x0, 0x380000, 0xe, 0xfffffeff, 0x8}, {0x2, 0x81, 0x9, 0x9, 0xfffffe01, 0x7ff}, {0x0, 0x3bd, 0xc597, 0x6, 0x0, 0x80000001}, {0x200, 0x2, 0x43, 0x80000001, 0x9, 0x9}, {0x4, 0x9, 0x0, 0x2b90, 0x899, 0xb65}, {0x59, 0x9, 0xfffffeff, 0x6, 0x2, 0x8000}, {0x0, 0x81, 0x5, 0x80, 0x4, 0x4}, {0x3994, 0x4, 0x6, 0x0, 0xa514}, {0x8000, 0x38, 0x7, 0x0, 0x8, 0x1}, {0xfffffff8, 0x7, 0x3ff, 0x6, 0x5}, {0x40, 0x55f9, 0x7f, 0x2, 0x1000, 0x10000}, {0x1, 0xff, 0x81, 0x4, 0x7, 0x3d4c}, {0xffffff65, 0x9, 0x4, 0x9, 0x2, 0xfff}, {0x7f, 0xa1, 0x8, 0x0, 0x1, 0x9}, {0x5, 0x9, 0x0, 0x8c8, 0x3e, 0x4}, {0x2, 0x80000001, 0x2, 0x2, 0xffff0001, 0x7fffffff}, {0x74, 0x1, 0x1ff, 0x2, 0x1, 0x1}, {0x1f, 0x3, 0x7, 0x1, 0xffffffc1, 0x3}, {0xe37, 0x5, 0x80000001, 0x4, 0x10000, 0x100}, {0xe8f6, 0xfffffff9, 0x2, 0x400, 0x0, 0x8000}, {0xfffffda0, 0x0, 0x1e2, 0x8, 0x2, 0x2}, {0x2, 0xffffffff, 0x200, 0x7, 0xfffeffff, 0x101}, {0x0, 0x1f, 0x0, 0xd734, 0x7bd9, 0xffc0000}, {0x8, 0xffff8001, 0x9, 0xd81, 0x3, 0x5}, {0x6, 0x7af463f3, 0xfffff001, 0x5, 0x10000, 0x81}, {0x4000000, 0x6, 0xc0000000, 0x3eae, 0x1, 0x8001}, {0x2973, 0x57a9, 0x3, 0x85, 0x7, 0x1}, {0x0, 0x173, 0x400, 0xecf, 0x5, 0x8001}, {0x7, 0x5, 0xfffff371, 0x7ff, 0x9, 0xd78}, {0x5, 0x9, 0x7, 0x2558, 0x6}, {0x3, 0x7, 0x8, 0x8cd, 0xffffffff, 0x9}, {0x1, 0x4d, 0x8001, 0x0, 0x7, 0x28}, {0xff3, 0x8, 0x2, 0x400, 0x7, 0x200}, {0x0, 0x81, 0x1, 0x9, 0x7fffffff, 0xd48f}, {0x5, 0x0, 0x8b, 0x9, 0x374f5515, 0x2}, {0x5, 0x6, 0x9, 0x7, 0xfffffff7, 0x80000001}, {0x3f, 0x400, 0x9, 0xd2a, 0x4}, {0x5, 0x8, 0x8001, 0x2, 0x200, 0xd4b6}, {0x9, 0x81, 0x2, 0x0, 0x6, 0x8}, {0x8595, 0x1c81, 0x400, 0x3, 0x3ff}, {0x80000001, 0x8, 0x1ff, 0x5, 0xe6a8, 0x9}, {0x8, 0x200, 0x3, 0x7, 0x6, 0x6884}, {0x7, 0x1000, 0x86, 0x101, 0x0, 0x3f}, {0x0, 0x9, 0x8, 0x7, 0x8, 0x4}, {0x2, 0x2, 0xfffff61a, 0xb4, 0x3ff, 0xfffffff9}, {0x0, 0x20, 0x6, 0xffff, 0x6c, 0x5}, {0x3, 0x1ff, 0xa979, 0x7, 0xfffffff8, 0x80000001}, {0x1, 0xfffffffb, 0x400, 0x3, 0x0, 0x7}, {0x200, 0x5, 0x100, 0xffffff72, 0x6, 0xd97}, {0x2, 0xfffffbff, 0x80, 0x9, 0x1ff, 0xffff}, {0x0, 0x3, 0x6, 0x88, 0x1d26438f, 0x5}, {0x100, 0x0, 0x3f87, 0x4, 0x80, 0x2}, {0x1, 0x3, 0x3, 0xfffffffc, 0x2, 0x8}, {0x6, 0x3ff, 0x3, 0x9, 0x7, 0x7}, {0x21, 0x5, 0x1, 0x0, 0x262, 0xfffff800}, {0x1900, 0x9f, 0x7, 0x9, 0x100, 0xe5}, {0x9, 0x2, 0x3f, 0xf98e, 0x0, 0x3}, {0x8, 0x50695ea6, 0x6, 0x2dba, 0x6, 0x8}, {0x3, 0x15, 0x9, 0x3, 0x1, 0x1}, {0x1, 0x3, 0x3ff, 0x2, 0x2, 0x8}, {0x1000, 0x3, 0x800, 0x7, 0x10000, 0xf0}, {0x4, 0x7, 0x6, 0x20000000, 0x9, 0x42fc}, {0x8, 0x62, 0x6, 0x3f, 0x9, 0x80000000}, {0x2, 0x2dd, 0x6da, 0xfffff1a2, 0xfff, 0x3}, {0x2, 0x5, 0x400, 0x7, 0xd867, 0x3}, {0x5, 0x9, 0xd92e, 0x1, 0x2, 0x2}, {0x8, 0x7, 0x8, 0x2, 0x8001, 0x7f}, {0x1, 0x1, 0x4, 0xc78, 0x3, 0x1}, {0xffffff81, 0x4, 0x8, 0x8, 0x0, 0x57}, {0x10000, 0x5, 0x7ff, 0x5, 0x101, 0x8}, {0x20, 0x3, 0x3, 0x6, 0x7, 0x7}, {0x6, 0xfffffc00, 0x4, 0xffff8000, 0x7f, 0x8}, {0x0, 0x5, 0xffffffff, 0x7ff, 0x95, 0xfffffe01}, {0xfffffffc, 0x80, 0x4, 0xff, 0x6, 0x3f}, {0x0, 0x1, 0x4, 0x1f, 0x2, 0xbe8a}, {0x0, 0x3, 0x6, 0x0, 0x4, 0x7}, {0x6, 0x0, 0xfcf, 0x3, 0x4e139636, 0x4}, {0x3, 0x1, 0x8, 0x4, 0x1, 0x10001}, {0x1, 0x4, 0x0, 0x7, 0x3, 0xffffffff}, {0xfffffc01, 0x1d3c, 0x1, 0x1, 0x1, 0x8}, {0x5, 0x5, 0x3ff, 0x4256, 0x9, 0x38}, {0x6, 0x1, 0x3, 0x18, 0x800, 0x9}, {0xdaca, 0x1, 0x81, 0x401, 0x76, 0x19}, {0x10001, 0x6, 0x93ca, 0x2, 0x7, 0x20}, {0x7, 0x2, 0x3ff, 0x1, 0x2, 0xe51}, {0x5, 0x7, 0x3ff, 0x9, 0x8, 0xac7}, {0x3ff, 0x2, 0x9, 0x1, 0x4f}, {0x5, 0x23, 0x10000, 0x81, 0x53, 0x9}, {0x1, 0x7ce, 0x1e, 0x25, 0xfffffff9}, {0x6, 0x7ff, 0x4, 0x63b, 0x7ff, 0x7f}, {0x6, 0xffff, 0x5000000, 0x6, 0x8, 0xf207}, {0xda89, 0x20, 0x1ff, 0x0, 0x61d, 0xfff}], [{0x2}, {0x3, 0x1}, {0x763b3ae2af9a9491}, {0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x5}, {0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {0x2}, {0x3}, {0x2}, {0x0, 0x1}, {0x2}, {0x7}, {0x3, 0xf547f92a1aaf037e}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x702226dd7891fd10}, {0x2, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x4, 0x1}, {0x2}, {0x5}, {0x2, 0x1}, {0x4, 0x1}, {0x4}, {0x0, 0x1}, {0x4, 0x1}, {0x3}, {0x7, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x5}, {0x4, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x5}, {}, {0x2, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x5}, {0x0, 0x1}, {0x2, 0x1}, {0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {}, {}, {0x5, 0xa6d7d58b5e2d1c4}, {}, {0x3, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {}, {0x2}, {0x1, 0x1}, {}, {0x4}, {0x5, 0x1}, {0x5}, {0x4}, {0x2, 0x1}, {0x1}, {0x0, 0x1}, {0x5, 0x1}, {}, {0x3}, {0x5, 0x1}, {0x1, 0x1}, {0x3}, {0x0, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x5}, {0x4, 0x1}, {0x4}, {0x5, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x2}, {0x4, 0x30dbf489a422a0b5}, {0x1}, {0x1, 0x1}, {}, {}, {0x2, 0x1}, {0x1, 0x1}, {0x1}, {0x3, 0xf8d279b93d137304}, {0x3}, {0x1, 0x1}, {0x0, 0x1}, {0x4}, {0x1}, {0x2, 0x1}, {0x2, 0x1}]}}, @TCA_PEDIT_PARMS={0xec8, 0x2, {{{0xa20, 0x5, 0x2, 0x101, 0x8}, 0x8, 0x8, [{0x101, 0x80, 0x7, 0x10000, 0x4, 0x80000000}, {0x8, 0xa347, 0x8, 0x7f, 0x4, 0x5}, {0x1, 0x6, 0x2, 0x80000001, 0xfff, 0x6}, {0xff, 0x9, 0x3, 0x5, 0x3, 0x5}, {0x80000001, 0x7, 0x7fffffff, 0xfffffff9, 0x7fff, 0x401}, {0x80000000, 0x3, 0x9860d27, 0x0, 0x5cb, 0x1}, {0x3, 0x66e, 0x5, 0x79d, 0x4, 0x1}]}, [{0x2, 0x2, 0x445, 0x10001, 0x1, 0x49}, {0x0, 0x7fff, 0xfffffffc, 0x8000, 0xf41, 0x7}, {0x0, 0x8, 0x351, 0x7fff, 0x0, 0x4}, {0x0, 0xffff, 0x40, 0x63c7e3a5, 0x1, 0xf6}, {0x95, 0x80, 0xffffffff, 0x20, 0x4, 0x10000}, {0x6, 0x2, 0x49520da1, 0x8000, 0x5, 0x2d5d}, {0x746, 0x5, 0x7, 0xae, 0x6e4, 0x3f}, {0x2, 0x7, 0x1, 0x0, 0xa04, 0x2}, {0x6, 0x5, 0x7, 0x2, 0x101, 0x400}, {0xa017, 0x1, 0x6, 0x0, 0xc, 0x9f3}, {0x2, 0xffffffff, 0x5, 0x8001, 0xffffffff, 0x3}, {0x1f, 0xd342, 0x7, 0x101, 0x80000000, 0x2}, {0x1, 0x1b344756, 0x1f, 0x1, 0x8, 0x8001}, {0x5, 0x3, 0x331, 0xffffffff, 0x1, 0xe16}, {0xfffffff8, 0x4, 0x6, 0x9, 0x9, 0xfe}, {0x44, 0xfff, 0x1ff, 0x2, 0x40, 0x10001}, {0x80000001, 0x7, 0x200, 0x4, 0x5}, {0xffffffff, 0x0, 0x80, 0x101, 0x1f, 0x80000001}, {0xc0, 0x552dcb8f, 0xfff, 0x400, 0xe9, 0x7f}, {0x800, 0x5, 0x0, 0x20, 0xfffffff8, 0x100}, {0x55a, 0x4, 0x2, 0x5f, 0x7, 0x7fff}, {0x3, 0xf7a, 0xfff, 0x9, 0x40, 0x1492}, {0x5, 0x45fb539d, 0x0, 0x2, 0x90000000, 0x1}, {0x6, 0x2868652b, 0x36249be0, 0x1, 0x2, 0x80}, {0xfffc0000, 0xa6, 0x20, 0x1f, 0x2, 0x1}, {0xce, 0xe0, 0x8, 0x80000001, 0x6, 0x6}, {0x1, 0x100, 0x7f, 0xaeb, 0x4, 0xfff}, {0x6, 0xfffff000, 0x6, 0x9, 0x40, 0x6}, {0x7, 0x1ff, 0x5d8, 0xa6cd, 0x3, 0xffffffc1}, {0x1, 0x1, 0x5, 0x2cc6, 0x78}, {0x1, 0x9, 0x81, 0x0, 0x10000, 0x80000001}, {0xf8, 0x3ff, 0x200, 0xff, 0x4000000, 0x7}, {0xffff0302, 0x0, 0x2, 0x1, 0x1000, 0xffff0000}, {0x7fffffff, 0x8, 0x3, 0x1ff, 0x7, 0x1f}, {0xfff, 0x1, 0x3ff, 0x0, 0x3, 0x3ff}, {0xffff, 0x7, 0x1ff, 0x5, 0x6, 0x7}, {0x7, 0xfd25, 0x1, 0x3f, 0x5}, {0x7ff, 0x80, 0x6, 0x800, 0x401, 0xbf0b}, {0x80000000, 0x6, 0x8, 0x47, 0x2, 0x2}, {0x80, 0x4, 0xf3ab, 0x10001, 0x401, 0x1}, {0x101, 0x4, 0x2b0, 0x4, 0x80000000, 0x7}, {0xc68f, 0xfff, 0x8917, 0x10000, 0x7, 0xf3}, {0x5, 0xffff0001, 0x80, 0x2, 0x7fff, 0x101}, {0x101, 0x9, 0x7, 0x0, 0x4, 0x63}, {0x1, 0x80000001, 0x0, 0x3, 0x5, 0x9}, {0xc224, 0xfffffffa, 0x101, 0x2, 0x7fffffff}, {0x1, 0x800, 0xffffff17, 0xfe000, 0x1, 0xa00}, {0x4, 0x2, 0x4, 0x4, 0xfffffff7, 0x200}, {0x0, 0xe8, 0x4, 0x3f, 0x8}, {0x5, 0x1000, 0x3ea30722, 0x0, 0x1, 0x3ff}, {0xfffffff7, 0x800, 0x618a, 0x1, 0x2f9, 0x3f1}, {0x9, 0x4, 0xe4e3, 0x4, 0x6, 0x4fe9}, {0x1f, 0x6, 0x5, 0x7, 0x1, 0x1}, {0x0, 0xe2f4, 0xfffffff7, 0x0, 0x8, 0x1}, {0x0, 0x3, 0xfffffffe, 0xffffc57a, 0x9, 0x9}, {0x1f, 0x3, 0x5, 0x10001, 0x20, 0x3}, {0x0, 0x7, 0xa2f, 0x1, 0x6, 0x3}, {0xffffffff, 0x8, 0xffffff38, 0x3, 0x9, 0xffffffff}, {0x10000, 0x200, 0x1, 0x1ff, 0x1, 0x80}, {0xfb95, 0x637d, 0xffffac68, 0x0, 0x8000, 0x7a5f}, {0x1, 0x1000, 0xaa, 0x9, 0x3, 0x7}, {0x8, 0xf6, 0xc77, 0x1, 0x0, 0xbe77}, {0x40, 0x541, 0xffff, 0x4d6d, 0xfffffffb, 0x9}, {0x4, 0x0, 0x5, 0x7fff, 0x40}, {0x9f21, 0x8001, 0x4, 0xffff0000, 0x9, 0x3}, {0x80000000, 0x7, 0x7, 0x1f, 0x3, 0x8}, {0x50, 0x2, 0x400, 0x983, 0x80000000, 0x4}, {0x7f, 0x6, 0x5, 0x81, 0x101, 0x2}, {0x5, 0xfff, 0x1, 0x5, 0x7, 0x9}, {0x800, 0x0, 0xfffffc00, 0x800, 0x0, 0x3}, {0x3, 0x8, 0x800, 0xfffffff9, 0x4, 0x2}, {0x3, 0xa5, 0x6, 0x2, 0x0, 0xfffeffff}, {0xff, 0x730, 0x9, 0x0, 0x6}, {0x4, 0x4, 0x8, 0x5173e711, 0xe6c, 0x7}, {0x2, 0x0, 0x4, 0x29f0, 0x3f, 0x4}, {0x3, 0x0, 0x2a11, 0x3, 0x8, 0x101}, {0x40, 0x3, 0x80000001, 0xff, 0x101, 0x457}, {0x3a0a8534, 0x2, 0x2, 0x7, 0x200, 0x7ff}, {0x10000000, 0x9b77, 0x7, 0x5, 0x6, 0x1}, {0x7, 0x800, 0x30, 0xfffff800, 0x20, 0x2}, {0x8, 0x9, 0x2, 0xffff, 0x7fff, 0x3ff}, {0x1e, 0x2, 0x7, 0x22c3df7a, 0x42, 0x2}, {0x80000001, 0x80, 0x0, 0x1, 0x3f, 0x5}, {0x6, 0xa227, 0x10000, 0x0, 0xaa, 0x4}, {0x40, 0x8000, 0x20, 0xe3, 0x5, 0x7}, {0x800, 0x6, 0x800, 0x4, 0x401, 0x1}, {0x44f9, 0xf88f, 0x8ec5, 0xffffffff, 0x200, 0xfffffffe}, {0x0, 0xfe8, 0x5, 0x10001, 0xd26, 0x81}, {0x0, 0x1, 0x3ff, 0x6, 0x3}, {0x7, 0x8, 0x49d1, 0x400, 0x8, 0x7ff}, {0xfff, 0x9, 0x4, 0x401, 0x10cc, 0x40}, {0x51a4, 0x8, 0x0, 0x1000, 0x9, 0x10001}, {0xab, 0x401, 0xffffffe1, 0x3f, 0x5, 0x5}, {0x20, 0x3, 0x56c, 0x5, 0x35c2, 0x8}, {0x3ff, 0x2, 0x9, 0x4, 0x9, 0x7}, {0xffff, 0x6, 0x4, 0x3, 0xffffffff, 0x9}, {0x3, 0xf7, 0x8, 0xfffffffd, 0x8, 0x4}, {0x9c08, 0x1ff, 0x5, 0xffff, 0x2, 0x7}, {0xf8f, 0x8, 0xffff8c34, 0x4, 0x3, 0xe0000000}, {0x6, 0xfff, 0x1, 0x3, 0xa830, 0x5}, {0x80000001, 0x0, 0x7f, 0x8a, 0x8, 0x1}, {0x3f, 0x1, 0x80, 0x0, 0x7, 0x8}, {0x80000001, 0x3, 0x1, 0x7, 0x4c95, 0x1}, {0x1, 0x5, 0x1, 0x9, 0xfff, 0x1}, {0x5, 0x8000, 0x1, 0x6, 0x6, 0x1}, {0x9, 0x1, 0x0, 0x0, 0xfffffffd, 0x4}, {0x7fff, 0x0, 0x7, 0x400000, 0x401, 0x4}, {0x3, 0x7, 0x7, 0x2000000, 0x3}, {0x75, 0x6, 0x8, 0x5, 0x9, 0x1}, {0x3a, 0x1, 0x6, 0x1, 0x40b, 0x8}, {0x1, 0x8000, 0x6, 0x7, 0x17a, 0x8001}, {0x400, 0x9, 0x6, 0x1ff, 0xed78, 0x4}, {0x2684, 0xffffff00, 0x8, 0x3, 0x8000, 0xffffffff}, {0x3f, 0x5, 0x9, 0x7ff, 0x1000, 0x6ec}, {0x9, 0x4, 0x10001, 0x21d, 0x4, 0x5}, {0x7ff, 0x4e83, 0x6, 0x3ff, 0x4, 0x1}, {0x100, 0x9, 0x10000, 0x5, 0x9, 0x4}, {0x10000, 0x8, 0x1, 0x8, 0xfffff800, 0x3f}, {0x1, 0x0, 0x1, 0x8, 0x10000, 0x3}, {0x180000, 0x0, 0x6, 0x3, 0x3, 0x6}, {0x200, 0x455, 0xffffffe1, 0x7, 0x1f, 0x1f}, {0x8, 0x9, 0x7, 0x9, 0x1dbf534e, 0xc49}, {0x8, 0x3, 0x6d, 0xb36, 0x3800000, 0x7fff}, {0x100, 0xb40, 0x4, 0xbd67, 0x9, 0x3}, {0x101, 0x6, 0x3, 0x8c0, 0x4, 0x80000000}, {0x6, 0x1, 0x7fffffff, 0x8000, 0x800, 0x80000001}, {0x7f, 0x1, 0x80, 0x3, 0x1, 0x2}, {0x7, 0x2, 0x2, 0x8001, 0x4ec, 0x2105}], [{0x2, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x4}, {0x4}, {0x5}, {0x3, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x4, 0x4ca3bb75a57b376e}, {0x4}, {0x5, 0x91af9d4379b14799}, {0x3}, {0x3}, {0x4, 0x1}, {0x5, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x1}, {0x1}, {0x5, 0xc073656b59cab5dc}, {0x5}, {0x3}, {0x0, 0x1}, {0x5}, {0x3}, {}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0xc1e73e9a02a073b, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x2}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x3}, {0x5, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x1}, {0x5}, {0x1}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2}, {0x3, 0x1}, {}, {0x5}, {0x3, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x5}, {0x5, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x3}, {0x4, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x4}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x1}, {0x2}, {0x0, 0x1}, {0x7, 0x1}, {0x5, 0x1}, {0x4}, {0x3}, {0x0, 0x3483d56c5149161f}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x3}, {}, {0x4, 0x1}, {}, {0x5, 0x1}, {0x1}, {0x2}, {0x2}, {0x9ac24a2e0c32934a, 0x1}, {0x3}, {}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x2}, {0x1}, {0x4}, {0x5}, {0x2, 0x1}, {}, {0x2, 0x1}, {0x1, 0x1}, {0x4, 0xba3e3af3da3c0724}, {0x5}, {0x3}], 0x1}}, @TCA_PEDIT_KEYS_EX={0x164, 0x5, 0x0, 0x1, [{0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}]}, {0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}]}, {0x1c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}]}, {0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0xee49a041e0b04ff5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}]}, {0x2c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}]}, {0x2c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}]}]}, {0xbd, 0x6, "dfdd6c2f1fffc80cd207b515efd0905452db950bb7007deaed537755ff60718b901f3e4bc68f5d94fbb841d9188c365bd427a2397756ebd21fef2cf89fe06740a6aaa2a602ed089ca43ad0c2f9f90f882e22101fa3e1d9e09f2f78ece5eb1ffd95db3ec4ec0949cdb6a609a49fc4596e07bc4145de952c4dddfd5466928275dd790f9e0e94a28fea3621622814179414b47858883cef3f3477240c386606b0bab4c2f2c4e0d38fe917c0cdd1eb6dd90f36ea187e5027693a4c"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ipt={0x128, 0x1e, 0x0, 0x0, {{0x8, 0x1, 'ipt\x00'}, {0xd4, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x9e, 0x6, {0x0, 'security\x00', 0x3, 0x4, "7a19052d74d332079f9a1713a721eb888df17b8066e7ac520efdabe519207df5688bfb13a30857a5d1153a77d304b9198552932118bd79bcc8aa151e749dee51b08499508252cfff1b79f792875970ec2e995737f84e7c6adef6281677dab64ef8fe1de2762e787b1349e5569694f368d657a352"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x5}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_INDEX={0x8, 0x3, 0xfffffbff}, @TCA_IPT_INDEX={0x8, 0x3, 0x7}, @TCA_IPT_HOOK={0x8, 0x2, 0x1}]}, {0x30, 0x6, "7b84595c505d9b7047a6a75e682fa8e89c439a2ea0cf04c854c0683ea1acd22a9c3b84d3775d7131066f053e"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}, @m_mpls={0xb8, 0xc, 0x0, 0x0, {{0x9, 0x1, 'mpls\x00'}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_BOS={0x5}]}, {0x7a, 0x6, "cc3da067ce0ef4ab51106a34a93a097454b19effca72f862bec3411885868ed05f2b0d452e43a48b1aa40783d0b9ed6ff04c92e7cbfb7d4ed7a2fd87ac10659738012e0411112320a0575acd1a4b9b0275ddf577fb330e80fa4955fc869833012dd378b365fc53ef4638e045d35fddb7576df54d7d2d"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_simple={0xd0, 0x9, 0x0, 0x0, {{0xb, 0x1, 'simple\x00'}, {0x4c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0xffffff01, 0x1, 0x1, 0xf9, 0x2}}, @TCA_DEF_PARMS={0x18, 0x2, {0x9, 0x8, 0x6, 0x58d, 0x7fff}}, @TCA_DEF_PARMS={0x18, 0x2, {0xffffffff, 0x7ff, 0x5, 0x2, 0x9}}]}, {0x5a, 0x6, "b2b88dc2a44704087a04e0b5e6f1ef3f60efb52031bb6561bcb2372d41b7690500bb1c5a2ba15d6ac2f48afacab83ea2937db9a85da9b98f78398b6f540482976e7d7058edf8ce3e8aa9daba0d117d5121acf9799d1e"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}]}]}}, @filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x267c, 0x2, [@TCA_TCINDEX_CLASSID={0x8, 0x5, {0x5, 0x8}}, @TCA_TCINDEX_HASH={0x8, 0x1, 0xc95e}, @TCA_TCINDEX_FALL_THROUGH={0x8, 0x4, 0x1}, @TCA_TCINDEX_HASH={0x8, 0x1, 0xd127}, @TCA_TCINDEX_ACT={0x498, 0x7, [@m_skbedit={0x80, 0x11, 0x0, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x14, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x40}]}, {0x41, 0x6, "3c8b9517fba50cbf410d1468088f9bef28db0b2afa6fa9eba791842ac91529de579031fddf1a075f43373a73629440d785f5ebf8e67c4d7b1c3d1eb9e5"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x4}}}}, @m_vlan={0xe8, 0xd, 0x0, 0x0, {{0x9, 0x1, 'vlan\x00'}, {0x38, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xf0f}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x9a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x37c}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x2, 0x68, 0x5, 0x4, 0xb6}, 0x3}}]}, {0x86, 0x6, "33b9eb2353648ed067e669cabb8d7cefe339e02625a1327fef74fcd93ae54231ce35e812e9af01533978f96734eb19b732618871376bfaa79a4860e90d12f6c3cc0739b062ff585cbace91a563af5e07580540c84f5619548d5545972c3c49cf016a8689827d7a06707ca0e73282ea1dcfed3857e0907afab44ecd93894217abe2f9"}, {0xc}, {0xc, 0x8, {0x2, 0x1b1eb88a1d10f340}}}}, @m_bpf={0x140, 0x13, 0x0, 0x0, {{0x8, 0x1, 'bpf\x00'}, {0x28, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x9}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x6}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{0x100, 0x81, 0x27, 0x3}, {0x3, 0x30, 0x4, 0x1}]}]}, {0xf3, 0x6, "30bb0014e66ee80abcbebd091388d2267b596dac39422d8ae07294b0cc1180515d002b1e1d40e11164d005a44fc473be0156fc854b1119f5d475b4c87bf8722e75ae119a3a4061dbf527a3a7fef53f79dd429f65a1f0f8bbe6d9ef42b9a2dc71061e86919a55539d21082a37bff2f384c6e59b16cfe869a4396a78d56518652b9642bf871ad985308222abc528fae7a701cc380c7fdf18e3bd6899a7dcdfd9c7bd56689e7edc87ab4251b6645ec664085017a65dae8539520ce0b3feff186145d6b175fb2b1d38ebbe2b0cc8e614f30bed7c60d7aa001a7a9dd0190bbcaa186cad229b3b06243abb39c800e4102a6f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_sample={0xcc, 0x16, 0x0, 0x0, {{0xb, 0x1, 'sample\x00'}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x6}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x2}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x5}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x6}]}, {0x80, 0x6, "76c15c22fca4c630d694efee7703200e2a9df70d70a0191925f9658b8acbc2a38a7b9b470a4e2b4fdb9895f8001441b91b9cdadd27b16b1f13fc73d254dfc926f6b32c65ae16903cc716b3226c1082ea5aa0580e6a9e8fb35f696b33b3f31c668e55b0b56886a2e4c350b7e677cc046b6ea948dcb61f6cd39c687715"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_tunnel_key={0x5c, 0xc, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x18, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @local}]}, {0x17, 0x6, "d71679a53df85ee3e1f4a1a24efb80043ca586"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}, @m_gact={0xc4, 0x1e, 0x0, 0x0, {{0x9, 0x1, 'gact\x00'}, {0x88, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x800, 0xffffffffffffffff, 0x1, 0x1}}, @TCA_GACT_PARMS={0x18, 0x2, {0x284, 0x5, 0x1, 0xf43b, 0x7fffffff}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0xcb1, 0x10000000}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0xc5a, 0x1}}, @TCA_GACT_PARMS={0x18, 0x2, {0x5, 0x2, 0x5, 0x0, 0x4ad}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x159a, 0x4}}, @TCA_GACT_PARMS={0x18, 0x2, {0xff, 0x0, 0x20000000, 0x3, 0xfffffffa}}]}, {0x12, 0x6, "9a95c5a57c238850bc0126b1e7a9"}, {0xc, 0x7, {0xa7c3761e05d8fac5, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_TCINDEX_HASH={0x8, 0x1, 0xb1f6}, @TCA_TCINDEX_ACT={0x21b8, 0x7, [@m_xt={0x10d8, 0x1a, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0xb0, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xac, 0x6, {0x8001, 'filter\x00', 0x3, 0x2, "07ed76a476d8e1056c733f6f814db50dd8db89f5ebbdfa7ec06843d20b8fa8392bca0473d0e2dfe85de511247aa40e1a161caf239d7efc00cc3870d3d82a2589f05bad457d3245eefb4a4c9740e990e69dcc69914ec912715c07f389cebb5d2b4a3c1f5098ced841e99249b81a77474ffe860a06dec022d16c4e3664fa1d8dd1bb7a"}}]}, {0x1004, 0x6, "972242bcda6913a6c8d6be64520538bb0a6e6b1af8351a1b20f564d222095eb27839247905e68fbc03b01e8c403c5a13a0b36e02177a93a7556c977090dadf35701958dd21fa316f5b0675b2d9f49a10912a47ce84ae975b759ba221f1e46b21f7f609399dca9b2b896f6e5111b64632efe2449ea3f1c8e6849dbf629b01566c5140e19e5c1a66e8e21846c4d46109a818c55b90078e85300ed2f6510fabc67326a6d4198cabffef7012cdaccd705d059d2c3e02294a374157eb6e0005dcd537c1e27ea191ce86ca3811c67ec158ae2a5c287b28c5643112279e98bab81de3863b717ff3ec5fde576b79651dad08832f632d1834e669cfb022aec875d96115838db3e19b1b7b038bb33ad53797d76740cbfe4d8b1d8dcb296915726e6438fc1dc495f5017547dc6793e0a307c4a7e176b3d65b7b120066cad82048745d47686fe26e65a7289952656752691ffdaa4a500b0ee0c67df56f28649962c7be3050f2ec705b66347d627d3d5d630b2695f306b7bd9c865c251b582daf2155fb6fed73fe0d366e7a64cf687989bff0faf4bb50585bc57358b650f4c9f13586e3e9edca8ed6b9f5c25da304ac7bd73181624120505461aca63a470f82f97a4ac54ca430f510834d559a039e8e4e3a7e4299179c7321453a2499bcfc6faeeaa8832dcbee9ade7531369d40bb07135c9238798527584700282c172ae2cb3c5b44060aee9554ded2264ffc857fd4bf2dc475a699865765de06240cd7b1d1316c1a269321b4d70ce7dd72bb5934bbb8de84e0c13ff0a79251532dc084fcb82cae7c48ad392a2fcd4da3ca118670d0b7e06a46c9959ed3dc8cf378e4142a4b6808814265a3e2724ecbba30909c38ff22fdb5cdf6ec5a60578a549b4e988272a12f861584476b3fdc37a26dece21f084b3c629255828d276d0f4ee80d0c24d510f950cbd9292c69b138e76e8a25abfb3fa40f7b7dfa7ff5d6a53da359b919a04f9cc816ed843917598dfe774265d07ef04a8b000b7e931339af263f1d80873c4db1d67f980568dd54c0a2558a819e15b673be098dd6e4b4f66f7dc0bccd4e8dfe646c3effedaccd2d618dd32b079bf598e929b563108bc292e1fc71863edd6a42bf32a04ade5a68d5076fd4abd60fc398af2d72d4be7edc5335ac42a3cd81d3537397a2c3477b6126853eb20b17ef751d4a5b85ccdd9d584702330d9ac2a91f992cb9cb5b4d2352b577a76f7c6fc86420a09f59aaa56ee0bfd9e948fbba064d719162edca14b0f05559ff9b78b62b6316a9f42df6fbfb429b5749a3d3b6bb3f51c099a9fac564fc8d1438e83b7274763e2ff7fb1629353a4a77b5dddeb38a455e07633fcb6fe6ef503dd9ba06d6f776045ac25e0af33bf7b3e0ea24939a937fa04545fbee7f7da14aa7298b0e86f911fc3eabca3be95ec4a3c81858a67e4b904a3c56a8f75865bb6deb31db63c07ac96430e6cf80203d002fd908c81a3b89946fe2ae755a94059c46e036967425cc2ba4c102ccb7e7517cae102b0990a746bead40325b3ec3585d52856b4a825ed49430e6ab1128eaa0c3624fb256ddeee32cd16250667361327c2a6e5230931996694c5da25f65e2a48930bb9cb3462d41f9d13bc6327b5e7d7bc79d4ba4a13075be2cf671232dbabb4342a986c01f756e581193f2a267212bc98f3f225b2a44877220bc07623f98984188818c1cfc65bedc7fc0725c9ef89b830504a7467916b2ac4313d55a2b26d03d7aa5d82853894999a68a6f47a67633172e564dd606b2a2debb02d79a7d7ba7eab199903798335b0a0a4c0985f467520ffc8a37a37e52798a3559b7d4a2774d3b60aa8f8b947c60c9652d46d453b937978e2e514a2eebb979defbe3b9f4eea83f4b6d1f5416fc611add7b409bd220c4a63c5066b68a2fbcfc326c49c03123774fcccf452718d1ecd3f99c24abfed4b8ce25ef23de5d78e47b15fb18b476fe24c45d27dfd86e7183d9297ffeec3dbf4a7a91a090478a56f0d9a8ffae9bf0fa3bd1b074dfef712304c931c499346aa91ce2c8805c92d70feb8ca26d18be80047a73cbc34cbc1dd363209fd98863af63eb4eb830f0098cc5cadf7c1e191c020dd85b5cef4da3017f63243ea5019f6edb1726977a4151de7fec60429ab86643a1b8ce6f78f9208dc1f2f49f54acd15fe27834ffe981cba90ca99939024820ae29a29d86b26715560897d8919898834488669e783a6595628bf36524288c51c88fb0eb777952e4e5c16a59bf24f7d139718ff2e775f82dda100d5d5888467b8430e4676e54a90c34d5c007388814411897dfe43afdaba9e8929a5103df6ba4cb3cd5e7a82db73e19e60d545ec47173497c9a6aa493bd53fe3b9d289a2b4cb5d48f3bf98bbda921efd0149e1adb5aec5e49578d561bbe624e46b734afddd5c11f0b6d7e317bd63981ba3bbdeff3d38b20b281a5e11df4e0d5b33cb07e4139ed4554ed1b0955e43636cdbf9b1a4351957b7f889ff8a893efd3763d901aafc82e5a291e5acf1d3a60c64dd7fdf4343d1f886f6b480e91d32364143413b0a7b7ec6af82301b68b067e3168e9285aac5ee7184aaca8a22ef9e12b09b5daeb67f3c3a914c5e0435163b91fac249aef947032c7fba7df41c450599788a0265b96be744de05c418b77ac9160351a18aa620d3ae3d740e1f2a6f8275eae60f660f05db6b866d2408fc9884026495c007f4ab4bf5e02d36415f978e529d260eb50417e6561f1bce6d7c3e8d4505f557aa3dbc61ed69935784af1733351accc470a649c8c10d599235d9c43d7333b19b1d1d388d496d7d9926d555934b2653651b808a84a8a4476deccc0f66351598d65307c2e77ad90ce7ebb9a9c6e8d27a7689ac8de428fb6503813d8980412d73f6f54b4e433d8770ce7da2bb01270b2da7a6b0cf3bd2403e2360b5b4ef1f6c835d4ec380a674f5646dc31a6959243fb47664773c860f4f0a60997efd1fa608f2df37fec06619fc13a5d5a84a342380b0c6735a7fbb4d47fca16573ae5dd1b897c3f7b07681e57c5155b2b0d43569e0acf531bf282bc638574c79459bb4f2ff586f28ff973a13e1f044b7af55feacc1aae80290b9b7c4f0fee4add68dd5da7942c1f104712b7d7f1e4a35bd0f1c2e45ebdad03e9574b4fbb00a4ccf3fda80912b305d01ea5b424efbad32008462b69ce8c1c913d7854116cbf81bf2593721abfb99515297bf1c725af1b728914f49eef8127917c320306e989593b65bb8c3ea2c5c143f5b53d8ce644a754d23ae64bca0cee4c2a75043e45f53e62b16432cdac6fca6d3e98146fa5a8c354ff3b23a53379b31626254fbb3c71503115ddcb60029661a9990944e07d909eb12adea4719e1f48a3471b618bbd1b0a7b95e56a901009009c72c784233fc7d8a82b5d4af24f9d2ce732f3d3177bc6cbe7318b74be8733290079da9a070f2d16f58d3be758e4d0725982bd1db50400489dddae7e96f1b49e14993e6278f6ee2f0f2ec174e547ba88b5cebb60983332701b086152f8fe77670f11233a228f9cf34bc51b5b56690814f52dd45e1af62f499da9496d75c5ce0b6745fcd657e4d0d57b380bbc457aaa09d6938fdce2830b86df5a5d6454f3692502589a099c3c61d34aaf990d390be9d025e082c512250aa24497a96e21647bddc2d4ff0cdb18d76393bce5169703fd27d215892259e68374834b628d7d3299a930459dd2df89bb2deace836af3076b312988dc98fb31b5a477492ff17cb00e73fc877bf4d897a5f6352ba7551c6a8a740d902feb870576d333f61d541228248964f19a43295e58f8727cc4cf7005ed7b9dc9dace8aad19c405c7889c7686d8505f60e35cdef0615bcd4020e68aa358e9460f4d12e2420d456af50cddfe618736901eed1325ad8f5d7d5f5eff5dc752925a91cd87bf9756314d06144b51dd5c970e69ce137d1f42aa3efc9415872346f71702c14be5452fae3d5895b2517199bb51e94b67cec7276757d01c42c211a16c0f59a3e9c49de12ec74857a21fec10b9eecb94a6b4ccf92aab8ac3133cae810c1a3a2910789b9a9789272e00d6519813514e0651470801f5fe973f017cff5a2b256248a4bc69e3f792a65bc20cb9c9af27dec5697f3fd80a76b1307abb899f5a9e728bb939ced608a89a5d74028b34f8b3a5a49f912fc8cad36f1ac2888cdb3ab08a4055809bae890d4f4724d207679715a60dbb4c1b4ccaefe46bf93b95ce7b977bc16f1afafadcf0b2abb0f794a4f55c0d937052aa1bb670c73ffe2c9b8d6e6984f1048fec79768f09d31c8790f1520c342cd597edad4cbe88ed6d2f224fb519cb8784177e67e088ec7b2b063cc15a9155653a42d3743fddffcd7bf90bfa4f8a0d49e39b00374370b92314403979b17d3393c67961902cf3e3a4ae0c270106e6c329af9de31696d4f4f738d90bb9e852171080f5497015cf94e4737a815b6fa7e12be9d5538fe0505cfb94f4e6245c83c06be4e11d3d2ea62cb394cef589ee8fa9a3d88e89e11ca1202052df3766612f9d7e67d2113169c48eb1f577ffb3070d3dc7fd8514a44b1636fd97f521350b7f4e5d20df3bc9995891ba3b2c3d38901ff13e08ec02bfc3141fd6e8a94909cb02136f9a07bff030089708c71a8108b1858cf91b76c97d4fac8d1c52265025f25f03c81b62e7e4ebf253d84422740c8e1be703b782b0b2b313462463f30772af15fd28667479d93421a8d306ce5f26076ade68487d5018de34e9dcccdc80418a6e77206f902a5eb5a2ceb880dc93ccd3434bba535dd092dd33082ef68b68be0f6fb4d6a7cfe08e549368097f5c1f02d1eb1363f5c524f8ad6d654735e5143cac58f248f9b0fcbbe6b16d9ebea5965233b627aa3081c34b0576feced281deaf77ba245058a488b48ca765335c006043819b58aef7026ca9ba90f28e874610130556148e0f05870aa3e355377997504c5b6ec7f2198ac2335c3fb354c7f4f5ec606fe45bbe48c40c36744599917149a3a83d8ecca968ddc798ca660b0b534f79bc57292b8a4b3e9350bfc750a4de028bd57ca05848b71171f23b3a78aa4b890c213429a24fd2ce7ba2987f4060f9c2830a2ad76d42606f56cae7cc58ca9a72548215fe4fbaf2980689a673e809676aefaa0f607caf5c09a0eebe76eb4011cde5d8086f2051410a1c516620755d18db1dd8dbf639ee2536c016410f930fbc1e799426514ea6c93a63d5ad3be14040e064c6b9a2d6e3fae8402b9fd581dff81f47d0674aed239112ef3fe81aacdbf982e5953ae3d3ee3cbb1e88809f9e0c68ba499699acd9a3417281794f75660908a27fbae682fe636295675b00dfea2c60bbacd01cd9abd436c7f0d988f24722bd7de47b0a13bcea4729e1ae56959779c9d8abd345bcf69eba9a478c267b5b830a065787fa1e26b19ff08aa986bc5f45c6140e0a23d9c1388480aac984f575a4e7841a2b1373318e51919190c16e68eaa9038d861d99717402519f5e61f093734ca324d90f0f19c5846fe8b316c3c50f5a8d5d4eaed77bdf9741f5924296ba0db41d5c01bf0b26a201f3be2f988b8468658a8a33d6035cae67ff6be1be1515626ee226e3728f99cbf6e11997be8a07bdc1826ad23dda12660e599ee2f958555e72c5f28a1b219e4af323f0224716103843b892544a118ba2ceca10b2f18a1efb2c6b8b34a9fca29fc73920efde96aa4c1d444fd8ad2f7caf601e7b19c89f9d90c2b3ef63f7c6092d9782cc67d856c5c8016cf59e9f5a6c6172fbb688138af297d90c5a462bf4b4f80a6355d87eb503a2931e0cae9c882e2c38aa93"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_xt={0x10dc, 0x14, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0x1080, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x4}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_TARG={0x102a, 0x6, {0x3, 'mangle\x00', 0x4, 0x4, "2ae994b50b4346bd1dbdc953ad17e0afd5c3653ce2c24a8b63fc6ac00ba6936f28b12d7932ba8a6f70ae475c58e598672c589dfbf93c73df5510755643bc74291361906e4b83ffb1d98ee151c1859ada19a5ffb285f8a26bd92b0fce2abfd7eb2c810a087b83137697a0491bee4a7e96af098356aee4ea9b3f87c1b4818431be4be70130827348a81c91843727b1975a5123a2f3f30597f56b8cdda44de5be0b4513d8f3309aec91c1a005934ceaea96b243e38c567deb2a13eb9164dcc4fb79e87e4fee9dcd5979a3340c1e9b6cd4c9b2de20f0870b89fe74995610e620f106ed1b4e599a29ec39548ec14764daac2eb81fef86b3b03fa4b29bd1b725435e2889b1ec53055bf0ad8a020c56c417c29481b76fb24f7cb7480ebd1c2b43418a2d52fa9c744bfb88cefa4cb08183d0b5eefc8600db51ad9921b0664189f312f34d8588595d0620df74d213400de2c824dab39e956671a83267b045709f66d6e808bd408972411ec3994df3c2ce58327d996d975448e28dea21d03683437444a8f15ba1939f784c2fdebf30aa08cb92bc7577de3b4c410d1617732d4376c146acc3c5dd584cf095a45f2f8c7bbc3bf731dc5094eb8522ac494daf3db9ce33ea7aac49a1a6da5260ab82acdf5269baa18dfce5dd1cee49092ecb7459bd1fa88d03aed50c254ce43b039462ca71d5c6e9c38424f9c9eae2c85524e4e7fbc1059ad04241289cc19da7fc3a5c8e844e90e2adf8fb6d3bfdc237d5440b5209e2b2c4f0f5e22c82839c92570913f827e1993f284ef3b2759faee55f8ce6bbf32be8ec75c7d35f60efe270e08a29e4960e4334188a0ec51983c0621950f1686aefe5cd464fc34853a0a9b8654f247a981eb74786bdcb227c6b348baa2795b8b4cd74eca1a64a9a1186026dfc5ad01793db280cabd44af99c8ddbeb2b84ee3486eec43fbccfd6074c87d041bfefa6547e04fb5b21c669c48fdd4492007e8a3e5aa57c13e25e5e5b9c67083623e1eef858a818b28129b5cdf854bf3dfbeb096d94d4eeec60d8e3e70e9f6192b24b5cf990e4d13fe855d1780018517c306f203f6fbeba84f50898fdecfa84cf5a17c4ea7b48abef30838525b4f23f88d10f25edf361138b5c95764a5cd8ca1cb078781770a44e868da3d4021d098e2590cca269090d028a461569420c10c89b1fb31aa8025705941a2de7c3e614a021159325fa9cbc52a25ca13bfb181edfb00fa452febf2f06a762c80732faa21c6101730d41a6dc604274d8b86896c867bc59a5734639389e2ada9d2c4a7662349c8eadc011a186ee1c5a305da357a3aeba5ffe982e4168b6e9196f6e6b6ebe2f02a8703517f4e5dbe464de06f336d0fc082b4d714d0cb2d7faad50f5b2a37ff4f257f317713bccecc1a3ddcb496c70a1ee1cba1bb4755f67aa61d7b71f3350ad77a92578a06f522b7d03ad3229c5f0adf5db60fb9bfbaab6ec60469c84830fa6cd1c09547eb8af33259c7a242cff0752ea0b7def7857ae02a08842739339a5e2f9e725d236361932523463aff94f024492b9f296133ecff7c50f6a0f322ceed91ebf049b166908f2d6d75c55848584bb9d5b7122aa492c9eff9b580f77f8db55b4f51af65be071f4f79c44f489b69635746a146c3522401c8890688a2d0745adc6493f606771212414f2aefd8d3a58d31427b7915720e5bb07a669f577271705c80a5166031e2636fd38dcb8c10b18769552cdeacd35ab2c61a13000835e6b5ba62fc106251b819e79a0f7ea0738a6ecf14d280baa4d64d99896eed668d7485bcc730aeea2a23a9e237a38de03a703916c674f79f7a46bae4c446c72c1070a82ae73659e554177be984bbea139eb8b45caaf0a01ac27d161b44f51471c81be444ed615eb834d459a62796c2981329b379445441e621b07591aa705dcaf11a07e7502da3105d2f954edcda768fb2cb1be333584ee175e15f723595d810a76c50c8cac815e150c5cb8fb9511a36c50c3f7062d6e3167002ff7819a7147119345bcc6400d7e754324ca629df9aa963ed0e0cd7a63e763bf76b63e41da72e4a1da7ae8a84db22e13728818a9e2640e9606c8146c5d50263224cd99c53f0fb264287977095f0f91aa95eda1395999974bc527b44ca2073f5dbaac7817cd4261696c427b9f0e39ad313b8134c9f3912e0b8602bbcb0b392f0b5823b893e8a44dc2d7063adc9c666ddd804f132a4b5fa8910413aefbe5b3ab0719716be8417144b9e07e9dbec67c3d79139205911a9bb48d22ad6008f1c961e3b5f0fc39308c5dd1e013e1babee48eb546855cc8d92fa2a0bf965ad5fd762db088e6b4336a2ceb0bd37fdb3c8903a7c6923b939d7e898111c9b0170a9cf9b6c30efc403d08a5dd1132bcdf2bffa4678033812ce54a6a9614d8d876b8d621bd443aead9cdac2bd78517efa0d1157a516bb14d8e9b975ef7685c78d559caf8fb5ab2722370b85a5deaecbbbd2f63b93197261b6addb9c9c5499a9de48c759431d1c61e7d09c487a1dcf98c71f3ac0a796181ce9f27145a7db93d81693230655a93ec42279dbf6ab946114e0d0d320f575641555c954caab065396c5807c76a9c180ae1f1442bcebe13edab4270010bce2da6921263d348a9eaa6d2ccc5c971c9a253ab28f3688273fce8ef206bf7936b9b82d86a3518343361634c7b3133b589f96492cac83a9a36ad236d0ac07452b7a46e213173d4a41776509e2ee53e362a7827468ae5e59b0a3f5617862cf51f47fc5e7176ad678ad87849c701234a62bf6fda4d2832c2fa7c37924eda50eadcf3b69927b88135a85889434b2524c02dd96663d4a7eb1ca1d4bd74e92457b8e0045812ad08351425aa20e1f2e82b60cbba608fa8b6db25cb5d0a0660ddf10aebd8569c29bb76b45bc671bdc606d4db10c9f018c0107999f8fc5833252ab7e45f79cd1b04eb0a02cd01c00e26ba6b5d58417c24da1b9ca4ff0fd9dfb176b81658153206ab1b4bddc21a843ba1f7e578416889d91faae0a635b2162d2171daff77a2042387741b85968ef9ffa4ba2ca5279ec4bf3a6c53d965f70b679d281798a193094877bd1527e32c3ac0d169ef731f5ad116d90a72e5195df7f5ee5cf4627cb03d0b2dd8a4819a282cedb62077f55602fcec5baba739c45bb88b2b81c008d81706f436150261659a3bcded23d7c6178c7c9d4e5b22ad20b32c081e88af2768f36ba2f67225759db39e6d8cf3c0516fa4125553ea11daf137dcdcc01ee8d0c74cede1bb8e0046bbe035e27c18b413c730124076f668a28be0de615d981b4e2c7b7a3da75ba7d7916058d0097ff4afe0b92b3f3e75a4645fb7ed7bcc551e258ef068978eb8d4656a48a976c33dec4d482adb5083b5dfd27e9f1310ac95a4eff1a3ea577846be3b23eeef979753a240590a8f474b2433863edca0480db1ec3bfc7de01a1ccfb8fe8acb3078bfa5ef8235ba9deb39bbe8e4e6f619e603426afa424c0164283ddebb8e0403c9c1b425652b1f03e933204027f596111b0d22170b61f284d55790c3dc6d25bf04065cb57592d27c99befe509d9812bda8d8ad972a7ebcfb9ecec12fc6c59604ca3604c6e552e11bb12cdc58c080dd09b6f3b8e9e0986b0284cb00519bb36a80a4dee4684a9037263a0aee50fbc2f37283bdcd0390077ec93af8f72b11fb142429868259492792de4fe4927749ac4ed542f56038d5b338ccd948748ac90e7f99df64f8b5e9dfef7f114e6adda0c3744e0a54b548d7259fc6050cfa693b99f05cda168170b4b8e2bbaa67f2dfb7377b2215c14e3801b92626943356260187feebc603780f457c79a1bb35b874b70e63aae2ee78bc489767c049068499abfe6a32bbdde8baac63cb26200e09e3136da431243a9cb39d0830428a5e4fa5d6b5ef96b5d639c73faa25b1bf41ab6a29d3788d5c2c1ef556099b1bf356d42633c9d3d38f11c820b78550d2d5a941a74824bc8cf2262b66439590ec4889d15ef2e8adcac0d76bae3fe394585d2f733a16f76bf5ac259eec4162962c5c500c4fb695fdc060a794941b1d831b17961ba54bc5271d43b135aac13c9235d5c2090815fd4abc6136b6b1a779c68d20c3594e7c01eb5c59fd4dc97d35ccd13b9f4eb09980f857cb2308c8100738e03cfb759df51c7751ba7332d09d2f331f62060fc97118904b2c95b6fe19bae5666509d8ba86b9747ab81c219d9e35e51130730a1ede00b8d96d1fdac5047273b744fee657174b127adf5081d7ac4f4d229f67cd4406025d3cc978dddc0ca797778eae92d5e3b35637a367c374c4bd8a3fcd8ffaa9f4f404f14d021ca02a11a68755af3fb80d2ae3b9d6d17cc3620486b4fb1288fd354c28864ea64c91926298791f68caf95389fac9d8e2ef7710316869b0eef34fa83cb670fc08da147f13de2feb5ba1a9e8c853a6990d3fbf13d71822ead9c5e26ae2c9f15448781bfca3584461b21bca88f30601af1a1f964a137c4a592115f402e6818f3a3e669759b45c07db29f04a738cf37c15982699cf8ed072d9342686980a40a0d83ccc7bf8300e8304f57d5976bfedd2408ccd8cb15287beaed994a2c9055254dfb1d20b7d8db4f65f9b51aae1534fc22e2268b1eaa43878c43e6821f008a8ed9161c1358f8e0bf88a9147847b812473fe17b1de9633cd2babe4d5945de29f1c3a1c7608f13d5f45758603b2b7579fe6dfc5be643891d1ef8dda48ebb7775c9e97be8c29262e2ba7c305f59b6ada7e4dc1ea5ae99ac2a523d86f0ea1ae421fb09f11a92e2136e328ab5b581c2220c9139d1bfd311d1a2ed286bf82d473bc9be2b8612df64463aaeecc2c800e06276ebc1880afbbb18c8fa0ce33100db335bdc6d81bc95f7ade6bda7acc5b2cec6edc2eb4d92ba7faefe0b858e779a6df704d5323a92d41b753aae709f4d9724bc02884510ee68eb88b65e4450efe9356c07c4f09f63e740678e0a782082810a3b561ac512c7a4f40495ef096ae4cea2bdaab1be536eb78b92284747339dc5e3d685a6260c4315e65c3ae6efe995bb89c0bcd5108b515cb997b9a3335839f5b4dd25c57395bba153ed64e8fb97fa4e2b26f310c06ba8bc3d6ab4916ee73316036c9f23cef189539797450ca0f9049fc9ec81647c59ec76791313933d26a44f1540479c31762856eebab76b1b7a6054c1127111715b9bc2742c4a18481c5778ffe567572b4352490fbcb18a6005429b55b2eaebc636412411d4a06af09992c6496adfe95a8c792d991e3481bc96d1b0368a2ded9368fedaabbd81ecb14f991616f3317e66063694019d07595c0ced6445415b27cccca29e33110cfc79761d886865cc22b69288d888782c339c998fc2af625449cebb7c4d3049c503a1987f8bf771f57c0b30cd0ba0789955da99abf74687e08339f2c3f298e7446b2647cf3d1788ade0dddd541c71d203a480cc9266861a0263c080b6637a2f3cdae2b0a2a863502325f2f6e6c75670f240d5556952269deb6839db04e25c8856ddb5c5614c47dc33b155f777d5d9a5f5de518a7fea2d4f421b4df8e6b77ab4af1eb37bb58bda4b10df1ddd31ef4b913b32f5ec9b02e075bf40c30415e4bbe2673dbabf6f0948fda7c6fa7bd4eac03c36dde1e173adba7b65d9ea752f6b30f740bf477218a3e2432b67cf434c00bc5eaaaa58b96cd041d0b16d0488e5aada3c4be42c240dddd6cc3d2cafc7b85db6fc0b19efaa86e8cbc44239b4733880767f35d3d0624c4e998d253f975165fbec3e555a821922ed830c4727b6ae04e880db1709e52820c0b3490025a4186bbf8b4f3588cc162104992"}}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}]}, {0x38, 0x6, "dac91dc24c7869835ba78101e3645c77f55660e01d17961ae62598ec84974631b4d28bc3411647ce0fb3e976f46c75b80fb1d04a"}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}]}]}}]}, 0x6988}, 0x1, 0x0, 0x0, 0x1}, 0x20028000) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x0) 05:02:32 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) [ 185.222732] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 185.261416] ubi0: attaching mtd0 [ 185.265832] ubi0: scanning is finished 05:02:32 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000080)={0x0, @bt={0x800, 0x45ff, 0x1, 0x3, 0x73, 0x1, 0x1, 0x8000, 0x0, 0x4, 0x80000001, 0x7, 0x80000001, 0xfffffffa, 0x10, 0x2, {0xfffffffe, 0x3}, 0x5, 0x40}}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 185.324234] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2564 sclass=netlink_route_socket pid=9978 comm=syz-executor.5 05:02:32 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000080)) lsetxattr$trusted_overlay_redirect(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x1) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000080), 0x4) 05:02:32 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 185.366231] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 185.381080] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 185.404466] ubi0: attaching mtd0 [ 185.410286] ubi0: scanning is finished 05:02:32 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) ioctl$KVM_S390_UCAS_MAP(0xffffffffffffffff, 0x4018ae50, &(0x7f0000000080)={0x5, 0x7, 0x8000000000000000}) [ 185.443729] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2564 sclass=netlink_route_socket pid=9998 comm=syz-executor.5 [ 185.469944] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 05:02:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r3, 0x40044103, &(0x7f0000000000)=0xfff) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1ce2b169a1b3f39d0b48ab588347316d28c76021e60dce246b69ec0884baf0ed99e996a65520431091a5d2ca033792544d5fd0ef625f38302d566044d13bfceb54376d7537a1d12466d5eeae2d492d3206a51d5093f6e04387f89d282f2958e8688a873cae58f2190b3d5f376d546676d1469c1ba806b59561d30d5f35ed8218dd", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r5, @ANYBLOB], 0x1c}}, 0x0) [ 185.536686] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 185.557243] ubi0: attaching mtd0 05:02:32 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) [ 185.589776] ubi0: scanning is finished 05:02:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)={0x3c, r1, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffb033}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x10}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0xc1) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000240)) 05:02:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="01005026c3067c1d869d741e5b4028ffd9f70e40e42a0607a9e2c4f2cb97f57584914d1165ff8a65c5da07a2abdea7e0065aad8dd50fb3c48f185dedf5587a3a3d5b7407c01eaf3a20cf904d2ce1f6e32498a020c124eb01b2665a2ec25cc409cc4e74bffaedbb3a50f1bb8fe3cad54892f6794a04d023ab2432a7353d1955b22a78", @ANYRES16=r1, @ANYBLOB="b723000000000000007a1226220008100303b72b65dc14abe1ee02e4eb10541b0e975a186573a72048891d3975de537d05c71777a50528f779d77916f9538b9171609ca0c1ada7b6b7b6752cd31a051afc39", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r5, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}}, 0x0) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={r8, @remote, @remote}, 0xc) setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000240)="1911cc90c2dae354ec38711e254b62327f211119084b768644efe4af826e1395a56cc27b45d44659c34760d4f008c97ed25adf5040870871e07aec9b7fadbf285feab8eb12531e5da84efc6257bebe27d2553123d155e50f32ec756dd8e4a59e8f41b58a31a1ba81519aa9a3a1da096e738d4399ae723cca8b4964af12a8299eb1975d88595f71b6ad87d66e1477b8814a0a3e28fccbf6d3042a6d086882f13b75face988dea2e526cdebcf241cce6c9f7952de6a703", 0xb6) [ 185.784477] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 185.796291] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 185.817940] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 185.838150] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 185.851513] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 185.859943] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 185.866279] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 185.877929] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:33 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 185.892041] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 185.903705] ubi0: background thread "ubi_bgt0d" started, PID 10032 [ 185.911311] ubi0: detaching mtd0 [ 185.921423] ubi0: mtd0 is detached [ 185.927341] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 185.931394] ubi0: attaching mtd0 [ 185.985529] ubi0: scanning is finished 05:02:33 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) [ 186.122255] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 186.136096] ubi0: attaching mtd0 [ 186.191638] ubi0: scanning is finished 05:02:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r6, @ANYRESOCT, @ANYRESHEX, @ANYRES64=r1], 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000640)=ANY=[@ANYBLOB="50060000", @ANYRES16=0x0, @ANYBLOB="00022dbd7000fedbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="400002803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="780102803c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000300000044000100240001006270665f686173685f66756e6300000000000000000000000000000a00000000050003000b00000014000400e25c08af02000000ffff08209dea000044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b000000140004003f0004060500000004008651080000003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000b00040072616e646f6d00003c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000008000100", @ANYRES32=0x0, @ANYBLOB="3c00028038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000010000008000100", @ANYRES32=0x0, @ANYBLOB="2802028038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400020000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000050003000300000008000400008000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="54000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000002400040001000109939a00000010c320ff0f000006001f070900000002000334800000003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000b00040072616e646f6d000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000a00000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000200000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000e00040062726f61646361737400000008000100", @ANYRES32=0x0, @ANYBLOB="b401028040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040021a90000080007000000000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e63650038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400f635000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400b0000000080007000000000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b00000008000400ff07000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c000000000000000000000005000300030000000800040009000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="3c00028038000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000005000300030000000800040001800000"], 0x650}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r7, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x0) 05:02:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f0000000300)={'filter\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}]}, 0x98) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r5) getsockopt$sock_int(r5, 0x1, 0x10, &(0x7f0000000000), &(0x7f0000000080)=0x4) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b7000008000300"/18, @ANYRES32=r6, @ANYBLOB], 0x1c}}, 0x0) 05:02:33 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 186.304225] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 186.323311] ubi0: attaching mtd0 [ 186.394888] ubi0: scanning is finished 05:02:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000140)) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r6) r7 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000002c0)={0xb, 0x77, 0x2, 0x8968}, 0xb) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r6, 0x84, 0x76, &(0x7f0000000440)={r8}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000240)={r8, 0x9d4, 0x2, [0x1, 0xffff]}, 0xc) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffeb6, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r2, 0x400, 0x70bd29, 0x0, {0xa}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 05:02:33 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 186.506570] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 186.532785] ubi0: attaching mtd0 [ 186.584386] ubi0: scanning is finished [ 186.747907] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 186.755240] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 186.771351] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 186.780508] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 186.790837] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 186.800102] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 186.811318] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 186.824205] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 186.841185] ubi0: background thread "ubi_bgt0d" started, PID 10101 05:02:34 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 186.850282] ubi0: detaching mtd0 [ 186.855587] ubi0: mtd0 is detached [ 186.863278] ubi0: attaching mtd0 [ 186.932223] ubi0: scanning is finished 05:02:34 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 187.030504] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 187.053810] ubi0: attaching mtd0 [ 187.120895] ubi0: scanning is finished [ 187.238464] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 187.271608] ubi0: attaching mtd0 05:02:34 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 187.325546] ubi0: scanning is finished 05:02:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') mknod$loop(&(0x7f0000000000)='./file0\x00', 0x80, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x2, 0x7, 0x100000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000006c0)={0x1c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xc}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x40) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) [ 187.458792] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 187.483739] ubi0: attaching mtd0 05:02:34 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 187.532822] ubi0: scanning is finished 05:02:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x202, 0x0) accept$nfc_llcp(r4, &(0x7f0000000240), &(0x7f0000000080)=0x60) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c45687bceb0ec8b1e80d8ed17d6f049b3c0ad51a18033e14f1e79d444945bf2b0dd080cdb4c87c49f1b5ce9f580a0a4fbdc4abd47c7b0f6c9d87af3eb83b39f06578dd8", @ANYRES16=r1, @ANYBLOB="b7230000000000002bb0ae62000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000080)) sendto(r4, &(0x7f00000002c0)="1798e7959f787ff85004c2cd9557d121f5a3f45e0dca2ad4c58da32ae6859449ca29734e94e863e8f67c9f6fb1cd62f9bba34e2652e4e5105a8518331031dc879ea678a911c2786b23f140c05f5855ad93c9521903b567a1de92315d3bf4666d5d5a5328e1791baf3d12c5f87c1313a6e1fd8e523c4981675aea42b0666b3f60cb62846c683624084fb61d05b0827860f0619473743350abec2606fee20fceaac26022fd3cecf05393ff8c", 0xab, 0x0, 0x0, 0x0) [ 187.737919] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 187.761704] ubi0: attaching mtd0 05:02:35 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 187.791457] ubi0: scanning is finished 05:02:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)={0x24, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x356}]}, 0x24}}, 0x0) 05:02:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SG_IO(r5, 0x2285, &(0x7f00000003c0)={0x0, 0xfffffffffffffffb, 0x42, 0x1, @scatter={0x1, 0x0, &(0x7f0000000000)=[{&(0x7f0000000640)=""/4096, 0x1000}]}, &(0x7f0000000240)="d121b0ccbcd042e60f20e20c0c9f46e9d8be044c20164b9d7c0a0a2e76c8de8195f696cb6849df0be50be9ed327547b9bd868bedcae6ae73c20acae76448035f52f0", &(0x7f00000002c0)=""/202, 0x200, 0x10011, 0x2, &(0x7f0000000080)}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 187.934184] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 187.961990] ubi0: attaching mtd0 05:02:35 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 188.008775] ubi0: scanning is finished 05:02:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c063bb540bbec9499befca2e14f17f35836c70a23e4763a6e8f71d991f3c35574dfaa8f3ff7520229040055c23147cada6fcadf58d5d645411937fa30ec72b9367cffd4604ea1d0869ddb96ee0f92555cf6112586880000000000000000000000000068c491", @ANYRES16=r1, @ANYRESHEX=0x0, @ANYRES32=r3, @ANYBLOB="2c78824c4c9446c7a42446f44cfaf3e1cc6dafc5411bddd6abf78d7840647473998e129e1596ae9c2a70cd618723c9b5c974432c9048f4beb591f4b8587b7487447e3c77396f36b379f86eaec220a984355f9e3d87e6138fb5c74b89c88ae4b48d96c0ccd1104b42159252aa1293a50b626123eb31d9907fa834bc056a85587c91b5e844451482d5885375478a1ecfbb0106be54de99fa32d3a5a8bf8f42eae17ab545d9760cd85e8473f3aae52319daca4bbb46b944edf265e155c1"], 0x1c}}, 0x61) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000000c0)={0x100, 0xff, 0x1, 0x0, 0x0, [{{r0}, 0x8001}]}) [ 188.183623] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 188.221382] ubi0: attaching mtd0 05:02:35 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 188.260282] ubi0: scanning is finished 05:02:35 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 188.392684] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 188.423761] ubi0: attaching mtd0 [ 188.476329] ubi0: scanning is finished [ 188.652789] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 188.668633] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 188.681854] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 188.694848] ubi0: VID header offset: 64 (aligned 64), data offset: 128 05:02:36 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 188.702025] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 188.708407] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 188.715802] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 188.725470] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 188.735135] ubi0: background thread "ubi_bgt0d" started, PID 10213 [ 188.741662] ubi0: detaching mtd0 [ 188.765773] ubi0: mtd0 is detached [ 188.769792] ubi0: attaching mtd0 [ 188.817429] ubi0: scanning is finished [ 188.902211] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 188.933150] ubi0: attaching mtd0 05:02:36 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 188.974871] ubi0: scanning is finished [ 189.126773] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 189.148476] ubi0: attaching mtd0 [ 189.171632] ubi0: scanning is finished 05:02:36 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 189.294327] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 189.318359] ubi0: attaching mtd0 05:02:36 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 189.352930] ubi0: scanning is finished [ 189.487069] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 189.499639] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 189.514086] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 189.528553] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 189.543152] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 189.554976] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 189.581052] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:36 executing program 5: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDCTL_DSP_GETBLKSIZE(r3, 0xc0045004, &(0x7f0000000000)) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r6, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x20000010) sendmsg$NLBL_UNLABEL_C_ACCEPT(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, r6, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x26, 0x7, 'system_u:object_r:mount_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'nr0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4010}, 0x20000000) r7 = dup(r5) getsockname$packet(r7, 0x0, 0x0) r8 = epoll_create(0x40) fcntl$F_GET_FILE_RW_HINT(r8, 0x40d, &(0x7f0000000240)) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) accept4$nfc_llcp(r7, 0x0, &(0x7f0000000080), 0x80000) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r4, @ANYBLOB="a1010e2a3d80733d7871af0372cc41f72ef22812f2f578e2389ea32ee2fc3eb947a7130c7c68756802acfbc5ff618f00b51ab599614927d479f298f90d038d5c4fd0d0dd642f6ff475461558373e57d5c496d5ae27cbf76d6e12103c71aaf00f5137afb9698b9928239611cd037df9eba766cfb1484f7ba2cb2336e5a64fe1c5430ac5b5b04e982c6551bbd782ce5b591b0d1af47f221975d7158a3fff25e66e426e66b69e25ee97dbe4be"], 0x1c}}, 0x0) [ 189.613026] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 189.639116] ubi0: background thread "ubi_bgt0d" started, PID 10255 [ 189.645533] ubi0: detaching mtd0 [ 189.658587] ubi0: mtd0 is detached [ 189.662593] ubi0: attaching mtd0 05:02:37 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x20008001) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000000)=0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, &(0x7f0000000280)={0x34, 0x0, &(0x7f0000000240)}) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r1, @ANYRESDEC=r3, @ANYBLOB="b723000008000300e3437da3423bccf019192e3e079c3ef6331917e9cb3db300bc722ad4c54df1ff98bfd637d4ff164f417f2d09f6c7bb9347202866d6c09a52d3372a0f9205f9fcd7982b128d290662ae3be78db45d7d47edb41ad4fa27414400dff7bf5b008007671e1ee19b62145393ebc777a3140b46c5c051e1088e4bcca25281af9c0a6cf3328e2a5b3f0dce60837abd1500dea7984620674008431feefd3d830dda25e3f8026b802d48532899e03490b60458b2a2dde6c382fa22653d7b2bb95fb17cfe70667108498108178384ca7e0d499259227e4ca0f606f8dd17664009334137c6061619e072aa15112d46904c755c5cb4897485d995e1059e04f7b20c1d31b5226c5ebb15d286e1bb66355bad87d672af2e0b1854df6ce81f3599bd9a656c5de4874017040f7d3051957c1710d378c9f310fbcb6755b8a403d7e1218c0ad249f613d395dd26f6a765e5bb322dbf", @ANYRESDEC=r7, @ANYRES32=r5], 0x1c}}, 0x0) [ 189.722782] ubi0: scanning is finished [ 189.865812] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 189.895307] ubi0: attaching mtd0 05:02:37 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 189.931828] ubi0: scanning is finished 05:02:37 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) close(0xffffffffffffffff) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB="000000a4"], &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000080)={r3, 0xf}, &(0x7f0000000240)=0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x101040, 0x0) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="b7232bbd7000fcff0700000000008da211d21bc571cd599fc5ce3b7840cfdfa7c47c98a5017c8dd73904dabca244797f0ed6d0fc034b2981f6bebd8e02333168b5a3ed8f046aeee567f4d9818d777b697bb252550000000000"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x0) [ 190.069332] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 190.098702] ubi0: attaching mtd0 05:02:37 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 190.137973] ubi0: scanning is finished 05:02:37 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 190.234434] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 190.260898] ubi0: attaching mtd0 [ 190.319698] ubi0: scanning is finished [ 190.496558] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 190.509306] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 190.516179] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 190.529122] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 190.541651] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 190.549775] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 190.561033] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 190.572488] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 190.585385] ubi0: background thread "ubi_bgt0d" started, PID 10308 [ 190.593807] ubi0: detaching mtd0 05:02:37 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 190.609025] ubi0: mtd0 is detached [ 190.621369] ubi0: attaching mtd0 [ 190.676696] ubi0: scanning is finished 05:02:38 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 190.801192] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 190.815217] ubi0: attaching mtd0 [ 190.863062] ubi0: scanning is finished 05:02:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x14, r1, 0x10, 0x3, 0x25dfdbfe, {0xa}}, 0x14}}, 0x4000840) [ 190.967802] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 190.994612] ubi0: attaching mtd0 05:02:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700)='nl80211\x00') sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYRES16=r6, @ANYBLOB="96af14a8128c6fefa8f1", @ANYRES64=r6], 0x6}, 0x1, 0x0, 0x0, 0x2004ccd1}, 0x4000810) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r11, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r8, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_DEL_STATION(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x120, r6, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0xe6, 0xac, "5e24f9cebafb8406f3256821cd97dbe97f4a71b091169206a25ed755245b03aa390822579b76c5ff99dbc0865d0b0ab0e68910f4870e947c09e1da7f3fdbae5fe061378cf9ecffed87d68684c6f51a28c0860f309dc0449e16503b4d5c49b1680e496450b42be10ebd7897656bf5ab5c58c7cc7998656b5db0f00bc93fad151c9bef9f9b1604bfa6a92dfa7cdaf334b97ca4369cbe10dbccb77bfb4e6c0c0db804a244a41c0541329c797e2cb566acca571f53eb231f2e4eeacc88c3411a6de73dcb1089c02cc4e065e5770e668548793dd1971eedcef42184e8e9da96aa53875e37"}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xffff, 0xfffff001}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r11}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x1}]}, 0x120}, 0x1, 0x0, 0x0, 0x40010}, 0x10) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:38 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 191.054165] ubi0: scanning is finished [ 191.101710] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 191.148066] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 191.179628] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 05:02:38 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 191.202997] ubi0: attaching mtd0 05:02:38 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000340)={{0x2, 0x1, 0x1, 0x3, 0x9}}) accept$packet(r4, 0x0, &(0x7f00000002c0)) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x24, r5, 0x110, 0x70bd27, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x4}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000081}, 0xc1) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x800000, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000380)={0x4c, r6, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffffffff}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}]}, 0x4c}}, 0x0) [ 191.251218] ubi0: scanning is finished 05:02:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000000140)={{0x3, r4}, 0xffeffffc}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000540)={0x64f1e8bc, 0x3ff, {}, {r4}, 0x3, 0xfffffffffffffb70}) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001680)={0x0, 0x0}, &(0x7f0000000580)=0xffffffffffffff68) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r7}}) syz_mount_image$afs(&(0x7f0000000240)='afs\x00', &(0x7f0000000280)='./file0\x00', 0x1f, 0x4, &(0x7f00000004c0)=[{&(0x7f00000002c0)="d853625eea092d35bf8586a5c50bde5ce068d88d289a26a4e6e41e59ed1f90392f4f009be3a16ba66e6f3cfbaab578994b880ebcf00b38d25023195b633d1064b0c8c324b7bf21e0ee5e3c348838d8fff3d90ff9826139c6ba17233b6c677fb80485ccfc673aeb51ec54de4e5503999221", 0x71, 0x40}, {&(0x7f0000000340)="c17812", 0x3, 0x1000}, {&(0x7f0000000380)="8ec954aa745f410edaf292c9a55395758b0323cb6e7356f4d4dfadc4c5b33e577bd25bce11afb71a1ebecd5c358f6888aec8dd6db53a91753d7f5f5c6e9cccb89eecb546c1e06935ac9f690e7b39ccbaf22758eda597e3a0c2e28b139022fc6638802fe4025b307396f82aa45777ad1f0ae73d6741b11b9627acde264e37f408312491c36c47a18429f994c30c69a9f88c0ffdd19eef524c16c30081b0d6a3abdb96539791ec32f7194ae237cc39be3c80b5eea356a3a39018099ee2234a77e7852a8f852fb87d9d672c7fa052b792af8816e89bc668f0170d0a2adb", 0xdc, 0x1}, {&(0x7f0000000480)="0b76579ceb39f210194aaf687e9582a3b028f9d0ebcc", 0x16, 0x7f}], 0x8402a, &(0x7f00000019c0)=ANY=[@ANYRESOCT=r6, @ANYRESDEC=r5, @ANYBLOB="2c7375626a5005a0cee7e24512055b9900c8fdba4e1d844487dd68bdc65f9a69643de3fc5e1caa7b15406e2b5206fe665a7d3a63567b4932969d75e0a40eb06d5484e64e370b6d25bda12cf25782e88813ba8dbfa32b395ec851607bed4d64b30ad92539a2a7df4809f295298e89e28b9ba051d082b8a63d7b49218de59dedd792a345eee37b58c2241beaa83b9da4190acc27d186bb9f5a00000002c0fe10256e2494ff7286f3dae26167f4b6ea6e29cdb4923f681ebd7ae636f30cf356d9812bd1bfe0dde6ce92efa4312718fd9c2bfb46299adfc11a2f278028291e55c0e78b23bae6cc5d94d39868cf3cf1907ca9245feaf7d747f4619be49189578aa0677ca87e090304e04c801bf25857af15a2047e625b52dd9dd6e455a2eec0f9b67735e1b73c5bcd9bb62919782d40f26490acb589fe6f370d0f4a157e1d7bfd6adfaf840af4a677957f5bf1751268facfe5a825e4340a3e0c18f62d13754548f920b7cb17fc25b5bfdb", @ANYRESDEC=r7, @ANYRES64=r7]) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', &(0x7f0000000640)=ANY=[@ANYBLOB="0810000006000000b883098a22ab554db58b6260a7e1945233786339159635bf75823154e67af035a960b547a0d46178802ce0622773292ec8adfc7bbcbf830a3504c1bfe5fc83fd1692da3f6190b4b0f2330308562f745d27a77cbefdc75f453a36cc034991c598003c9eba77b830b81b29ddfe664da8901a275fee103504a737755e372fa05c4469bff2c3f4962ac77f39ecf0e2c7271bd0639c689ee3cf295eb4a38b6a6e4fbd3a11e485c5be6a710cf09a2a56bced943f4865e0aba0d814f6bdb4fc70ddfcc9708a3b9d5eb00a2510ad6726acded6e7841cafe53ff239a31c2eb3efd8596ecb33e5e2812d708442615dd5f0378ca61a4c19d1af09e6fd1be41828cafb98788bb8c25faa78f53e72ad3f45e41c7ac9f8c9343766479618f7c93693e5fe9966ce272e1cb8ec7c33319c5038659de6fa0950ade5a5a1acfd381de20ac12443ee0dad3c266dcbda4a6f0892bda30b825c36589bcb59687c468294d9f8fc97254907fc5a16b46818d417edf02e49c7c3fb82e2ffefe25d6fd7a60bc59161570da672769ceafb12391ddad14fdffe811a66c463e113f4b689a8ea9e2bc79e661a338de5b215f0e043666b5c813b288407abcc45e8935245edded48c26f7eb69ed405318a1d8953a3509893a29be0b5664c5134c3c784112da16f6fe307ede6907a2fbfea30b57fe2534a2ebf0cf58f8f4456ea8db8a4dcd8d725c93b5afde7af9f23afcef3283f8fc02b97a07647d94ca1761e087eb817ec4faabb0a976e4ae0bebb7c573e618c7e8d05ee4713f1183b543bfa91ca963efd26a4349a62104eeb0df84c5c7e9341b3c9d86ed11aa58abae46d62b8117f52a2afd1eef5aec7d82679c15ba6225ee05becafb0ef639a0dd2c777c805f942b4b9ed84a9a1e4515c4b8f9a4e397478fb7bfe857d3eb27b9d5813c6e1f7217a7bb954453df920fc5fb04177c573d2175856a399a1ea1331dcdda785b34617012b83f89a0a2298484b94a9fac09e4a20b0a75a5f9fe69245e38127e5a7b788fe8ca3fdc40fe9860eeabb2a82fd33fff6dd73ca19630ea2161a69123725e9b0ca93acd4f93578f7b39c747b27f808c60500c38ff7f4d2edf059a678d328362d0dd23d011f9762e04d55b919487eb1c254a3289e90b5818d022c284f370d37558260a018ced8d9861176af18076a58b9ed7d47414cba01f97589094cb2b9d9776f31b1957829e15dca6f0243aff998a2c90ea689daa5d353f09f84c60654af1c96d841db69332a2db383944fb9faa9c1880a77ecf749ad284e3fbbec24a51c83de83cb4f8063adead4bfcc38ee9aa46e0e38105044ce59d361b47573b6f18229789f1cbedcd73179ecb4216e274b54b16d82b8d577691d1724c48b4cd81abf9c6007be21cb0be8fca7c6cdf84f5f76673a221e819ae90de97e10812770c10e633b6f67f273fc2f788887bda1e0825738bededa039ac1492b700417314f86814dfa63eea0c8ba5451948f3dabba6d45bf70b122d594b2235395a3921a4e1c3645d38244880e73bd7f7392a6580f113decc564c3fa377dd5df1590cb060295130d96b6546d1a7804ffe115283cfc71acf1a6ff01dd2d18a0293707007851a87840cab54e4144e54d419ed14e30325d8300a9055557c9b0471b35fed7d04a4bc5400085211c1191bbbd67393db4387113bfd5824d93ae518e43659fa439ab96bc23b0a0d7e23f4a7d21ab982e36cf5d23d119c48bcc6fbc4adb77bf8ba9362d34a76617704d7f195d7e637044159b019f3897dbf6339f09ce5489ffda84ea4670e0d2f37653cf940a0a392e51f8ece4a315cb821301945e0f6155662f335536a9586432c7641dbd59817704be11f1edc0a1fea1be3e40af5c9a4525a7235361e6443c24aef6e58e48223e50ce2507721c3d23475c5deb0d15d389dca4ed7df8c208807249bd3fb065897b8a1bf30e0b5b281e5a465c51fd660559879e0b55229eaad3e40011649008ed7ee01058e7136accf3e343df06d6624f7dc720753d79b31571592e1420a3366891e506ef4aa305a2cd47c66dd6238b21466075e06e01f882e18727c5cd9faf48a267d3443334498532573aa29812ae7db1205e249b6e79baa96bafe4ff99ea0e5f1c0f35a3dffebca1ddf467972c31abae2f5c68baa7957dbc532b76a73ce4a3145638b92f9ea48f18e343cb2229677bbebe9208fa6f1e1bb4e840ffe8d5d7ec2586d4568ea9e806eb2d084ecd3ad48e45f241863cb17a20a9acc3894a29abf451032de672c9c920665aa649dfe367b632cf784ee615e5579c9b49c05a0a85ae5b477e957fc53170d75a75d48e78dbe59d82bb6b798f59458bfd0b0f16b64f0a8497334868aae21f5bf6b994d387f39e81110a6e652d593e4f487b4252b445e5e2141f3f967b66888a35435591f6724c096ceb19745da0ac5921b4d0e5db137c467ead72621b039f81e35454ee6db8d65fb2d024ecab85043a70a87f87e5544d5f0f6090822e7f12c00eb3799546a51ffd26ec4981692fff41d2fa160942e9a8d4ebd384e9de676b0009f6d9d825804a32c88fd45febc2553ff0d58315af4b0303ecf561561e4027e030a4b0ac23a14faba1300a73b3515e2e5b6a87582aa947fe9a07ec97dbea020cafe05283188e25f43b96983cf3ba9c13dcbe65dde9fda0d494b86523992bb0e9bf9cde2e597beb148a8ad3dc192d95b3aece9391e80a42ea4b94ad493a2147f74a3b4bbe635084203bba86ba5eef1e340afd9f131bba31ff5f4601e0815a7c859ba6665f7887cfc297019d285873e6fac3f27316078fedd6155fe924df85cef69f8e06ce5bd07cf3e47a029500b5d78381f4c8e4e75b37c6700bc738576888f78e5faf45fa24c2147f84ae0a3533e06bee22d41cdbaf46f5041626ec970bfd370840c039947430195adc4196d26148e227dfb469777e22a2060cb3189960f4bc6aa36d95b41d0c33521180cfcfd8f9939025944a9631f05baae6d3ea627ff32c22c2f1a399c657675b02c2842d49a6553826878f67bba28c2cf4c796d172c38f6797e09f3555bc5f769db2d441b4e0992aaf75b3f6459161e8d1098dc42008b2bbed9bce666650453bd1c16eb36adaf4bad375755a57a1974e223d50838f5578da44cd828ad1fcf1779e3c27d5d8f707cf6bf070e516e307412c716259d94b4170a870fbe1ed1d708180d9687e2511cc01ae94cd1d566504373ce2ad771011de3d16c850e885dc58c0ee70e49195b7d172d0a2639be006e623bf2b2960cdce25bf43b4da9f17b8a3e02d8a849d33652eebe926ab5d00baaeb6cd3e5caa71e32c467cbe22225dcde5822af95e9dadab7554ea2b52fa016c1ba3f293bf4ee299084709caeaefa63f1747e4683d1a61c1c61638cc349d42ab334aefec90fb8849b04c11febd1fb1ee6b0c0144a36926a2c454eabd8fea3859a944d7f3d1247995213ddb5ba95545f132a1e344ccdf125e642d4335b677ae54ea4d18699d48c5777ad50d669e03805bed3f565f210b2f9322274012b7802ba681b9dcc1c55386b2a6a4ad8a59ecc03b6d8215089a8fff9cfa00044a58f634c769053eda1389c61c6bf74d5cf81da176a0cecde7319c95541ccbdc39e40b1a752b9ed2cef23f1e1b4377d9201afb5ba29df7c0d783ad57b892182259bc5a8cfdce03c9425a1a5c3a04acf2b7827bca04af18b9624f02720565210f61a57d6a244df1496340c716a529d504202577cc15eba0420cd8f33f4e772b2b26969a36ab332d7ed10f490798ca06d66250b8cd5bf60f8c86cef2347a6180007b763b3253f477cf19ee045de31d67c280619ce67bbbbad5a7c3aa2e0d3546d215e1db45a19c1975ddb74cc23e71371ee6df8ccf15bfed1fac86d6ff1abf916c9cde49a60c88d1f6fd20a3deaefaca07ef580d3c7b2d1f7cb1037a341fdd461a6180af7e32143e8b92ccca98a248d7abd2b0cf467a033ad69d8d8e54cac73f7cc2b75fcf48c4c2fc1e6ab0e20e3e61996ec4b5f81becc9dafa94db2625eaaf785a0531de62f3ca6923315cf899293a991e3b9977fd7f5eed21c08f2c283bb341bfd4d8e0de3bdbfb66d96f2450328bf9604a2b49b2f52c622df4d67ee817fa7777cc058ea239aacb6b6d96b154fdbaeff5b5be42ea8b50b7f36e32be3684b33d81cf51636c12c34dd92140d560c0de4e229dc40927d62f612da79bbfd347f783158a7309021fbe5e84e6a63326443f01cd05980a6ce98081a2e8190e9854ba035374122802609fd9a0981f20af66c19029ac803811088a169a56575692f3e57797c99066e5c005134dd57d1f555db891c3b6c690b0d407835861df290cdf8c0d524a6f2420c71b9479edc1c9cf131b6a7e4df92c43e652f5df9fd4960ac637bbac781b222d298a5414357e7450eef06c89c5c98b904e1b8dccca9839d236d57d3bf508c303b320f9e2a93d84f2146060d0f2be28f0bb869b881f891049dd865f919cf9b32d037eb3412c1ec5dd6b64a07551c7eb645d12f1c26ff12a926317b82c99fa724f18c55f437d2004ac4032ac10ee54a3121dca6cb2d3876acffd89561274dc259ceba3464a81d04ff39ff7f847192f82a1e4ce30d9a84c27b89d4688f4a261bb377815e4ba416f5598573c334d9a686180fbefb1d8af3b2c540c416e2e01ed16a8a2dc99823f774d0664eee42c88c7a404aeb43a63fac675e934b00c229095acd6f8037a44ac2fce739efc683cca49e53a95341d9a43ee72dcdf1974d41dd6b82b5ad57db5710c6164546c34347e7f1842c0f8395eee4d5ddc5e2b7b89a9328a8f1a823b6b12e4f9ba71b517917a70ab9fde5bd332ba450035b15ada641bd94bb67f104152c79c4bc7999ccf145489182dede58ce1a2c57d9a9363809d3f2cc2803f8338ec71d84b3fd4418aabe7032da3ac016e888e164e4045b8201b6fcb76639139e2987615474f98ee5791ee6032fefc0ff388c68b309a2ee9baed637b4d878863a658d42fc3e3ce1bf8c29f6ddd18ce397ad26531551b569a26ceae426bcfc3aa26468becbcebb57fad70e15fc647e9883d5a608d99eaca6e06ca4bf9f55b905e87825b8ddc005c4db22bd0ef1a937d3b29be83adecd40ba95951cd5bfccd5393cc72544731f6ef071bd573f777504a7b84e47701361df48c8d4cbe95096eaa178b2d3465e5276cc5013b8ebc806ffc29e78913a4a8a0811265eb98fdd91d7ef768a2ceb7a75a94d58b918fb04d320974ffe1376d9701ff5539473f76b631b831f9b26027166c8affed4666babd10abcd5ff374abba8215418d7fa4ba16d0c495e407b6130852a0a69922c998cc31fa2cc20211865f14c5e87ff49b919d367daf511f979c689bfecf6f0ca55eefaa9a7a36164a0eb2270b764892cd11bce5ee2d8cf80279dda54df2bb05134164799a206cf9cdf6acba651b82224d06eca1eb3fc2cf3aa07139e2b2b51fe9ceabda19c1383fde83366946e532548d8c1692b951e57b2de94644104ee6f3ca2eecf8bd056c7bad70ab4e385d252dc29a902a2ce40dc45bb4079b0cd8a9061462a9b822e48b75e3ba4f19d768e7a1c13b838863767e83a8e22837acf94f30358e286e419c91ac814194866419b9997837db9817873a60fda8d1fb7e3389b7b657c98739e180e80fbdf37487f6898688e149d792d72862e87e663c372cd2f7f05059f53c97d89e5cc648c9ad8b1aa4fc154f4b424b8f899e5d4df8b1950cd48da3cf8b2bfa80f3d51526fc0f8f5c9e3967ef1f3dd356a7fe954e967886122fa5eab558e74ca60b0e40ba136d7e1e2ad099b4f5b37cb8d31f1"], &(0x7f0000000140), 0x400) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4008814}, 0x800) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}}, 0x0) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f0000001900)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x34, 0x0, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40408c0}, 0x40004) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000000), 0x4) [ 191.434100] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 191.447491] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 191.462482] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 191.470005] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 191.479374] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 191.494512] print_req_error: I/O error, dev loop5, sector 0 [ 191.495550] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 191.512728] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000004b00)={&(0x7f0000004640)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000004ac0)={&(0x7f0000004680)={0x42c, 0x3f4, 0x100, 0x70bd25, 0x25dfdbff, {0x5, 0x0, 0x28, [0x0, 0x400, 0x3, 0xfffff001, 0x1, 0x905, 0x7fffffff, 0x7, 0x2, 0x2, 0x7, 0x2, 0xe964, 0x7, 0xffffffff, 0x3, 0x1ff, 0x10000, 0x4, 0x97, 0x4, 0x7fff, 0xffff, 0x1, 0xaef, 0x400, 0x2, 0x7cd, 0x6, 0x1ff, 0xfffffffc, 0x1, 0x0, 0x3fe267b9, 0x4, 0x40, 0x20000, 0x4, 0x8001, 0x9, 0x9, 0x20, 0x3, 0x5, 0x88a, 0x7fffffff, 0x8, 0x9, 0x4, 0x2, 0x5, 0x3, 0xbaf, 0x7, 0x4800000, 0x1, 0x9, 0x80000000, 0x8, 0xdb, 0x0, 0x9, 0x5, 0x1], [0xffffffff, 0xffffffff, 0x200, 0x899, 0x9, 0xff800000, 0x80000001, 0x8, 0x8, 0x1f, 0x7, 0x9, 0x2, 0x31, 0x6, 0x5, 0x20, 0x7f, 0x1ff, 0x6, 0x8, 0x80000001, 0x3, 0x8000, 0xe15, 0x10001, 0x5, 0x0, 0x2f5284d0, 0x2, 0x3, 0xfbb, 0xfffffffa, 0x401, 0x2, 0x20000, 0x6, 0x6, 0x3, 0xfffffe00, 0x2, 0xfffffff8, 0x4, 0x2, 0x3f, 0x80000001, 0xffffffff, 0x8000, 0x9, 0x8d, 0xff, 0x6, 0x3, 0xe54, 0xfff, 0x0, 0x3ff, 0x0, 0x5b, 0x1, 0xfff, 0x8, 0xaf], [0x1, 0x7fffffff, 0xa1, 0x8000, 0x957, 0x2, 0xffffff80, 0xa78, 0x6, 0xfff, 0x490, 0xfffffffa, 0x601, 0x3, 0x1, 0x7, 0x8, 0x3, 0x2e6e, 0xffffffff, 0x0, 0x8000, 0x7ff, 0x5, 0xfffffc01, 0xffffffff, 0x3, 0x7, 0x7, 0x2, 0x1, 0x6, 0x6, 0xf4, 0x7f, 0xfffffff7, 0x3, 0x4, 0x7fff, 0x4d4f, 0x2b1dbd0a, 0x3, 0x1f, 0xd6de, 0x9, 0x5, 0x401, 0x3, 0xffffffff, 0x7ff, 0x3, 0x8, 0x2, 0x9, 0x9, 0x480000, 0x5, 0x7, 0x2, 0x7f, 0xffffffff, 0x1, 0x8, 0x101], [0x3ff, 0x8001, 0x400000, 0x1, 0x77, 0xfc, 0x9e63, 0x6, 0x80000001, 0xd3f9, 0x2, 0x7, 0xd5, 0x80000001, 0x1, 0xbf, 0x0, 0xffffff01, 0x4, 0x80000001, 0x7, 0xffffffff, 0xe3, 0x9, 0x8, 0x6, 0xc6add4f, 0x6, 0x7, 0x89a, 0x1, 0x800, 0x400, 0x7ff, 0x7f, 0x80000001, 0x80000001, 0x1ff, 0xbd63, 0x10001, 0x6, 0x7f, 0x8, 0xfff, 0x7f, 0x5, 0x2, 0x6, 0x1, 0x1, 0x1, 0x3, 0x80000001, 0xeb, 0x80000001, 0x0, 0x800, 0x6, 0x1, 0x7fff, 0x80000001, 0x0, 0xffffffff, 0xfffffffc], 0xa, ['nfs4\x00', 'nfs4\x00']}, ["", "", "", ""]}, 0x42c}, 0x1, 0x0, 0x0, 0x20000090}, 0x40) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1d009069", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000080)='./file0\x00', 0x1, 0x8, &(0x7f0000000500)=[{&(0x7f0000000640)="98ee8b2695d058d1df4dc88c19916c78675fb7694b275aedd41f20bf8fb3b72d2206c9ee4daf2ccaa71465424f494a043807968349aa88123dbe4194723c260c1bc7f8ca2ed7fd5b1f2caefd38f5af5d586a107e60aab77d31c6c2da7acc0c8e027d74c8a82f069346365438f6d1f969645f7dc16b65e497c99c9f5f0313ff28c9f9c5bf6234de76e1ac3254a7af7c2d8e7cb8f5abca76e1f84941ee440b3654cf84705a2607e6ddb62c23b788aa1162a742ee2e291b0cc997e5e0438a2c2d207da3269a5b7108bb6f92df879de43ee7d2181277b954af701af57814f752345996cba7ef02522225165f9781bbd6fde67465adb70b69238df07db7529a4f131d0eb1882945b85d781e9f0638bc8d943889c4c04a0673b62763cff1f9b3318e08a48cfd3b649251f4cc95394fe70fdce04b77c6b07a716a129704a839dbb71987f5c88340a8a8947fea84b3a23056cdaf64a6676047d756075f240dfb7e54e707b5087fb382df0c13d00f6499bfcf6efb4efc34ecfe8ae643ee14d20a62104a26a956c30d6e20efe30601aaafa919911da4c663a56ee63ed21d5842b2b099258e95884c9e9ed1aeabec36565ae5711fab9a177d9111f21ee2036cebfeea6239fc67f570ae9d4985c9900bb12dac02f8fd2965e862bef96e537376b719114319b42194955a5503b01046718ebc40b8234a696010d6a977d385b8219067c8e88c241ca143626a8c3bef33703d652c32e51957332b2a2201ce7e68e0c4529c1f8707ef11ff56f62a6a4abd63fecfd157aa6da922df80c159ddbffd7ac6611db9d91c4e486f699b9918140b1c0cc7f78a9bfc5b8cced37f634c4d4f2f344de18f5e659eefccfd309fa9355427b0268ceacc4f666c71cbdadccce032f0cff34d76fc910118eb829b2a558d5754562154ac14822d3fda0db7f7332ca247951debd026ade49c91927c6c425effcb567aa85ff67ef9a506ad48554ee072ae11d027f10022290ee026c11885651957a5e2d0e3cb9e5be4b7dc1482e04e66306ab441ac2bc1f6ef244a979c7050ffa5cb5fc98e71a731d98a4025cce5a85a875fd2c8760cf2cedabb37de8f548ab1dcd81912d94a33670ad06c7e7655d2d414b3c8925a5363bd7dce869b2abc3e1048676236db075a1f0289b9aba59b843f3678f62106b141385011e1d2e37ff31e94fc81381b9f4e82fc007bd3be260991c26fa7170aa7a9ade3b5148cdddb6aed5567f0da75c8e82a5e39d371e6c60d05462164581bf270dc63a7d65e2bd098766b40b60329574708c8c965f3053cec92ff8d31d86d330a4bb17f82b64c761eb155eac573b87f8a534cfdd869d273a1820cc7d5ce8f66ac867958888c55681eefd748d19f96ed4f1e5efadeb1a75b7479eb6207f31b0a74f41ff226fd0465e64f11df14ced2c9cf885a949331d56e8ea842587bf9ef1c062f7d782911d378d1dfb1e24444e722a6094c6ccd29fd7157f69ddac37b4bd6b129d8b96db50340e6dd854160ca8a577cc8a5e08c800a7d2fb5c86279a5509028eeb45cdebd5bb6e1f5cef2b8af44501aa24927ba58a6683715affcc469c53fbcefc55f6b080ead5a79cf289cd9fc24ffddd90dd7155b5c444ab2a8040f617cb8f929b52ffedb3184710415f2bc03889c93bbe3692f3beace123dcd5d6fdd45a590783164fe0c1a47099fc685bc746a8f961a84ffe5029ac64de5a3cb55d21e1d79204a2d781308c7c9333353bf9bdfcc18f844336458369b0fbeca95479c27ef6709e096080635b2c8d00cb7b4089e38b4ce2caa1d3130082ee42ecae4f480ad6c19ed11ff74346d59ffbc00dbf06e16ac352ac07e60b4eb80f1820a3644094bb5e9732de5af628baf9b7faba747ea3295e1b4ceef9651a716483a820cf64b4e6becf07828f05a7dd580282c0717f7c10279f482aba204116955a1bb2fbb361ef55d80054aad301a14edc80e9db3f9a7c7bf31dde25de0816e2d97baf62c5fe17dac5fa902d2996d8db214dfdf17bb9bba82e361d5995f70bae9fb37f96d44c1eca49cb64daf2f09630ebe05790f2bc8a291f305222515ab0a7846dd90631e18734c2e11ddc16d871bb4d57d401dbb487cb2f3bb143e200e0eea978b6eb20cbb30c0cea25f35f1ad064f74cebf9ee430b7306fd49c45f3c8b25602e525e713e9e93451e2f6944fe15e18aaa283637fd3fa6af257e37215b67a20d48b90419cf58f05bdb715e77fa3c2c8c221a0249428a9b0c724d54123db7711a373c6b1bcde528808b1d2557ca1b8f55c0855d6c5d4a9ff7f214d977f03c02efc221c241e263f7aa206552473e4c24b9ae6a25162406a612aa902bc0527b7efb1445a7465237f802de7e02244be07b08e62444ea927875d38dfb380024e35ef2cba2f703faa501661a0bc8c7a553fada1aa7c4988e60a145ff55cb5e744b85fd328cbb8cc1b8d01fcfb13d07f8f7a331520dab463fcf18123446c3905b83ac4b8e5dfbdd5b47231e2f19645c3911323dd548ff74e9f761329fede4a0403ead4ade4ab054474a8e9946de0b68cfc6778dcbe599077a9036e3336e5915a9cc701e30075a181f8f344976a6aec3adfe9ad7494276f0eb5edd439220f4c828e618d5e0abec714fb328a46d02b0af4ecac83c9577b65ea71ad7f3225e3025eaa86e7c041fdd58332ed96107f958104d8027d2ed7128a3aca5c6a3b21660a0ff3d54455d12bac9d182add8e10596547b4c3369a588b44a7fb04334f1d7d32ca5a0641339a58909d141477d560d00dfdd7cf5e1c33d12631422345980c43c19ee3aae069d066b3677e448a19a9a28dd0fb32816e71dcc46093dbbfdfdf59f452eebd11ed0c4d3996e0a8512a261706a6926a4ea398fc9b598f375593b88bf6b67e7b0e5bd6c2d4b83b4313ca76ad0d546712a8da26f4d7cde7069ceeb793f6629775ae566c2278a8eaf6327f11f8521976509c7f241d30eafdabe7ffaca98bfb48c98139e246332a3e75bb76985800f989ded65b1da9a2f7cb2ca15ee3151ed3a643ae69ee3f8e4ed4a5fe6229ba32e4bcc3308a43a47ca97e9ce0edf4f2ab387ef9d708be19af7fcad019215109e5add1bc9866f6f5bfd547c8f20263527d41bec666aa610a4823f9830ce52173fad38350624a88701d644714949923f84f10bd06cb803858ef4d71bdc54bee30b6a5602f44c60c22c9f3d1df6f341c65a8b587eae3c5c9e541e7df1408a7bf029db2599e4b73325af6611d3ee031dda61955dc829708d2083c45a9a698f64f45054bf62c1cb9d71f4abbc34fa308272c94520cc6e5d1a5dfc0f25be9039802871285dcca8acf312085749a6b1a76ec4afd0a533a09825ee1f3e55c2f8ed896f26d1c0f6ca7d6c8d995d2a1529fba55e35c04e35e8cbb0722ee17a0b5c00f3f99a21a3b1f1f6cc37eb6385142d93547ba15cfabbda630ffe426759dc2344a58e12d8a222c6e6b2f2e27646d9e0a3c309d8c730f5f1aa224bd09ba07d10fc22e6e4669ed428fbe25c6f4b9d079b632c924d1a5596a10a3475ef45052dd25132ea5fc28133a34a392c392baa9dbf9e6b1f940aa7ba58515f1b8bfe11daf6d7f8e82ad5c79be843b500e8c3dec13632625f2ccf8b99ad1e5ccc2f80b7594134102eaa3f1243a9ecadaf83a7e69ee3fa53911e3e9f6d695ed208a87c8ff4e694cabb4fc8f848d3556ad6a4053cd1ac8e2f2f6d90042eeb7971c6ab7651cec96408df2f19075a2dea17ef93b821cb2c247638da9eb971ec87e989c92d016b41c16676337c4178c38b3afdeefd51d3ca378a235fb3a90e9768b8e3b27a02e83c2ea2d9ad48b20483cca4e30ce242184c1e0f4e3dd7654a46550b2635966d92815a29531961552e6ba374bc7b5d5e6a930f2d84c41ecad9bab7dfdb415c85ecfdbdfecfb088d688af55348c40872ed32cb1a05dade7b22ea43f3bc42425c8bc3fc4af097a61267130c7b0bb08d06aa10b1d1d10bc36b22e068e645993186c1f9f984991fc64f481ce55a56ea273f20092d373952fb61f7f0bbd723ca46ab3b2f3a2ed6f0b644183b9ca110ea7e59a86e8386b2536a84796853fe3cef511f68d6c288e48fa9329f8d62eaf213ccd4a3fd1d73e6a748cd120cabb0aaba3fe429b5a8128c69d89f18b4d7a09ee257561fb9bc4343fbb5448bfc5dde9370d14bbe21d5a5ffb5bad8041ab9a7ac13b0c10c48faaf342ba528c629ca9bac41152b53af5c58d36100ece2fc7a2d2a4735fab879e26a86f1357a74dea1c25a39de558aa7b96f8c7b677c0ccc086efcb3ec660b3804239a01cab44b0ebbf4386f39a534217d24fb326500a891567322e4a6b0fa95002de87c0bb57181b53138156b95d8b9d2df3f1874b1aeb29e8dad3a5202ff772bc2a96ac51fba59bf2cb94b3a791d451d5cdd367b0e9c2b934e9ab585ef863416eb27169b31e99d518e5acfcb9c0816ee11085fb0e342fea3a40cc92d3e33cbfce77ab18862cd70732eacea1e4268b73f1f5e8a986d08b0d785a9e439a9d3685ae1237052cf75ada2f82a25ab57a4890668f83f8b3ad1c0530a48d3c49e658603c79cd9b6fdc7bcb1d5126478cdada28988a225bb1bcaa4ca4995e7c431dd16f7c0e57c4d970aab7a12cabd184caed58f4acebdb54c06ac9251a04a0ffb922e1f5ba487b5f766825896aa23541beace2232be6e8debfd88d90a2407935b29f6027107d9a9b9a40de109d67b4a80d81038955e7f915d9c2cb901f8eeeb523e08abab2c8104224d59309b41c203b1d1db5618beb1f82daaafad08f1c1bd27ace95f2337bbb29df9e01f5090dd1210b3827f0682cd280244f6185d3ee7d676acbae7c01ccccad2c4aae5e93d3e4fee372c5096064000d17eb2caca18d32a3e4c96ef78715aec8f5ec487fa50ef8f74d80d9730d2dab46b0a124eb2e2a97e54c6280fb8bb63c404a225bf8ffa9af22c75280ee857450b558b2aa6a3e8de381ccacb166f2feaf3ce2876557504d4ccede78629842abe1b654ce24b18f5221337066b19d24583014049638b25c27295cd1c67d41f115e60b9121f2905aa5ae56164e57e575d63975414c823854b3a32e70b864ed5d307c68cb51f3b0c510c7503f9bb7abe8794f9063c3eee133ad64375f9f777382694fd10ee55c82c4f2e290fe9d5fef11a8966443c66a4e5772a66f2492a0d5b569cbb5a2f50534134368d0da5b3af68828e839983fa275172aa7dae2f7f9a27d8917d79856237922490404f6663eff901cc60bb2a3edf8315534d478469f3ccafed6888bbf21222b0d5df16a9eef9be476d0b9d095ba0a982ae46876ab53917176b47060346c9cc5927d926f8710f899adfa8d9c6fe59538e0721a1d309eb75f9c758fc7f00fcfe593d7da05541684df47d8d9112efda763da17ab8c00cd31212d1bed3019d6ed4f88610fb54202f70f8c75b2876c4f53b6923279304ed6d207d187f62f9df11b96d0f6c10fe02473452209fd0372f3106ca695924d98805487b3de100b2ce8f8f5d4ad1d6a419531bc0db8c649347eb7350a44914dd0c07bc60a87463cd1570c8ed0b868fe84b9c1435ff55606810592abd7fb6661ddd480ee714eb1fc53cfb1f3f5efcbbb6db2ac7a8ddb3cad3b5fe79552742112abd7cadabfaf90a6ad847d045d27bfa31e48c2a87618b6269da42a3ffc2e5929829f47c8c6f6f509422b8df915824f341517556e3e23e0bb0e830060aa9161052480816c99ab1268c90c97227b8466d38c2825ccfe657b6c007fb4ceee8b256aeec723a27a8e898a361a1bd20bcf540e0d0c58f75d6d660f8c02d696eebb28523", 0x1000, 0x8}, {&(0x7f0000001640)="521c68de1aa23ff25e1a5d9d0b70e6a7d84f54158d3afc5396278671f26d85ecb382482628dda15f90f35a4bcc7c7e2a643ef35201f217ee3e7838647920959f84bc4d96ce3505aef95c636520f7fd882bf09bbb031ff2911637216f1cfb8b0b7fa31daa363382af21989cd0a2e11a285db44f36f683d4f5b32d13515ca6eea21f9ce24ea87f372be729ae9736123e36710ebebffbabc5c4243e40e2c643bcbab3bd1c77d98cd08b464891760a1009f24bbb732b890e065472dc794ee8615bc46de87b54964bf87c74414209e22956dc656b14dec57400cbd62b8f314a386f12a8d329ac21cdff5b44a8abb9a73346f2f3440a236b66435ff51ae7dcfbbddcd9a7c18d86914811abf732eba3665edde3e5ab70f7e63b4313fc498f5764636d65a8d44dad520bda5295fe747aee80fe98db8ef886c8a296616c64056c1d8a507fc8d312ebd812ed6b0f6de8302cd5490c6479f8b7b9f6c9099b677ce07d9f59f7683da909cb6f30f0935d6c7390bcccc23ab1a9e71390575b3827e0170d83e1cdf6ed44ad80c759780f0748d32de80b81ea0b0f33f2f2931538efe60e3faa760b4be1d7abca813bae10c05375e21ba424cb0ce7d9f690f3ed698f56788af630cf2f47dbb38986cabc309da3222c9b2c2e796c61d17cd85c2339f0efee03dc34c0b4ac3c59b1406f31af63551693d59ad8edea76286e07609784382437291684da14ac239b7b905985b16b71cbbf3ac88cc2d7c7972fa75864f3ff48b53e17856a74ae1d97b02ca87bd67fa65f3dbc192e6ca3213c960461883f07389c22d718a2fa7c4b1842bde2773231f47b43f3eb4840f53c81d78b9810ce18f49e344abc9b29cd581259f8e82824f804875164473246bd523743c8c3c6181ace5ee115a87f4583d8d2c5b4efe84e9373ad948bae460bea40459f98b698f0476cc2f4c3888f3e37a1dd68f8a08d719b5406063d33a1fce79ddacabd1251e632306f716d2623c8e8b71e0c78401585055ff859a41e8e847e7dd1365d7b7eea44eeffc81b3e4ccb5cbb0a50b304444de78725004112a5cf726c370576049370f0461b5a508f4d950a6150b53f92a7e015ae2f473309cf9587d7adaa81e5cc622bb9592d1bfe36743e2c5ee22823cda636092bde94f3ead5898de30cb0f77fa765b0f097accfc101964f430a9560a630eac0e0d069c90be605a0b77f861dd891190eef381fcd9209cd7bcdc9e8368f43babb5afc122ea24799c43e4d9d0ce572b44f69ebbecaef07946ba5431d1a58c58c94bddee0ae830d3e09a0755b165b4c54ff9038e40a76191dd618578d04c505d97899983dcfec0836ef5bd432023bf4ed7cd2a660349cdfa6f1684afaada6af52a6c02c3d2f61d572d0cbae64d4793c661d6c7c3b71157bc82bfe9990d68a8533181ce8d39c2857da8fadfce3c93c3433f6c7d0764d5d87a71d36b841251554c3662837fe755a5a7ce458e1a82cfc36368e392678033817713a6133743e1569064de6f4594a78a2d60fa8363f4c5dbd95240c071355a89711e33f237be2a7e2fc7b44c63184bcac78bebe4b6b2de5de5522eaf65443deb809a11c48d80cce4302e5cd2a00ac8f6ad164ab75224c2a8f8c6ff972827ca2516530746bf618e26418138d2504ed369229d001aaa5a65a5ffe29b795f682a80059564c5d58d2488d40d04384232c4b6b569fada4f09dd2ddf977ace355d9f8b961484854bd5a2734f875cd36ee927a5931de34300dc1c5c07db187d6d4bc74e5ad4495809d4c230cb014b1f72a817dffbc0dcb974f28c6d2f1f50cdf7062db60f9b8f8a69c713ad8883afc04041849452482e8f4cb930b478433d7955e223d42119af0d121bdb201952fe8de440687b7954271bfaff328595806150133a515d45de15f5c3b84994445bb244e19b9241a0449e8b5280e52982918d695557f19c70ec874fdde120dfb8d856a1dff24d9658fb74b9e2da56ff9fd5c12e9283621ce962f47d398eff26198b74e8e656c522cde483d256375bf471509aa39f4c6eecce26cdb970a4bd74520def9205f0268ada111d6d37a3064629b30086351b63618e7236895db80e18d995474bf11f721927d9f96e560a2ccdb8461608c00dd9a0fc4d721524b658652553b8f678458cab2ee4db9f197f999780c414c9602a19a9bd6d565589b152e9f4a8a8e4aae5d6b1150548c2aa9d86528545ae15c39a1f7f0368ccce3a171425ded445f14c5c0f7af13dd4955a59afa181e01ab245059824fe293db01953a785b7274efe99d5cfdef640bdd432578b8cc3b0d8b9b9b7740cc383a0129db3e6215fe5150d40aafda96ab66a91d2ada484489c6abe221373b4aa0f1eac0dc420e7547e3516b33a1d9f8dd3e66871ff5ad8785a5be62e30d04640f1d6cb8070a58bcc35acfdcbdb173668ba0b746c5ef292d670bd44d643dba714ebd59afe049736747695a090fe120077d92988be2050f6dfc93c6f63cb44886c3f20a8cfe4207e5ee118765793770c3dfc681c7f9a5c5847b0cd086ea2d5924093bab11c3e086d9484fc670c24d0df03a837955f66df32717f76ee324a716cc5a99a84985d00d5e9d2291cfefb4fa29ce6bbddaa46731c00e751a33d13aa5a5f4a85de7a2c9a6ab2dd0f9d6a5cd593e5dae2a2b2a5b0c69517e535f4c79bdf6a85cb27ab560504107371290b3e5bd644e212eccbde685e649d5e6aff647f2eb319b37cbdbdcdcde7372a5f0e8a8eed08c12b099b3049c667c5ce48410487637d93d9ba10bb83af343aaf3d81b082808adf7d395c759a381d599ef255cd778812f009e9658d3eab7b3d229d4723da24a289a5b86544f4370c35952824031afb637c566317ad567a8244b212c638ee026cf00176d02be891cef994a7b2b68045230ba5e8b12d0eae563752d2f8852dafa35e00e25422842220951b21727f966f414a31955d5d7fa8c7c8bb77fdb453a946cf07e08ec52ab91bffeaf92ac89c3bf00efbd08402bba86fb9edd9e8c9bec94f2ad99f4e03b42b3ed7966fb7840692f13c306c54058fb57f3e0c902bdb78a0d4b34875b521a88a59be8944c31aad5f3f11a04d03eff44732ba8eaac6feef705c97af1dd66d6f5fbe01f96f54a6af7d164681445d42b600edb6b4682e00d38da43b781c01ac3857501ce458f4f5bd46043af21aed3296fa1d3256efad4366e23e8d91ec870a017747d5eb44a0cad87433b135a38c963c58a5414c586241a298df59d4c8627275dec4de3ad053968f2ef443cb91e785b7b4c76bf76082c9fcf8ff3e800237b3cfe52f038c2926c43c429b88e8fee6fb5908a8c645ac2f84800e387ad2efb5be545f7204282f33423ccfd86767d7d4bf3379aa3476329c91d4da28582b7b6ad05b03693cb25c7cce5bff6cf9ebf5dd467158a02b3ea29498531a4b38d19fd333480124e61c3edaad384e4a6f37e0d2c5f7825c82db783002cd4a35eaef4a9386fbf52e945dcbbe61593ebad266193a70d8222cbd9f63cc3a3a955808e933ea1e195b18d2fcb92fb9e04e037f53136206b048cad135ff9740cbf2281727bde945910b877b9d46442c7229fbf1fa4f9a44c7f8be6234f9df2fb7d1455ecad0e3c66ca41e73899d6cf9a5103ca913f573e611ba09741bcc80e6271a0e717d180781bdc50e666e4d2e0a520ff90917e59f765f4b124190c34cf0f8dedc41315e33eb32654e4dfe69bf3a8ff37a8eddfa9d0c28e6a42426fe582154a9bfe9ee4803cd4102734edc28f91cd6f7d5de40dca8797eb13abc1fbad19a7e0f5d6dec30185168a1fdcb4ca1122af794647cce2efd52ec1fc9e05e19f33e468f0d525fc6b5fd8f1382377bf640dc3ebd4931cb635d5f2f6bbf1c6e46857d2a98699471a42cfe9c06f9c32d56e7c2cd3bc188754d4979d3889915731884a85ab4f15bf518450a910a074415f90a44a00b03d8643b9ded8cd3b616166445339cceb1ab0fd0ad09a475fab7c189908eacde17c6932813a9d75a5ad2dba7ae3077495ba4c51591bc4d71c6fddd00b23e3c3b44f08c6a5a9e8bcaf765460b8084fc809d8ae59eefa0fd97210d96419e25752c9001e4cdf46033e7a68a9650bb51c35f4d5f57306d12dafdc4df048a84d75048ed8b7bc5cdbb82187e6aaf6ef2e615c62655e08880785e9dc4b6d5367f1ded0988466cd33b716a116833677c359239201f476c83dd51a25e13f20f916c2ffe2ef6753a3475e9772947f87a088815b6671574bd3643a85288a87168db04e16c9792458a4eeaae474c222865b1ef3aed086493184880817af87eb5545dc5cce6a524394cc7de4c9ced9ce2cc560bd78ee5f5f32307b299d2bb6813d1d4c59e7257a117c44a41852bc1339a2b8db3db13f4d7010a8d363cf4e02d478c0b518e8e8ac8bec8272c520508430ced74518e3064427cbe75bffbaa034694bb9a2802aee88287ca7fe3b799ac0955f775614606ca8b5ae2d8845104525b3027f34a50720ff85154db268ecce461d09b8560bbe15eba6a9373577b70807edca7cd7944f60edf4e4b8ffeefb370ef658a223777fcb94ac994a0ce6de6a85f56ad16a6b585b3beed31f98ff63846824ae057b2b0d9be18d4bd3e01c6ebea78242163256f1d8c45564155afc2699d44b82c4a7572e0ba058e85a2a0534035077ed987ecd6df418532b2159b6c9144d8dcdf578c1c4bf407740ff2c55d501f2508d90d223a84d827b1667056e20591c7c65a6741f036dbec22cbe138dd8c159450e103507106d57d4c5e43f719b58e05a06010a3bc438fe6bdc71d31bd6c1c5c5905f7b90189444cb6a85c534ccf50295cf8f0cdc4d1609392687779883d8463cadf87f40e242e812e8306725bab6f2536d7c633c1a9cda4cd76f68773f083d24ee15dc3ace7364f46d4fe11d34677f5c4d8385265d58389b4dd2b20ec86d47e75a71857aca48ccb3f879910f2458d32f5b758787a14d303062daf1c6ae3fd2586c5753f02f9c73994aa8ae983ef5a55179314493b3543e225ded1ce0e502e4419feab58528c78f06251c1140a74a8787eeb0f2a1606ee98e1b69f673dbaa546d86e3b778a3b327931b885ec3c86a8179f116122e8919a4cd4f7aa28a97aae0330a16f48be87d9217671b68f8029be3e0a12d04e3d797b789584dec57202344369fe25dd8a6167b92375a559deaaf8ff18af01cf37e78f376fbe6ae635f82773fb31be9f401c727857dcaa0ca559612e8f58835317f2fb3f8bbbb933774bd8a6b1323954b25c627c7ce4a3489c8c3390bfb332dbf40139a2fdcc84e9bbe69d1ca15f003b015e581b5424c0e2ba98802a65eb086e5e672fe7ae181bea2554a0cd5ae8f1a8ea7a1d3467e1542dd94f55ddc11c36312051b421dd17f2066a146e36fce51c693f4a04822da5ddc1717f4f83ce4c2613450bd7429503103efab2c40f158591c4bfc9c5dbcaeb46859f744ce0373010ec51385407367fba4cc8270ecc38f246c03064d6f09e2a976c8236bf663f7b16e239789d57b7191209dfc5213d1791ffb72d8efeae3abb203b56b6eb0112b17a32298e68ebc9263b02b9edd001d825d13c54000f309de0054cfbc7cffdde6273bed62c08a54449158788bafdc20f92b90469ed70378dcfa2d2f8f5417916c1d5f5a8323310438a2660a4a8d89c96b76c3465484de05b5a1fc1a91c0ffa05a22cc50c61f1fa73dbae49104efc5b09fdef16827cf85e6ab48a77958489d795212cc342a82edabb5e78c81e6d21a4bf1edfd31856a10b06cb29d55ce20a231f3547724eb2d3b96f58d6ca4855fdb53ae693d2b7d1d", 0x1000, 0xfffffffffffffffe}, {&(0x7f0000000240)="5b9b66e0e0be992dcdbf969f7b1799c99d3b5ac6f13e61871e8b1b1693e3c227c266f5d3b81f584570cdf6ff8a5ccb08ad954dad3797ea2790fa9782d2c8e783d902816bc05ce0c17e054ca125df60c0dc37f4e39047d6bf7aaa44f02779962056f233948b9ddfe5ce4384808beb799cb00af3dab2236af4d7f16fad895a", 0x7e, 0xffffffff92bc0188}, {&(0x7f00000002c0)="c6c9524d53d38bb773c9f60571ffb6695f8e3f51b9da7f14b9876a42be48fbdaeb64045c9d0800b2bc4316ce18eea59c71dd843a2816d7bb38d50f7198dac840a23e7f1b37e3b3b19de75ef1fb514abcf5e970544520dd157f1fad3e", 0x5c, 0x7}, {&(0x7f0000002640)="5cbe9febb721f7048d0a6ce27ee204b8152d87063a04344e239e7b9752ee6183977254530a2b816e885f6c734bd5d97d0f0cf6a5aefebdd9f75aa4a5ef0a3b7d3429a59790b7bc67acbfa0684b2bd316a150c4459258afe188545e50e02c9a727df42874325b9eb6bdf83d7e2db9b4fb1d242ec34f3803a8a3cd1732e2a5e9bda9e982e4e616a09892eb4eeeb0ecfa49af577000a7bc62fe4aad3f6f4982904a86ad2740089d496fe758c8390c0fca7ebdbc03e5b6ce17ec8fec00bb48cd0fb9de2eb9f80171cd4cab43b252d9db3f33c1d99de5e6d9f730788ea242e92ec95610e90537d0e6c91bae499c52a43bcf6e0f704f741fcffc42e2152d56825e5cf4bbe2cee9488c436501c323254f8e75d5e01dbd4045daee48cbad29131f38c796bd05f337a618f59d76f32461439b95dbdcdf10cda61df7b6980a4c172932625a64e22641979bfcef5f616b5412a2a8914b55cbd78ae42fe052d9fa375dd897789b012c17f3fb95db5ea5c5cbf3c26dc2bafb50c3db123b5d4febc6fd15cd34cc94e7c1691e162a41092beba24ef839cc7fd1abe9d9bacec0f0d85b1ce5b0765614b804054d54f3f9e9713d3906cc55583209862ac2745da550a9d6ce86ae34a9de7e983ad9995e5fc24f67aa0038f5884ffe85ac2c96fd6b2b9011f5d65a662bad5e89a7d9c18c1b9a6d6593b297b8246a80788385cef531f904aaf8196e8d1dc1e3fb06e8e9c501b3e1cb97b5109dadad9562e2a3d0f785244abefd11b393d173e91d6ffd88f1bc61b952c585fdbd01bed4dcae707b27663550bb6503811ab112bf93c16b8e7be9b1ea54080d12a3b7a084bf3cc0b6493a347ffb57cccdf0044feb4083f882e9bceabfbc79196191ada52308661b284ab87ada3d17b9554604340e4f5bee5c81c3bcbc5e11d3ee4a44d88a8d6f68dcef229cadd1dbac8a766df525683ca096217b7f9140a747b8c618a7d8fd965dfc367b4d48c21e65a13ed34c5a7db985612b1b9d8e2703883ba952ce0d41e773dc41022cd981494fe9f69f72d2e26cc2cc2e90567a7fc2e2d0a416821d5e30633bbfd6c9daddae1642e23ed192c08120ce3ddc89c23eb707e3ec4bd9c5c8b2d400d655eeb39d1464c5ca7bdb678e6454701ca2c9d69c98d950e654aa10cf0449f5b9694a03fc3cf44e53ceebc40cad943997d6afd1a360a0d3f02a216134b39167d05dffde41d76769075e996e6e08c9041c4afd57a54be642a3d1210c2b855ee7cab46913d2dcb1e1f84eb2985aae7f10c6c1ab9e3c80b24f3023e445dcf578e61219ce09d487443549af27ffcc240b64cb4e840702e37d541bc1c3c1fcf220cf7774557ac89e7fde30621ad3f0f192f3d895201313b5e0d363f9cf9d1d58ccc1be7b06638b3dd0bd073d398f7760fe9e1e4a2e187bd04289b675701dbbbc26918c1f69b29664725827b9ce8623ac855635a9470613e47b6c9a144758bc83f57e748e866090c4653c8ccbc971ffa24b335f98a4555d9d4d5a4d1a7a6113bafa52db4833dacb72f33f7c93b233b8a9c5d51054d7b097aed3ac73bd4e6447917b8a6b91da5acabcce2ef0b10d1d671d9c5769833ecb75f6e80416b4f4fc5111d8c0894094bc55b6fe791317ba3f7c280e4fa32b6ebcd957d96fe3b6238e47cb29a777fb1166034002cd0042e377074884f3d0c4042312e19ae7ece934e63c8ddb549effce7f5fcfb16e596bac0345f574098c623311f3e200108cd685223a0b1adcab526f5d2bcd0b27d898081ef80cb54d857a3765755e2b1b02e0c7c7ffdf3cedc0bbf8fff3285ab8f6ac9bd85a5c53480c0cb0a959dd1c3971cf92cb1d81a8bcd282f109247985b93fe76ec51141e42099111cae6319ff0f8f5bd80b59737e8c368c72269ead8643f9c0ed5dcdd68629e232c2b29dae439755feb011641ce485acd92eb45faef1b5eb44500fe56860b967f5531911d29fba79c976d6cf3c1d72ac5736dcdfdabbb280f21c8260a581f563521731542e07e4cdbe288943c51dc8b9ee2f6bf8cea62c3ece7b2f3cdc05c07d26cdb5c7a413f2f722a4172a98af5450cfa245fa794aa2468558a2ef0691f79f9c5773cb4511543f7a78d888a3dd3fbef67506eda5c4f85f3e6ee0d0b91ce09d57f0acdedd1c3b4bbcdde51471f3c86653840bedba9475cb29df94eb0b44083c44c2fae2707d767ab96d98cb7a2bcabd61877948d9bc4d9b8ca382bdaf748051f29604bf054de8b30e858c1ddd03a29ba075a7eb34d6064cc8eb4f6b57129dd765a4eef6e1363db969dea919f46713484be458170f076b502485d3bdea731a2ef4e04298da1a8bca329d0c92dbe6d447ed55e4dd770e2c85433a76781b707d0b50ac94792d3409cdfa54303c5bf75d3e972de3a3476e837880f2e032099b2e1c909ec719cc7a1aea8d33c3c1b86670515880977295d203a3053f0c35c7ef18d78f9a183ce27e61563b82a9b3c8c71b383458ad2ac9be256bfab9f40097f3806a2cb24f5ec615a7af83cdb6acfa6193dcafbef4ece0ab1c7e2e33e42d9864c48c6b7796ec88a2805eff101c21c75fe3080ac422c994dfd6e126bdb38e3f84b72cf1727b5c49e9482321aedd8dd78c20d3c150c1d2ca2d2580bb2d7d99d32b881dd205eb06174fd8e6148fea2fa744d358d064971650992de9544138056d3d7320f9f53e363448783ae2efa35466a6459d1ffd04bc1e945a7338f7ae4e76fb80e6639cb8fddd879d875e4e94eaf7a7a7097d764b4100712dc9bb572106c385da8f004aca91e7dfc482289156fc178f48084b45fd750b82665e3a9c192b2271cd66a571926a114f4ccc1adb0f48523a9b6f0e6c7af2f795fe5473bde24f35be2b6e4f65addc31ae8be39384fdba1e5fac6e9997ab1e05f354762bb30992b1badebaaa658598ffd2a33e22465d7cdcedb5932eb17110372ae806b7a2ff23b2bfff7f5f7e8f67dbe81f5159fe45576b7e43ada2f860202041498792027f97aab82a77c36d2f9fee0678e25ea042ef8c9b92dca1def2a59a8c1b01c6a87bf573af81181bcb470894c713e757ed0cb33037fad5a7723e17f381e404dd64ad52c9e7f7383324bd0a0a074769f8c5158c511997205c0b87edd3e3d36673aeb9ebfc947f0cad6b6d2c773d2a97a86571166ed7ce26745961da98522fe808fc4e406f32be3ce88dded890964d98fc472ef411f7b9bbbb894e0a783ed58f0790532ab9cf45ec1ca2e5a7270163f9a8a4fa3e4793fcc29b3209f54bb5260bd574b707564d7b3c0d60b178991fdde1a9ee75c1f9220c363b41d71b6b0376a87e2f7b256cf5c5452e47ed548e998123886055c8eacdf733d80da859260054190b4dffdd4aebe96f5ff2562736c7f1cc5448ae79f83d95d936b7590f4a0a84a61642cddb545127fd5338cb7a481beb1a11e3c9425556b78bdd3d95dbe86ba83aa40a7b4c37e863eb4822ce87003ca505b3bbf284dee9bab989f4f6883730870297755ee8b7da366a2548129f3daccae8f65dde6130cfed50714482bec6a5267fd8e06ade53e1f7c71cb2909622118d12d8ab51b4e6b5cfde3aed4afc6ceb098590ab95a4f091de1d5774862c9116c634de9b7a4ad260d9c36367e4e61955cb1e51c9aabec32222fd0d66c4f0d50f384f9d2c71cf969e56c7820ad6bcfaff7e187dc2199733c788b1a7ceabe86bb7cf90848d78ce5f0765d3b1a939e5ea8cedf4e16bb08b86153b479986e9da07b2e3e89d08081e3cf65a83070b105c1a8a3e1c7f5dda5f33d7f73f3ebc5059e2ed49a7ed74bfaac80ae456aec54802a43021a2bc11067c0154d6170a6da570c407bc0139ea61e6cb7a9505e4a843efc94ac3370732529c3d08607d26b893e48eaf12e6a3d965eb844ab6d84817eead2b58ad919072535111b1e7091bb94d1785d98c7d6ce5939b164db69e3a5ac9841707156a7785fe1a9bdeed0202f7f75403b354014ba537e6be87b13b29df615a10657d39e2978777df516d862fd0935c2343ec7383c3df1995914896566e405c4304f8414beb6de00155da3f5560e2675347977a5fabb72b8fed82433bf6d824274047d721d8b7319ea4f48176975161e64d869599dca9f71e82d8d77aa27c34902dbdb95c540f5e6bb83367e4b883a97bf86ce80bf51fd482400e328115d7bb5c5996c7d668992b9f8d4f139d9c19d69b2554a90312d9f04af988af24b2c6cb701920c74f38c7acd1b5eaf5f83acf79b6bb161880b5ab4bdad2e2973580c8deef1256282871b5b93cab470a10139236c81772bf745ab4a8a8c93dc547b09535822d143188e731cb847a39fec109e2cac1bd0dc925690add03559777f7f97f2f848bb6ec77a98eefc1f4f1d7833c7e9e06da4d7497c0f9b746cda2dfcbb28e5a014ac3c554eea233fa8c596549e705636dd017d0ec9da05496d033142c9f5c4e525ccd2825f450a7bc6e0adab7c2236a3bed7425739c238992776857e85b7d6ab6b26cd75f449b6d19417fe53d3e925144c97c5be6cd24a6fcc17fb572ba747ea8fa11e9ab248c529b0af2b5012dfe42732cea1b554e37f833046101bdd7810363881a3614b39e6006864121350e8dcd7d5401bed0575603a32c38f1000897ea04f5d896755b15df23d211215386d9abcc39ba439ce81b7ec32102f6cf58163666e9b92fd17ad7b6fd7fe04732ed21593c3f2f4d1beacefd45197f1da704f8ac1485f415fb780647e664d3be2f8ade0dde977159c5dc95133977cc3aee71e9aaf6b46cdee6ea120a692ed7be9818c914348ec82fabe78ab880b12b94c0126b1d6a833a8e56eab83b3283d3360b24f46002a75e19ce5ddb0e2e6ea934b9191c33d0b92657bdfb1302db00fd97287cb7a1aea326f09a3e5d30ff62d8d6547e9ad5563c0ac84653ae25fbd600d4155421c7c540757095624f1c3f1d4e2dacd9522583ba030cf30c80d59c2786d8980e386851e91eb313beabbde2de5dbbc3b1431efb3b0d5d13e0b6c2bcd6931ca984b213e370dde38b942f9720310593372b423504630190ac3513bb0b13359f92e92fb25cbb93bc41ab6b21b0852f05faf8b991725d077e86e297a0b2300f7858777eaf672b9d74cba7c4e01ac8fc083ff869ce2035bf9aca7b96d1be8181dd4d80a7b1c16974e0399b93bbd3a6f31e6f2d4e4c4148bf5117dcb20e32bab0ec9da2dc2cda784c60f861c7bc91cafaca2f8b5378ebb893d5c25c4d9c0320452c7038b7230e1d2dbd17b6b25ad07edfc949b7d6b9ec71687ade3d7158bd58c821bd59e108a66d0df666e6a744f52eeb2d7472a3742493689b65e6090c8a4af806efd0448e13f8df77a81696124d057f6f331679ee1abdc17df7ae2bc4fe62c39bfa560387e77896f32b3786b2833b8b05d71e025b0df45a880718e7caa212e706c0366db561ef7e56dfe42d47c06d14f27614ec933a77f2a870e00b71a7f1a6641387c636e5741bd8d6dce63accea211080ef6183a440c112d0e087e7b32bea4f8e18a33507da795c82e6f959f3c178503664b70e9b7a98455b1052903bb4ed260b90878b8c7095da3ce6daf827b2d858f1964ff1b1ce8d48d9fea8ad2064892a540d99320f5d1259b2586f8714d05a349d5ae2aed77afc14a82ac11c89a73c77e213cb0a47b5a1136168f5f209e8ec883429764c8be1fb64e11e22dac8c864f75169d2a61b83ac36f841f5387a337fb21f0c031447394f9c72bc1972124b9ca8ebebb8279140ad5cbc54de2a27d7381719952c59c4f141dd46d95c82898410a15af9e6c89b8264efea573526e8f04094e0135bf17065fb7162", 0x1000, 0x47}, {&(0x7f0000000340)="7c3e7d592a05661b9dee5004ad6a1657a6c272f3d12fb88c9ea2105f07cb94320245f381234da7ff78a718b8bf227bd14ea798086b259196a1056d28600a39651614ca2e37daf1c73202166ab9e81ec522fae894ef1bbdd3868c28372a30cf6f45b71c4e4358f09edfc2761d6dc822bedcba67cff8ddd448292e0895ada8b5450ba3184c5b35af3be595c27dc6aba530600c530706b8f0147728adbad58a2b105550c4d841f3c5a9dab3a5c3939482", 0xaf, 0x81}, {&(0x7f0000003640)="ddf859c060efead72f113275f767532517e9f0f114e65fc2a4a498fabb8c992eac9c83eff8f670fb9dd2c6d2e8a7c4ee1e52b174b18514fe6e0b5b041dc9d6f463bf71e0f7306424a16ee950dda387f97207cfeeb579c47a9e97fb3ed622b392e09b5013a0a7c019df8d3a09e6fd663f3f22de9c65dfe9968d10394e0a2b668ec91aba00be7f58e886af96165f4a09bfdd6272811ad71e26f9518bbcd6a8bbfc39d9f4bccecd70e5fb076e046cc5f8a40d52774a47ab2031f3eaf7de611338778692ee616cfbe0c5f3e495e02b7bc3cda21cf080e6e40c6c53a71eb192b64601cc2049b0a3d23b2cbbec7de8e2429fcb0c9fda8513c6207a02071f51211bf26e57fb172eeee8a21cd7f11c72070bc803cdf2c9b3f4fd49cc86078c2e8aa0911441a1912c69f6f92bcdec59390e1cf58f20b68470782c1fe74729b3c237cac6e6c9e71b166b02eee7a4898e083b160bcb2ddef3f092163c6739e9a838ec4f60a16b84526c97a1647ca12fd8a99b927692bd0873892bba3cec72a37f7ce72dd6c3c2c8a6ef3ebfd9d05e29939e3df5829bb5b10bfa949e93b4d9f7159287c2aac38a4da8b82f1b879b6476aab5c23dc358ea89dea126e52416a76efb4033255197471db27f15dbde2376e66c1a2b0913b11f9e4bad83e8cd2f6d8bed0006bd1265d20f45518b204922801dd5558c837e7804e28a0398c2975d26a4816c04a015255735d605b6e23666311e5663a911bad230ce1884f710a67ed63ec1154fdc54f232d687765ba94355709e53e76439db77a9041f58d70e265a3820f360f2ff306cb8ce715afba33d75370c01f5b6fc74a1996faaaeaaeea7d0a60337e778cf5ce9c4869e54e07cee6c796b5fa0a04075788a5b766652f66408213a2a933535c0232e41f86b809cb5dabf39766824ab1cf515733d587552bd47dbba2eb06813eae65b2791022af8c33423c347f2360fbb1ccb5a3b5e31f496253260b580d775cfa4f43a9c7e49e7ff04a4e278e23d996490b926ba175eff716c33b03576459298dcccd99f092ddbd053de04a24c4b107df0c745915f28aa4642730bdaacfd477fb752f89f59d009a8936594a8ed31fd442277cf7f1db0d714295029fdb777e28940651f2f8580d8d699626c1fed9013a9f60f22566e5a681696fc8e50e59dab3ba897f3b4c22a133be247b509d5a391ca3d0b935484211b1e3f7c575e2210a86acb9db09d98964d0a7ec2c2753ff240d229db8d39925229497473059ae9403155b6191c88e05d4c2231f47b7438af2ac5e1dab3b170989f83fd0372fbad32ea91e6dc3189a85b633962d06ac369c773df17c44f1724196760fc1dcbfb344296b026a11ec6d3ff957038550a0950124e088dac67c4c73886d372a7245e5f0f145c26596016f8d738cfd095c64e726bc82d4d8ed7d433a7c08faa4bf4962a0ef6d4073d70fec17bb045abb91ec19ce9c19f6940309ac53ff51f500260d5dc1283948c402a4e94f88ffa8a10bc4329c08a93a8dfb0cdb36d4d0744254f6d25aaa2787c065473e28ea48b96b4d2e3dc681b243f8b22f64d85c2716187c8220e75b9b62272e1980a675882505ed2ba0734cb7b9b9ab63595a93dcce1bd84d7c51b473205ff6304953c957fb913c7ecff221ca8ffbb387460ee84a65a52e8db6638e0977daf4b0ead14d614bb090567b1aaa68c2a5587df34970234e06508513b38245ca39e63a3f7a107d3d9687c6c9b74b70e3b82188519ca649e92727f9d3e86d37237cea4d34464ee6092ab1e8c830a2c09729a96b88b4a957fab8ac377b68656ae88751fdaff2b6bf5b36d92e7cc3ac9139f6278ce2fb512d5780b6e9e9912b96593a4dcafe4ac3ffac3327a42127677144eb3fa41ad946afb2d3b453289bb59665f817eb9fb8f3ea1e649c79bb835289240c298b39c8cd5e7ffa28e7ee123e8d276382a7cc7562e56d6f630b5530bbadc2ef1f2ff49e27b82d2795b8a31eabd0be0bbca3cb56d80d62e4ddc7168d8c53e412756d15efe522b7b4763ac8aab5dc440f26ffb9f732967ed0f5cbd7ff8021da21004d02fc9331691126728785a14722adbf21f7681a181f6a2db48447c0b4e3730d8f6f521ea7c47de0266accdc96e28580af8e265ec96930de6b84d694bb44ceb80156be4e7eb6405a7cbbe6d9b12e5a3233f13ef84f750154d2d3f29666d73d78d44f3668b67137e69c62963eaf0b5bd284ccec5264a2a8214bfb1e71a4612fb69a4e86a80b1a1e791d95226d39e6daec9f319e5643a90f489b89e51e8a7f43755b161bc1fe9ecdadff2aaaf092fcfb0c0592f4cd280a01d642a68a3c35113a7d3f0bcbd767e5837cb0cc8d7a0461c584087f8d8dc06938ebd854bbb7d65ea90897daa0375c4fc7ebb011b0b514244969b39600389e9e04d2b3f15a6cf9d4f62e9bd8162e48beeb6316b3338af249084a90e38874b837563cd6f5c43d5b00de01088c9b34d833f7a7aa0638baf104e9a346d328aa0a48f0ecb0288c875c82960cd6be7660c46e87be94df02e00c86498f92d2942f9a3f5696c587565fac6676d8358d61623645d596789656386090bd77a84e5fb3a65cf90eb053be1722673cd4242163264b8bdaa20534584595215b6cead08d6cb135dc07414e47f3045380467543eae650fc4546b3f3ff400711c141154dcccb1d2567ec2ac2c73c2a992487ef00e41224a8c0fbbfd3c210857f6f057b79dfbb73ab1d37ade8240ebeef9179aed1b62d40a41d9c14640a422dde7684a840ce9a45b0dc41a7337439d9104dc4a37c535eb888b6ecc0d63fd7946d57adfb014afb8bb821e6c8577ee14de158283f3f0b30a1dfdd0edff591a4eb56cd71dc6f6498a7cd11bece37929c9f137a46c936b85b51cecf2bb55ade68db6bb995c6cde11cdfa5645396846f24ca3d9686829f65d588ab55d91e5b28ad824a15a8cf9da78981a0738a1ab0671b1bd3ae4ce70a6d0778243d2f697d204509a7f7ec625a802c8f8c5a3636ebd9039a63d95cc3a92f0c22f18048b33827f9116e85c437b44c3a5b6251281aa69a5627448a95905bb6834c451c045ec0f17647766ba944db6358c4ccca0ce6de557681a525f9540211dac592243adcc0455de599dc30ab3d37f9d64fecb916098284b17143d19ab402bd29136edb6c42340736d41c535798498b68ca5ef9934b0264f8ceea86a9b6e8a2d10f24e2b345d17343136550a7ccccdba9dacbb5639bbd7803846f555c7ca6b0e87fb8c1d07eeca6b0e87d2decc97f56e956a1832d1fc7d84dc19a457ddcfc39cbcb087b16da0f517dc278277a0b041e0cdee83ccee29883be505b2e256ad28fcd89582d90536b581ff586f5200fa477506900fd47e6048cd7afa4ce9ae8bb448b174aef1539cbd599e3e37c3f57c8b93b798855d01987d46f9836bb41a92672702108d9be70eefaf6e4cc32e3e00f6cd03543cc580cd823dd745a9fdab7f1aed49f7edf413f23eaa7ed1200d9d17ec310a199658914c349b165e04184961398f62b96a0bd154999a672c2692f678f2fe290ff899e238e6ea05b6c0b544bba6e2429b61ecd655b97e467c455f079626c4dfe36c2cad7549052e48d14325dfa0d7fc766d0196ddddb468a1907a61b06fc71b4b1600544b8c5c6fead10aa402827df904362696cf75c45a57f8556c8c877e1eda1c0d285bb4d42c5fab756854bb5fde9edc822508773ea7bc2279d89f38a4cdf38166532e00a7b9a4c402be85b06362f94c658265edfe891456b9c7bf59ae9ef7ad163846e8613207a660ba52d41649142a6a108b71a1e7530f658f922b822f3bb238a258bfade9521a33d40f777811d64ad397851e1cbc550ccea5ad4812b3ec5a5bb1a42ce5e7139d5a9f8ed91c490ea5c9db11dd4a8373a1805c0c07f0b5743b157477b70de311852b4e5facb74fe955e4a9f99c5d51c04b0e6b7a47f3afe369ced22ebed4d1a511868125437fe7229139300353a2a2f2538417a57c04d6c708ce9abf28f5c9a5ba3cba8d8300fd0901da2495bffa9d34204b8f3cb80e22e99d6ad7bd1e02b202c194c3f6ba98716d05516b3f90e60b82692841360f580c99f4153dfd89b0849d12e94444adbfa05a1189541d990e2f8b82919ab3f346ce7a2c1d6100eaca172d6c34888a5b155f26a81bb72e5dc589b57f4711fc33a204cce1199398c756a79a366513b78f0317b215b76f58dabe0558a41b2e1c847e0921aac933df539917093eba5a59f6f98662deaef76ffdca231fd793d72a2291b4ce6ca6625857d6cdef27bc12c4340a00421023236426255aa63fc42b442db00c8baed5b22c3774a3fabdf68d866790ea9cd77cc011d83ca6f1b2af9d6e574d987d7a2285659e6a00a70a9ce65035debe41d2d92233599021ef38b1b4ad8bac10f6a3e4130a7fc5b15eea6506351efbaa83d674c0913b657ef862c92ae9bb997cde99b3c6b444bf2fdcc68f07e10d0bce799b8af21bb1f1511417739ab30bc90ab65b65d5e17909f9009626931d30ed4a04a1c2edd6c444210f82d8c010097af07b34d0776c028a24352be79ccc5b1240e04f07210bd66f13c9140f054b5c5cf6991869e66fff9363ca5b62a0de80e77755862d2f21dedcad6ec20579b40895f1347916f4dfd030d2ca7f91e6ab406ca6df397c32d3fa3f2add55b64f3d466346b27bb27ce311107874da14d3a3bc3e86565f465bd148f4c9afc963a4d6991b7d45f78820ecf6c050434c513e778aa05c3e46553363b022dda22766a9ee41ea53f9564750da413ca1a61a86106164da9565db4cdeb067d086fc6c55df4e29cdde1352a8a27e650c0a907ee4ef6e68a2bc0d17cab71a56e7b18261dd3483e6e4d3d647354a1b107a970c50d2011db309d20c917ffb95dc173e194c25624b2c53d6e86f787f0bd87746e3a445cf7ba87ae7f6cd9f0f07520d0d8e5d6d1dab2468ac35f68c04abbc5a0c25b35853b30bfcb708226d86807e2e1fe55bf61594244e61a373e82d19ebf50919a24b90d5ca67bb9950304452a559e65112908d1a4e453887f8cc15f929a1da6043686ede405e165c6aeb0a56a216691c8f08305821c56031209326ae6a5ffd076924bc9acf1f7d5cf3eff71eb719df27d7247c60083f6fc8e4a8ae8b3a7d12055e3a2bddf8412d631d7aab77ff9be3e16b46ca3d117066443b8e7816240bcb44f3fadc47de1369b59012b97abb0bfebd401c5346bb0120372f9d2f5585578fbb1f482e6961a525a6b06a69a3ac3169cfbd057f8dc9c4ff75f1a4897a5a8d76287f525b8047d6d6ad5c2f09bb71576fa9acce2f8a15245881aa945454c681e9d31d644f2bb7f3e247c0e9a7b59c0d6f24994d0b5e7c15b2126df74f0089772fb50cee1346826f53036660bef25d0d058cf1635b9a50bbe3f069c79c46ddc98e1139ae5ce92c8e26888f1ad7ec683c6bee7048b4ca3b37f72fc5505a0ae905e0c47f30e7b03f981be65e50b4048a17cdc00de3d8c52fc054f672e8cfc84f89e45eb9bdcfbdccaf1ea845167ba8ca655b67bcad7771413ff3a816995ebc87780fbef63fe9867c98c7c58b965fc10aedba94a797d075635c58613eb1ffaf3a0b4f4b0e7e93dde71840678d6301df7863fab622c8366f54b49f7ced0144aadf4ed88455ce66e4685f29dbc2d055f14be089e37e5fa1844e25ea2955feae6fc87be8ee8e9b3d982dd131704b61aeaa3b78044bb052e736108ac92a7d0a04b830331ac0f69b6bbf674e224492698c2b18c7917bdb6e3a3f995958c27be66c9769a4f0a9d2c1df031438b1b09079ceef54ea58eb", 0x1000, 0x4d5a72c1}, {&(0x7f0000000400)="934775621e46c3fbbfc6f23f199d4cd0d93908eb3bbb95c40cffa13c8fce8c6aa0f99431700b9eb8a22deb5aa427b73a742135dbf6ee47d81d02053617745a10a54aa4c69ed02a8bb8d0579b5e9421ef00d3f0949fc627970a4cdcc9e859b144c92108f524b86432a095e0b84c5136d0b6c91a33266f8bdf9b1d56e024103bef3c5d8a6958f04da62fb08118bcf798784446c32f43cb200b7854cea464693be679fc16257dde5aa67f97b8db7a3b0e796a7bc738280ae1e2f89a4e09610e7ab63402cb3324", 0xc5, 0x756}], 0x10004, &(0x7f0000000140)='batadv\x00') [ 191.531818] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 191.555266] ubi0: background thread "ubi_bgt0d" started, PID 10373 [ 191.567963] ubi0: detaching mtd0 [ 191.578850] ubi0: mtd0 is detached [ 191.587292] ubi0: attaching mtd0 05:02:38 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 191.632994] ubi0: scanning is finished 05:02:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) msgget$private(0x0, 0x2ac) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c00007a25a6bae29a", @ANYRES16=r1, @ANYBLOB="b72300000000000001000000000000000300", @ANYRES32=r1, @ANYRES64=r1], 0x1c}}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r5, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x60, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1000}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xbc06}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r8}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x11) [ 191.840482] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 191.853626] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 191.862990] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 191.883614] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 191.892769] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 191.904666] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 191.911405] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 191.920121] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 191.930393] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 191.940680] ubi0: background thread "ubi_bgt0d" started, PID 10403 [ 191.954210] ubi0: detaching mtd0 [ 191.961818] ubi0: mtd0 is detached [ 191.971361] ubi0: attaching mtd0 05:02:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r3 = msgget$private(0x0, 0x0) msgrcv(r3, &(0x7f0000000040)={0x0, ""/135}, 0xffffff1c, 0x0, 0x0) msgsnd(r3, &(0x7f0000000200)=ANY=[@ANYBLOB='?'], 0x2000, 0x0) msgctl$IPC_SET(r3, 0x1, &(0x7f00000003c0)={{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffb}) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000240)=""/165) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}}, 0x0) 05:02:39 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 191.995361] ubi0: scanning is finished 05:02:39 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 192.090696] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 192.102523] ubi0: attaching mtd0 [ 192.110158] ubi0: scanning is finished [ 192.200756] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 192.247161] ubi0: attaching mtd0 05:02:39 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 192.297829] ubi0: scanning is finished [ 192.501852] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 192.529414] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 192.550640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 192.562465] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 192.569545] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 192.575692] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 192.587600] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:39 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 192.601097] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 192.612215] ubi0: background thread "ubi_bgt0d" started, PID 10447 [ 192.619070] ubi0: detaching mtd0 [ 192.637078] ubi0: mtd0 is detached [ 192.641152] ubi0: attaching mtd0 [ 192.675229] ubi0: scanning is finished [ 192.840293] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 192.856058] ubi0: attaching mtd0 05:02:40 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 192.893748] ubi0: scanning is finished [ 192.990413] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 193.017202] ubi0: attaching mtd0 [ 193.052524] ubi0: scanning is finished 05:02:40 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:40 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 193.168875] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 193.190119] ubi0: attaching mtd0 [ 193.254071] ubi0: scanning is finished [ 193.414535] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 193.435172] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 193.454001] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 193.471796] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 193.489597] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 193.497969] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 193.505436] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:40 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 193.515796] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 193.525626] ubi0: background thread "ubi_bgt0d" started, PID 10488 [ 193.532635] ubi0: detaching mtd0 [ 193.539075] ubi0: mtd0 is detached [ 193.545579] ubi0: attaching mtd0 [ 193.589689] ubi0: scanning is finished [ 193.754463] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 193.780503] ubi0: attaching mtd0 05:02:41 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 193.813810] ubi0: scanning is finished 05:02:41 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 193.938945] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 193.962100] ubi0: attaching mtd0 [ 194.016843] ubi0: scanning is finished 05:02:41 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 194.122836] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 194.142299] ubi0: attaching mtd0 [ 194.188372] ubi0: scanning is finished [ 194.339306] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 194.352050] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 194.366055] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 194.385486] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 194.404122] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 194.421030] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 194.442043] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 194.452643] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 194.476395] ubi0: background thread "ubi_bgt0d" started, PID 10531 [ 194.482840] ubi0: detaching mtd0 [ 194.490684] ubi0: mtd0 is detached [ 194.497385] ubi0: attaching mtd0 05:02:41 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 194.532785] ubi0: scanning is finished [ 194.673017] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 194.699871] ubi0: attaching mtd0 05:02:42 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:42 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="2000000047114e3d0ad7d5f7dc3d9950779a99f4ba4df3285232", @ANYRES16=r3, @ANYBLOB="01000000000000000000140000000c0007800800020000f00000"], 0x20}}, 0x0) sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[], 0x1a4}, 0x1, 0x0, 0x0, 0x15}, 0x0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x5, 0x0, 0x10003, 0x9}) r5 = dup(0xffffffffffffffff) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x20, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf000}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_BEARER_GET(r5, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000580)={0x194, r7, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xa8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x9, @private1={0xfc, 0x1, [], 0x1}, 0xfffffe01}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x400, @ipv4={[], [], @private=0xa010101}, 0x4}}}}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'veth0_to_batadv\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}]}, @TIPC_NLA_MEDIA={0xb4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x49}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80000000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xff}]}]}, 0x194}}, 0x40000) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f00000004c0)={0x0, @bt={0x20, 0x4, 0x0, 0x0, 0x5, 0x1, 0x1f4, 0x7fff, 0x6, 0xd3b9, 0x4, 0x9, 0x1, 0x3800, 0x0, 0x10, {0xff, 0x7}, 0x7, 0xe0}}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0xdb8, r4, 0x10000, 0x4}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f0000000000)) [ 194.744735] ubi0: scanning is finished 05:02:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x4, 0x10000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:42 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 194.872622] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 194.896635] ubi0: attaching mtd0 05:02:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000080), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x100a, 0x0, 0x7ff, 0x8e5}) [ 194.953777] ubi0: scanning is finished 05:02:42 executing program 3: mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, &(0x7f0000000180), 0x5, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f0000000100)) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = openat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) dup2(r0, r5) 05:02:42 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 195.084766] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 195.107185] ubi0: attaching mtd0 [ 195.155754] ubi0: scanning is finished 05:02:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x0, 0x0, 0x3}) 05:02:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x4, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x2, &(0x7f0000000140)=[0x7ff, 0x7, 0xea]}) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r3, 0xffffffffffffffa3, &(0x7f0000000200)=""/78) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000040)={0x5}, 0x1) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000280)={0x60, 0x784, 0x640, 0x240, 0x9, 0x4, 0x8, 0x2, {0x8, 0x3}, {0x7, 0x1}, {0x3, 0x4}, {0x6, 0x8, 0x1}, 0x0, 0x80, 0x6, 0x2, 0x1, 0x4, 0x4, 0x4, 0xb02c, 0xfffffffb, 0x8001, 0x3, 0x11, 0x0, 0x0, 0xb}) ioctl$UI_BEGIN_FF_ERASE(r2, 0xc00c55ca, &(0x7f0000000100)={0x10, 0xfffffff7, 0x6}) 05:02:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socket$alg(0x26, 0x5, 0x0) 05:02:42 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 195.385455] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 195.409584] ubi0: attaching mtd0 05:02:42 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$vim2m_VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000080)={0x3, @sdr={0x47425247, 0x4}}) r2 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000000)) [ 195.472206] ubi0: scanning is finished [ 195.612658] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 195.632403] ubi0: attaching mtd0 [ 195.663604] ubi0: scanning is finished 05:02:43 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r2, 0x40045731, &(0x7f0000000340)=0x12000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz1\x00', 0x1ff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$NFQNL_MSG_VERDICT_BATCH(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, 0x3, 0x3, 0xa03, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x80}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0x1f}}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffc, 0x20}}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x94) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000080)=0x2, 0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)={&(0x7f0000000100)='./file0\x00', 0x0, 0x8}, 0x10) 05:02:43 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 195.805459] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 195.838688] ubi0: attaching mtd0 [ 195.883554] ubi0: scanning is finished [ 196.006267] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 196.030262] ubi0: attaching mtd0 05:02:43 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 196.072977] ubi0: scanning is finished [ 196.218780] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 196.230367] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 196.238640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 196.245060] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 196.252271] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 196.259376] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 196.267382] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 196.279030] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 196.289828] ubi0: background thread "ubi_bgt0d" started, PID 10645 [ 196.296376] ubi0: detaching mtd0 [ 196.310582] ubi0: mtd0 is detached 05:02:43 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 196.317063] ubi0: attaching mtd0 [ 196.362016] ubi0: scanning is finished 05:02:43 executing program 3: dup(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000080)) r2 = creat(&(0x7f0000004e40)='./file0\x00', 0x3) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r5}}) r6 = getgid() sendmsg$netlink(0xffffffffffffffff, &(0x7f0000004fc0)={&(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbff, 0x40000}, 0xc, &(0x7f0000004bc0)=[{&(0x7f0000000100)={0x1588, 0x27, 0x10, 0x70bd2d, 0x25dfdbfc, "", [@nested={0x1319, 0x3c, 0x0, 0x1, [@generic="da1dbc9e62075b5449a34d3c90b9f3474fa2bd75f1290297503cd2945657bc987b904285c97c3d379fd3e5902658b3d4d703f6d1b16107c3d12a3cf613c05f20317d9df402f522fba8e51b4989946bd7efbb98ff10cf3e9cda5f939d3570c5ab", @generic="375d4dd17fdcf6a70df036fb604bbcc7b789a1286dd3b73ebfa29164e02cfdd94f99b899131be64f499812678a31cf6ee03f237eafc09ed9fed9408a9c42b7825080dd214ff469533f8d07fbdad310da54bc747d4b108b867dddce682c2c220a1e72dba97fb3aa634ded051f58f645daed74f986c1a8f784fb6c0e54dce5b5f9744b577e784a8fe7c924682833d747032bfd38d543161b092c63bdb709b2449513d5daa7bb86d3f8ea", @typed={0xcb, 0x5, 0x0, 0x0, @binary="6cf31534fe88aa9294bcfb33472f9abbaaf2e144d841773f80bdcd3f9c6380c93dcbd189482420792f386c94f8807f56c2cd6e551983b59e0c9ac5450a7099fe1b9a3c46dd57f2d1a71c797f1e865fc6e4a289d4fcf91bd807ef21ce92d69d76988cfaa71afd7699c230c69d53f4655aabaa7ffe6a7c48ddeae60765e831475fb282fdc8175450c2610d2dabef73afb503598a6fb2fddb7c97e384b0015908ad1df3680b18b1549b38bd741bfda9a3af1e2c74781554bc4fe6f534ef2d07a2b8bd633e2b83446e"}, @generic="bb6156a1370d45211670293c7858f24f0a3360eec25f183e951653377929e739068f00abb00648910ca2988e2a4bd5ea616cc7490fb08f5744ea6c8596e7e8e98b49f38efc01f279ab595114", @typed={0x14, 0x4e, 0x0, 0x0, @ipv6=@private1={0xfc, 0x1, [], 0x1}}, @generic="538b78a30ee0404c4ff8f9eba1e670ecac4c15e390bbc939274d65c4e3a169d6cdffd09e427364926ba9211eaf03b637e02cb89196694a75ea4bd00d3d497d1d21ffced24e9cb80277fe5bb83785e7a193beca9c7a5b88db095a0a2def45cecc865c822c3f7efa0c3d7b2e0f8a1597f7c0df78a966b1401ae2fed2d9e4a3c501584214129f580075febd261776665deb170a7a35e94cc044cda7c71abd9f0dacd63debce9fd9d11eb474cb6b22f57a36e785acb2b2e1bec8d9cf705a27c94201ed1f3a70e96311cee55cb751a08b312de417f939cebb9849bdb193e01f72ac5c9d94779ce1b15f845ce26f4cf1ea13f76d01ce873e070e10e4f2e79f08942271e8d859edc01e0efedfdcb126301eb046e710428255537554212a9fb47174de5a3088b312f16a855da1283e2d30d6b79dd455aa6233fe6f97d99a43dcc8a2e4fb1022a3f812543689114ecb994a081b07654520480187084cfaf87eb17b05f43dbb167468a91420cde579f408488a8114a9dd4f53d45cf87a2bc3daf4f32c9f6cf3b9fb50b155d30eadb89b4871719e6c1c56b8add4d01e9dc8f32280c221e65b559352571fd054252dffef26cd409cd5c32b8ead30ac067d0d2723816f7b7fe9e9e561284996656fc932d81e771b324e1a9f74d5a8a7d82ccc8fff6770cc00aa4339d4491fc3ef8876c4534c9e82b0d7e0e20380001e26b1d11843c5ee29f758198371f8c4b65f005fef25488dcbf33aaf7eefad243948f638e66bb2d1e025f9d8f4b2db11809e4b3e829667fd81246eb17473209788526e462d7231bc2dd7a9177faefc77cf970901005948167066552cca0a7a02e537d965f568ce40658c6e92dee82e2842d35845f4e41f97ebf2a089d0fa0424724e481b4b3ed7aab2604e147a7c91c738ef63234ce18af7aa647f98ab4b91b9fbcbbd5a7ec5d892ee8fc06beb2907498cd3969b23ac5a06a9c2791a1f30ccb2a7ab5d80382cde6b9c0c22324658ce2c2ab944f83c37ae96067240c9618fc7da89b1476d9b0cbdc13c1c8a902eb1142da91dd7eaf2a776cecdb718b4bd6ebe95df08bd303ddf11ebab2e8715cbb1a35ad13dda269c8365ba685fdfdec53624d9827e38d0cf494d12d0cde159eaeed91136082e52f0380b3d030e0911d22d8097aac95cfdd263b6daa9dec202281154d2f70cae50b579641ccf2545aae607ec0385df7bfbe99f62dd38e24e2e86b7ca9910e417b5161b98edf0ac737ed5613e829e96f583e4a85594764522293de2eb6faad0f07159786fad615035a4bfdcb09036d0c9fd6728aa2cdca674a23ca35de5f084dd0c251810e1aef6f5058c332a8e52d9cd8e1ad52760fae67d908e88dae1d37591d774417568edb1b500819a2c2b24a4e407d2312bda367265f9c4b2401dad985e0009e47d2f60a939e149dc86e44b46e5ca0c736997b5290dab06158d8eea0535bd1f64ac518881f2b3a379e14f604e4b024a1df2e13a5248c43fed7fba3ff2486ba8edc168441ee781cdbf9780ea63d4bd5257a8d83eae5243e51b4d4487324020511e01388a81bea406a91173f8a8ddc7947b678d14283ec91cdecba262863e6a21312d2dd17292cc1d33dc04e1071cfd21c8ed7912e9846831b172be20ead5781a4ca5d7b9e4f6979c5d7a73c118171de38a349d850b68b552bb547f2840d2c957b03f1b9231d33eadb6a6431ccaead274f458756e1c88d3eebb5c6c61ab1ec272396d12529a704d8a93ad4d2f1b90dc164beb27c93cc52f7d1361651a87c830e95d29d63fb60b1144556c3ce96bf2dcc5e2776cbe2015240a502613b7e1e20976677913592e432ddcd2c7353947856de9fdcf485dabb3380b72a50c09a446873af8b4f9537a1baa5307c7096b8760e37765affd85ceaf1632e1ec409ec14dc664c825769056620fb1a3b12d4c44627d00620aad6712968955a903e3b0d3cf794afa36d0edf30603ff40b74e219b560eb46e43fdfab2cc7cbbf645120c0f590c352d06f1881cfa5695b2481c877de7a8dbd0264fb57be71fa8f02f72807069cc9647a604c2cab64ebc3ebfd95ea33cbb68b98d77fde15f59f6774fb727338000ee0de14821e29b5e352d3dfb03572e036ac8cee35775c3ad307502571d1f8ce95586f94d78ffe0850c2da39835e3853059948a057cb35847b5a23b5cc1c67718f4d5c42562b326a15834df78ec856ffcde9dc873fad7bfd1b6b7b49aabca1ff9ae5f66bcfa13ac35d3379dc9b0eeac19b965d3ea6cb874e05c942475a2c98769c8f49410a7beb0f8f2b9c63887838c5a3ace60da9f9e0268243f329b32820181e1acb3932f5ac5390237f96432fcd619973ddb702236b746f07efaf6406a06fffc75d7881ce233993b53772f76e1cdac64de05459fda5fe072e3f6cf4fc89d38c7dd09b1d07320edc8ba64281a5d37fd47fed5ba2c0093d22c87e121609d0e5dec95e65fea8fae7c8dd37c31be4431a1c9db86f432a54acc0fa7ec5ee5d9cf4950109f87c84e0c5f0baae9c36f343c70748a237e59e0b4324160acccd807acdce098af1d364ff205fd5be65826ab99ec0c4d4b3242eb87155cb5a141230b47e2364bb01a0d6b2549656304e3b63ba736459a8630f8c0432948349db850781f9676e23b12a177c9b936c8d10de194a64d4c3f615331bce3ba4918cc7e196a8c02c1b3e2b909e2ccdf3bec746be3b8efeb7fb1f5113ee292d1aba8430209798410114c372eeb3ee00b4db888657da04d7d65ac735c57cbf8667b289415f1c3a832758a54969c01e9118424114314b1459d9bd18b70c467fd7697cc9e15fce9d782f87ecfc2ae32049212e4d503bdb6acc2cc3093e111b60c6a73d2e68940185167ced0cd0e112dfce07e57c473dbcd81ab1977605403b06db5503a1c6933d801d3b81b8ee6490f2f7171003a0b6f14c315956e0fadfe95a9e87d4d130e8ca6ac87f9ee956c14dd49bc4299b0a598520fb2aa052f0790d11955bf67ba22034225fcbc3ee8ff2fd8454f57ecccd29bd5a9782a01e7b7c5f9be7f5c712592d459ac9b221064c306575d3cef2891b90389676ba08926dd90c8b48296f087203603b19e4ae56def24eb1865094971f4f1b6933d75e437a4e75f1e3d9f722e2a2f050a1572f9bd1a1b07c4ea2041601c997d1de200d565f3349e6a0e50b6bf44c51533274a4f64baca8aa000ae9030d111d2036ec0d3eef2f86578f5110ddb166dc3b6a938a3b8afc4455047bdea025c6a0ec4b545d4156ce9710d6fc37527143b79064888222831c8249e3670b56337c76bd649d28dd6bae7dde25bf953229aa97e72afab7bcdfa3dad1237bbfa7fd152bd48756380e2c8125eaa59642ef7967e689b60c2498cf7559d312400a92b2a5640b39986dfbd41dfe30b87b004b8a4da48b18a11da1e1d07b8ffbcda42ca4b3e6e45b9e86e43a6af8d6dbaf1916ab5c54b6c9db650a43448b51219e69ad33d5bde39f739d11566b06714609aa601c16d104c0a1fb1f6d81bb118550670800fbfd6525655d34deed6fec10d03ecbf7a862580df95e38f6ed6007ea6fbc522a3fcb501b2d94060a39d5d5b4ca8f1933a4a95e214baf702d930d971c6ae9a7259b6bb411b55ab000f7bbcaccb7052fff31f13403a3f996bb16ed3829193d4b93bc68117a21a1393ec98c59a35030fca5f219eedcec7a15084eceb70f540ce56df5155413fe03e5ddfb049178509a283bfe9a3241746318ff4f50f3f29b129a2d364ff13b5d7239e90a8c352815f1d125f0358146bb414c607510e557c88eb0f28b99d5e47f921871cb3b1a07d0aed5056f2eaf63fa77eda5784f949af53a1360207d4fe16a2e5583506610bd181a1bcd78080daf53621d0453ef5b76c4d67799d971689770b0669bcd1da3074c62b0355686c717567ba975346343ab13694a5c304ed902168bcc020378b83149682e558a6ae544b984630858eb5c3659619e584f0ded358f8f19be9384f171139dcc4a25ec0d1b31512c51b173fa7cc0dd06e98703cf5410fa48d9f50d9e2d24853187f51f9a962f17ecd5d7739c648c534e0dc31240cada2b69349ea65e082021be4c4a307fe79e399ee21250191d5700cfeeecdae5969ec5c9d7865037e029fd83dde4c6a489bd8ff5466b446fac337c255dacad9a1e6f88aceade5336a4ecfab85b9a62c4d09c3c61bc4cac6e85c7789bfa3143b605ac08a47edb62f52aede4b37b46aa334c1602fddaed237860b7aadcb1317331a61d5f462b0294a7d6870060b54e649a09a5129247074d1970bb6917741c3ae255ae3aa6046e0b3ee2b42a0496a0f708b47710df109d549a46aaf6ac04136dfa58d1daeade0eda3165d0b97db53953de8f209efc9b79b51a51d82b9ec8378b017268762019c1ad84dabb8cd4bf5bef11b8b249e1364a0ce7fdd986af6153452ac82a252226abbd2856e3a586e2b721439c7a5a48fc4225b2b8e1c74749b7fe4225424e3a86aded1cd01276fff1d010ee89803570d0c4be79512d758130360630c62af6becec2c4f7bfdd201217778b8a86988480fbb985528aa1c268ad70fe76b2d4820a6cc0de14bf2fefa49a8473852a68b4f7f3cfdf55803d7811e9bb47d590ce4fec0867125b9e5298d0dce6b2b9ecf759bfbb3bf7ec60553802ec5f1449099bbd846d821154ea2f807e7692bb9eecdd9be02e53f2a6342cd78a3513f0d872e2dca42f76be11b260b6b4241c211d5dcafedf3ecd6a50f63c5853573691eb4f3f872ab9b92cbc56b48850e55efea257fe01fb547d1548a843f5e9050e24f128448e5be4bef24e316607dc29dc3899e44c9d3d7b0207e371c8820dc5f09456c32b9408ec814396c656be017d25c51983767eaffc0a9869edad29608705af74ff83d91f75ee52dbadd65f0d764fd0ac5fee17dc86325f3984131b3dd539c85654b1f1c91f92078d72ac501ea2ede0d614ec73742cbcd9eb6bcfefde81757a0a23e0229c8e4407bf8f7db145f6a06fd19310c386574cc6ce8f0a87e67d8a80d12975a4448e0e72acc96b0d939d5f13f4e5360d69c109e0a71c52cb8abfba58c13ae5820acb91492d8418d052d0df574cfe75d0a78142ef1ed95d3d67f5974dc72abd0129e1c36530d806ad1d91bbc09b9051c1de31f6d2ad67cfcbfc7d1041545092a416596fbbf80cc2589c8a0c06e96849239ef9494948e928121bef97d6917bbf377b3c55436dc43b36473729cf237762183f8291ab957ee1e57648f8273771f9a68871999f73157a71d8bc7617683749751f5972d640b52475c050cb7a98d685003e88336ab61d399a0de4f67d54d0aefafe0b4544c07f49f3a9d6a120162853270a1219d9aa0de2bfe1bea254039a696103514ccd58ed04fee17c0ce135fc99cf82592c44869bbf1c9f5df9051769ae069ffe1360fd4e9bc3bb048bd5c6d967406a3aaf1eafc70c07661f334f7329efed75da9af6d95afc2aca1e18b4e80b3e61d90ea39e7d71622e1a4eb8513abe846ccc65d9bfc5961009996ca604da374dd63f50535bbcdcf84e429f28bf2e21ec72c27a5c15e024e44c8db08ad489cc34ed5315a76afba99fec362810a5245c6a8e7638a6a649aa1c8e9d7dc9050e530e9cd1f8bf5df259f732dad5479a8f3583f4fb0586e237b71b5386d6e1673fbcb59559ce4bc107b6bd00afac99555ee573b28b408026ec7eaf376ffe894d307064b7e78f5eec1b172d5b60cf9bbaa39c97031304ba73c757274346f75e2753877378d6f1a4286b3f4c0275315ca94124146645c4a855d899b6ecf1c9165f69c96b6716220590e3a", @generic="698f561eab34ceb6d27049a8a6fa6da88eb894d73635c7c7bb9d24a76470c42217a7dfa57f8cec4c925d5622d7809589b94df897aa062c8fadad8767930a3a3a6e870aaea0034b7a73940fa681f9882fdfcf7f9ea13b3f73e63b379aa0905371d6d07d7c2ffacec6e95f4c63458e6f7d1cd75d7dfe16d8470499de78e40472a10494e64a55024dcded8cb6cb5c225f3bfeb169beb11d9aa4e6ab18eeefa1fa7ed82edcadf78d05", @generic="784aa3fc8d8f047733ac10e1ceefee093edfb27b4e67e89bdacc4a298944a792af45afd0ca39468f6d33cad332f74ac942", @typed={0x8, 0x30, 0x0, 0x0, @pid}]}, @generic="983a17ba08468c38ec2730a4cff99369339cf4a167d16cd5d7814a3d35b9bfd2110c3e9ebf2c7e92f546b48057b74642f8458f665ebb81cbc1032cd5c70d1cf938cbdcb6c0b44c6e73b215e7558f3c127fd645a29f2d54b7925f313333dff76230c3c5bf8c0b2ee7289f7aa2e643452e8daa486c077098d39f3a0f75f58b49114cb98af3539e6d46abd79c36f4f0bf273addc0765dbc819c15dd900a17587e81a26d7a521626755558a4fac3100f0283d728efb3f66c061d35e251c02eef090dd963b582bfbdb71ff7d2e321db49835c9d97d001", @typed={0x59, 0x1b, 0x0, 0x0, @binary="685349655c0059a5ad58a1bbe774948d450ba9e073e52bc548e2b3fa24d304081b9838c55c17ccea15e487efa1cfe195fa955d50187d3365f330b69e10de455f7c024e4a90878d8de0e66bc98638c706740f654d10"}, @nested={0x73, 0x1f, 0x0, 0x1, [@typed={0x8, 0xe, 0x0, 0x0, @pid=0xffffffffffffffff}, @generic="bcea79fe304587ab317d9a1764094013837d2222b2fc29a3e7025b6d885aa98f4514e28514b3288e08bef0bfc546a87cebf8700b89a79418bbdefad2e592ab4b074599e20cb367eda78fb534e2e43a0b1d0379c6df0d8d908e06938260973ffcaf7dbc26668e21"]}, @nested={0xb8, 0x20, 0x0, 0x1, [@typed={0xa4, 0x77, 0x0, 0x0, @binary="ef8d9f655765ff52d7e89f37d358d81789d425f92853cd37c523b47e345cb75329f64b696a72fb276e87141ab00b7d7feb4acdf7a47f8f195c091dfabc4c56eab1480b076bd7e039e1c79c656ed234e50c3e02319b14da23ce6d462e39c5a5d9f0a8c8a6d1babf2e859e785a888fa14d9a1ff92ded533343dca6437104f805e443a82ec85467cb3e09cf541bb91de19d759a751b53e31b1ecd29d8f0dece713b"}, @generic="c75f586c", @typed={0xc, 0x7c, 0x0, 0x0, @u64=0x6}]}]}, 0x1588}, {&(0x7f0000001700)={0x4d0, 0x3c, 0x200, 0x70bd26, 0x25dfdbfe, "", [@typed={0x8, 0x5b, 0x0, 0x0, @u32=0x9}, @typed={0x8, 0x13, 0x0, 0x0, @u32=0x1ff}, @typed={0x5, 0x33, 0x0, 0x0, @str='\x00'}, @nested={0x5b, 0x14, 0x0, 0x1, [@typed={0x8, 0x55, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x29}}, @generic="1da23620a1d70a69506ca1c10e6cbf387e8998f1d8fa31765751eb2c87d04f474c122bd42001d9aa6fff2bfe3dbb01142a4af90306a335131e22126668cf527255696783a218ef3e4da9214b7f1260"]}, @typed={0x14, 0x61, 0x0, 0x0, @ipv6=@private0={0xfc, 0x0, [], 0x1}}, @generic="fab36a4c522eab9f36b0b3b23fed8e17a8804714d1bcde081d505bd0c0860ebd03a4cbeb3328dfa582022904a6473c75b4da0211d1c810bb0248eac216ecc5c358483ffa3f411bb6a75733f40e9976019b0438b88ac6be4821f807953a611423bc6ebf9fe7aa2362ebf21bbf54aeb8fb0b3b07d40b133537dc0eaab16aa5578e4160010f86376a032d0bc66481c69eda022aaa120ee9aeb64f5627e4fa32af5172c588cdc3e4dcad303cb42438a1a94d1b1e7e35d24d5aabd1f5e4809bef0a48", @nested={0x136, 0x4, 0x0, 0x1, [@typed={0xed, 0x20, 0x0, 0x0, @binary="b4611d51db1e2c0939184b6534a0947626d49dc43bf642e68ab6139347a680e7fe88c218654e8596fb06a9a3824f92ef5bfb3693d00b4287b4a82bd294a32e1aca110d09e598bf7eefc0b3bd5b6ae23e030c42e2f634c1684eb58ebd63fa71d1a1392d11a3779fc6406a62070d46ed770c82bffb4dce06bf1a8e18c0137e030e963670c439d16aa80e91547e1f5686b49eaf27ef6943136fd72a0ec0361ff853651f18e03215ec0987f38098046ab1d70da0bf2a5c01d0ec6dcacc318547e31cfcf854b4c677f71ba5b899bc852b49aad92823cc2c7fb70a6ba1eeeffa36c782e9cb6e81080732a367"}, @generic="7c21aa66c49a432fad4572d91fd5d63d1beb91977ed848b380612ee5879234d65b917bd3ce6a2993725ffc2652490befb2185cf53e9b456092522b77220006dffe71"]}, @generic="dde7e7323074d297df0186cf5695a9b5b187e0a6688d96b85964c41414ac1bacdea001271b8daedc37a76a90e5fbe5720e126f010dd0c4e4dee4af21fbaceea5adcb655d983df484eef154fbe08c8c77a67f1542830c66acaeaecce7237778bff8c0b7129b93f01364bdbcff82c02ac9222ddaced9ab6a48d8f8e72142e4d95d287e3bce83a9d633c19210e8a9ed73ed95afc5130b2bc489fed3a35088a9d4106d1c40bdd27410f108f2fa202b6266e1cb2d2710ae8ee2e0ebe4d4bd89415db6eb9e730c", @nested={0x17a, 0x42, 0x0, 0x1, [@generic="3b87d3da2f5c0da81e189d5ee2590f525a63599099a11d8411e1d2fab2655c43c3d1c2af1f0cf0cb604899a962d3e60adf6d4af558d3543aaa438d5e1baf85cf2502c07998a44bfbaaedc3e417860ffe86de71a5f8207f6cbb8216f032d925e5f6ec675bbb2224030c442ecbdb3dccfdc4250349b451ace366a7c786493284a1b47408e0e8d0", @typed={0x8, 0x5e, 0x0, 0x0, @pid}, @generic="42e78f730a7635ffc7ad29464cdb6781c4cc72b74bcb3412f312cebf", @generic="e053a4866b", @generic="71e599d9514f84c00d2c0e2ef66e53e5823a34e9e1caec2012bc560854d66b5fb3bf46c9c305aa764119479d09d2f5c01c71768031c2326e9abdff3c83d65d54e052e9dbf5e4913bdc732c12fdf0471d52c7c8a7e06e40de13f95f219d708cd90737b80eea27afea185c4e8038cb30123f3279a5c4cc3b677a15", @generic="abdec0a75a8a03707ff89aa78a31bb990c08df5af3424424ddd1b0d9c276d42ddc451be3ddf35fd8364cf311865388ae585e71c16db99292d86cb53fa4faba98d919c67f9807b4760ae87dec4c"]}]}, 0x4d0}, {&(0x7f0000001c00)={0x48c, 0x3f, 0x20, 0x70bd28, 0x25dfdbfb, "", [@generic="5dbee0a070225784e54c38503e60152391ea0d6b528a4f3f748a01f9fbb43e6dd22a5bea9557e1e1f91ef873819382186a90d6478b11acd6c4bfc461b3a4b5a9dc1012d436d3915345b3750be7a6bea7c6b9b1623fbac567e5b1a95779916f3da097a2a3512056307a339e2d0f00971e7d3aac042917fbbed39c285bd93a97b31e0c055f73fc2fb3b9816e73129c208825d4830e0c5bb40bda805dc6f564dd445f2059966717cd6e53b15b9bd1aec03a8947e55eb8b4ea99e3c07c393b9642a67ef88a303783f2e750a984909e830f45181cdc3b73f0f7a92db74ca8d574ff069734781a983023dc5fcfacc39d16a13c", @typed={0x8, 0x8e, 0x0, 0x0, @uid}, @generic="8c1bbf1b631756dc70bd0c19800dda06dbe50261f862bff7985b96c7112c52a64246ad", @nested={0x12f, 0x3, 0x0, 0x1, [@typed={0xc, 0x57, 0x0, 0x0, @u64=0x1}, @typed={0x68, 0x65, 0x0, 0x0, @binary="ec35d7c172bf65b21e31883dce44047971a630df711dbe32aa0fd7e251065cb0a1e228cfed622720e6d4956adf6d572d009bfbd11e52d52649cdea823a7d2471d925a591b9542c252f8e01a2d05aae235db6ddf30cf1548f6a9c8ac48cad863a99b13f0b"}, @typed={0x4, 0x2c}, @generic="3b82de1ae8ba9f540e3ffe82f3c4b888a855e89dc3e43ac3aad651d2a9940ea64ee85922bb16c45df1df3d30ead301b9ae8e160b49b2c5f326ec0ccb817c7c34628c7f6a29e550cba2014eff94f646e8bdc5e0cc7c770299781a7ed275545dc92777e18a0868aedd8f74af29a6309bcf3585339c3cc00a5597713a7e41d38e41ddb95abe64bc0896d47f547c454aac1a7c4cb5f91f5fe1f111046d0db5e880", @typed={0xc, 0x42, 0x0, 0x0, @u64=0x3ff}, @typed={0x8, 0x23, 0x0, 0x0, @pid}]}, @nested={0x228, 0x65, 0x0, 0x1, [@generic="d409211043cb5bca002d67334f09fa179e36da1d0e485afa6ff8599679482bc4263575176581118ebe2880", @typed={0x8, 0x8, 0x0, 0x0, @pid}, @generic="7b300e33ee2169ed07ad21972907433ccee3a2a30d4e5bd36c94388488993675bbf5735a5bdcdf64ec289899e194b1f947c74c12b783d0893af3ef59f8f7036bd2512bfb129f8d9ab21d81bad3992fd13888c397d6a88026bd29fe638ad88d4b7b9021ad3491da928543c0c5e990dcdc7a87b7e3f48f58526f686b6ae2e4dab9535b", @generic="d64b2c157faaeffb009c381cfafc3af729e4e48bd02c929b482158ec2af8043687b9dd4da526dbf6c605da12460c2eafb6e41c09ee671f34892337", @generic="90bd5da0e3500c1f483e9b5289a8209b359324689ce69bffa99d300268609300ec5a3307fe874ec8320c9d86806326f8f148a42905396b705041ea18008f534db6d44f9781c0a592bc47ff14b0b83aaccb835d096f0fac59e224f472d952fe0df21ad4144c375a9640a17f805bc264bac6c43008563d97ad27d81ae105641a986e24d4462c86fb7f54129d3f7f170a94423f00c8ee5be867b9d11bad019371761229645931a1ad038e2de41d94a6f4a3f186c0d3bfc186479afd7884f11c2a3629c47577f7efb917784f78b11bca0bfd4805849c3475fad62405605cb7023d2abfc49e22d8fda449f3a76ea99c", @generic="4270f109ea78c91c9ea0cc17b49510706fdc212d673e2d3e52df45cbd59416628d4e76ee628b035d17da7bd48ac2d274af7970185ce37d892c350cac599d616d6a07f1a36fcbc2"]}, @typed={0x8, 0x21, 0x0, 0x0, @uid}]}, 0x48c}, {&(0x7f00000020c0)={0x264, 0x2b, 0x1, 0x70bd26, 0x25dfdbfd, "", [@generic="213f9f879aa219c42c75edd196d350df0d16dc707f8166630b4d476fb5177cd6f12b9f6c9cbda7ab91625be821fa9ae55b6f4e55634ae0bc806aec572cc19bdda06ef6dc4391da316971b8181c32b5c43f6c281e81d4552ec4a5c22d", @nested={0x1ed, 0x74, 0x0, 0x1, [@generic="8324ab5b59b44c4566aa94d5f6137660de077784edc25f8825fe5a15785bbf371137c0b5c765590031cc9ebb30eaf376e0df4b557617089cfbf9c25bf80e0767414b675acc3febf4a31ead1a88e0c05c6cb19d808bc301932264071008ab12a331ed5a330a2ef515b5ffb9a248c1056c91bd8c54f95acb12f1f158b31775af753ca3eb92a4c97b264da528a42cd5beb410f8dc24dafc8bacb98bd4ecb8975a0a93a387c33018598dfa176b72148ad4dec912de090bc5bb69b07c062dba3e43508782ef241a2d5b427c3efc5271e608cac4bf3457230e55043e1bb8c8b361b8e686da680155fa3838ffb8e59ea44f7234bb2c836010077562", @typed={0xc, 0x7, 0x0, 0x0, @u64=0x5}, @generic="87c37eafb73d27acdc8d3642f70f93dd9bb6717650556eeebfd35de2e9a8a0c5428255eaddc617c97f1053b4fd869426d5120232d3bccc892a8013d7fa5d587cce859e8b53ba9fa117fd9653c4d6fe242763ab26b0e774abf94ac12b90df0a1d081c2f5b0039a31731eacac177d85c3ced13af954114a4cb558b84ae14eb559c4c1ff174109780ddfe8e8b0c19584de6b6f5f5aaabe92b9e2013d0e46cc57918455fb89114132dcfe777e8f1327813a4363678fd909aca1fd35e00dd100cc086d4b932461fce8095b9c8a754cf4db1651c32fd494fd2bafde969d82a780a291a8b7c9887b3"]}, @typed={0x5, 0x48, 0x0, 0x0, @str='\x00'}]}, 0x264}, {&(0x7f0000002340)={0x1370, 0x2b, 0x400, 0x70bd29, 0x25dfdbfd, "", [@generic="84985b59739a1b215dce7c1609cc5f4253bf2d3a7af6acf40e02f9f9cd8dbe7d7bd27f5be9559ab8c560e6296b76a8b4046c375067abf07d21afff15f9566343fcfd59acf5389dc48a2d276b616e59d3e629ebf48378c7544092c0ee6a7d8aebfc8d15948c27e1898f748c691be35d2880a8d7464daa548632c078f14c1ce9832f2ac772d6c77651625b4969b76222a7f34873d681c35803e97e6e4638fedd8d9df0ec1b5b653ba209bb1cefc37a9e70f1cf68bfd8fb832f6eea0a61255f34eef5f9f7f1dd3bdbe70d412bf794f9751591b54cf7e2b2e6862b2b3bf57966b70435ef2c0d6f8937af8f73e45c0b9afc87ceced81e55aa0472bfd5a24de0", @generic="cb1094ace57199e3e999cb305bcfe83c3ca051240dd55201a837377e6c040498410ca4ccdeca69e0b03a865a0ad40321ee95d8dc71d45fde2d733ff6eb8fa9d471ba4f1dd82a2aa0355ed6acf1878ca63b0c903747acaa1314e09c162b35cb3cbd8fcab03705cdb23107aa896e7bd03ee983223c699f2a135d4c4115949bf63522dd005415d248dfdaec601a094ab33d470628eb993a739c014ad0f56301234d37d25391de9ef2b3032321867823c89e04754d29086f15d0e31d5fe8444ffe4d85dc24050cf7ecf840066be85fb3eb40084e47dea7d2318593f76dca17a8c95a81572e653d426a779a3f590bdcf04ea837ad03d043a501353f293d032f699ad997da8f5ff20fdd4b918d553806a83197c519c2fac9176ee232bc53c819c4a812b446c96baf896dd9b5d98085dbe33fdc59db66a32faf8fcae6023a5a9b27f254f4de31449d930bb29156399bdd9fde7c6ccb2edaadf05004370e97973e2984113f966604d162cd07e291f7a6e28b771ffbeac945a7e3fadcb52b0177172df84b1068de0c910358ef734475ac8c3c4ffba15a2e68ff064f6a8fda0159706c8db03aa1b21e2437fffdca29b63164bdd5097723c7d609a6f23346c4128c03020ec52b1a09da50e9f9a54570877acba2777ef55d2372af617e1fb8b8f8b80548361a6acfc01ea61e2493e1dd61242c394fbca3f52eb029954554f509869209b97eeb9924c95e367e480af05b18017dceda8ba9009a675a763e4b359cee7b973a972690bd0a9f36a4ff7b245eb3e8c18fda39c7013eac1d950f9905f0cef9eb93e774cc85e8d62d665e1f3dcb5f45f497afc122cdfd87efa105cb8734a419252095aa8d0178134b46d4399e033ef2672765c0b190ba73d92364753f190f63abe624b92ba0b6a80f11c4ab163b860b4c1a4ee7e1e9454fe0f1e18663b33a603c3611c1b6f177069329a685c96586f3e0fc13c8bccbd8facace4b14de673fe1672ff9929941d4fedcd758243bf04e8007d340f7484e5673797bfd56f186861c15c2d79a5bf6b13844f840590b19d20102b8857e2193bb5a5919bb26deb1d2c5265087878ff6860c4e1b484977168ffeb5d2588361e64dd2ce4b4f2c284f445d517c1b6068ce05a75e466e7e52a0854d2f837b9f74d89bb272672992739128ca908be95c91f6667bee880da9d85efcabea3a3b1f22cf562b7b2e9c9e487bce8eaf8f71469bb22cef96ccec9758dd6dabc256b75bc34ffb412bb92806f6f1cb58b70f391a077bfc6afc47fd194ec09eeb46eac37d959244e5579fdbabae509621333e6e42c6132ee2e3eca373dc9c4f17001ab27d8ce4cb24f7e32edd9360fdc41c650d525f22d0aa5d97d62da5d50d216cdf4ff47c62867be2d7b30d503c6865ae001f5160265ae776d26b719a6633125965bd79f48a5eb13e9462d0330d72426e9069c01fd3b1df925817864f94e33682fb5afeaa56cd90b3414f8e0d89a29300c397849d6ac09ebbc7f0949cb0ca0fffc8fa11bd8c40b408dd6627374a588b96659ee56f35f641d197fb0b70d4b65504df488c51bfa68f1033dc02b25ff005656925d543eb2e8caac4398cfa617d4c5d891a1a4636198665d5182234475805e65a7d4818ceee31e62a354d65a9da8de79149011b46271a000ce0030a1dba8a7e2e5e90037d68714cb6be19760d968bb8e2ff910fc39a1d84e8b72aa881b6753895c53f7e04f8166acb1dcce0d25265ec8226bfe31a96aacec10c1546b538b80890997a95330a968da682ca49d647b57ffce7013ba5763bd85858ce25d5c76f496a27736a6c90f1dbe4192b36b900533f8159258cf8ce7baedd6df5ed8f754b667c8df33f7e55aa670b658a7f5b0aa96741bae0d2f4dd3a19b91ee11a23cce0d1d66356076ec485ad49367141094b5b441be4bf782b90505b8dbdd9bc429adca58b67d782d7cbf5ab597d5419425da6d8bded87bb91bdfcd7f9f062dc3ebecec979ea83e94bdd78cdd4546ac2b994878861faf220b38061990fbda9df8e746a18d0eddaf882c115a20db6b96106c8a5c4ba4d806059a9e4a0e8540794459c451a29289b443cb331ea707f1008152c79cbeff0898e7a4623d093d113beac2a0a74269c2d3ae08493f1ccdb5bd6e5a07fa3cc0e2e0dd91962366951301bdff77af3ee3fad15698859277bcb356a74edc789fce7b358359187d509c2ad8c337e1db84dd4b8485ca22b13840a13cbfbb1e22ab5710a55c6fa38811b19b5c6e7c1b8a986931b072cdb540d852ab9484d3625468f4f57e0652003191019697fb34cbaebaddb0493290a22a872130d6da0791dd7008a112e50677f36fbe78bdebbd55e6970418af17c2f79c4c88d8d12a74dbd97c38aa70f2a00e65533fc8bb41b452aed2646692816f551f8941b2d7e95e3794a615c3f999f12d2497f106918520c2e0eea8f916b8fe553a8d9754e691292f9ce35446fd25dc219060293b357601a12d3493708577dab2c4e06e137bd983a129cbd27b87461fa849fd2cfe57990701fad015c11ac754a6619f482c83db16bb05cf3804f71b0870c42dfa673b621e9255d4f3b66b8504cfc53f3d6a380df986aa0de0cb8d3df0671ed209a51c804b4ba72c430063e605c88df03e5628c0e9c40b59188cec07d68b4ad6653508e0fbd7f906d03bac47057fbe8333c4f2380068b3b45d368fd61a5b9001668019ce3ebe09965f3ca9084facf8a9c8566e7e8653d9f2450147ecfb64932e2aaa8b0df871f94fa199216d4b0ae2f8ba53d9500778946d2e5bf94b96751dfb66dd87018728905b139df176594be2bc6d429ab76f9e4ebfb724b22298bbd4c993b518d27e05b73b9b82ebbb0d58fed5b6d556dece8a273cd3c57bcd8df453c0cafc1c5310252e28998203b35779d92558c31eb413635dafb82bc6a555aea4f6efc170ddaf685da858fc48b24e1717dc2efae89e39ab5144ed9cae0fe741c9025079450abe90d903d0c47985772f83dc87b70376983578681f23de057c392f1303400428488902ff43f9d3748d78f30789bbec47bd6477b78215bf055f82d05abe1c883a29ebfd910fe1cc4a08cb83d0a2934fd4dc516950b7048908bbc7beaa4514c4ea8a10fc4323f57415a24c4ce5d9bf2f6e605ceafe452faf736d7cabe48f524f1e1ba633622d778e89fdb0fc4f2c3db78ea364a898fc3682f7ee4cbb91251b2e581d463542d8663c752a24f86da264ef8dae5771efd60c759bc962ac2eae62171b216d6c9ba36646eb22ad7d9573a2d56a8aa4db43fc931bf4d08c01da2bea584f77044206a8dee4b50a902c4c4bd65299fd3c5ba1ff461214d3de8741075460fa3f56dff4c5730488c2bc322715cc42c8abd85cbb8f580a893dc11cb0cadf401a7883159e2929eb32abedc8774f971b1ad34e584af44b04dbe551a6ed6ec52dfaea13496b7ded9ac3c514b20db4e61a71b0c3e9de6c9d1fbcb117ad8d85cf138b10738dac611aea9ed139b7fcf07de5aebe956a14c0000d5a90ed12a22ad2901b366953bb29f166b4f32c0fefa9819a5f86df6a80a8ad4da8e58db262cf45fbe63cacfaf7d5954ec2a4e6f673f79389b4bbe7487a44105337e9bd5323082d72e80fa7a71388f779b096ac6b668287b22e83b5da9af79cb1dd503098e472fab46c932b0feed1fe096530b3387f1cb6a1c7ddc5b4092b5b017d70df69c00164a8d09fa477e724db011f7dd2b43e166e332f846693a3ba3130827d167d0d13221f62fdc9f0f63d830b61f316e67583e993637dc632ddb9ffdf40d150d4b848b064ca7330f6a1374cfd42f2fd2dc5d8575357964b5826f82bfd82158e170276f9e0c90299d7baa2d62286dc44e425448935bbc088eb9cc04f2066c8004ccb3d04962e37b184be0ea3849ac383e49c5e072a5d8fae10d5d0d8f6c637c386bdfc21bbb43b74607a6264f74674796e64f60f1ad837960db1fc6e9dfa9a53813b98bc7e13c5b82a7c7fc825f57426a33cd2279be334fa95fc33287ae73d3280fac8d1a5ddc4b727f8028626af9e5c7fc5122a7957c13bc3fc2554e5e7b1fc546d9a3b1ecf0e03089c7f67d02ba2793d0c34e0f2573811944df3aa66ca822a0162903d79549cf102371a012c633ffabbe0aff89caa17c90dfd895977ebee04f1126fdc291a67cfdcdbacaeb4d9d10dad208eab5a61f6ded2e5f74961d1117a3e252a495192be66301d9a0ca4c03e47b53cceb9c29ca16f456712ad6f5057f905bf0494a3be4ed62704c6bb71dc4490878c62581f796c8ffc88f9038f69ec7a7153618c021460c9199ec36bacbbeaf9c13ba416937c882552cd078211a86e11f6e424199a3b5bb5426edce6fd7f24524081a97e6b2ca92fccfa7c7d12c6e286d8de1f6242c24c98a5cfeda9dd7e134d122a7c63212cad2f47c0a5402f0c3d50bf4f0b0e00b5f4cc33998164278adea8604bf123efcaa6568d5cbcc29fc9e8f59c4539a7c901fedf351d456d6b0d66ed9083fa525c0d1a678bf9c3cbee8ca3c8df2eeb54552fc517b7efeb82beb8af16740dd9019406d02bd8f836be1c25a93addae85277bfa066eb607b0f868dfb3d5a854935d78e5f94219fa5eda9f21e6ab54d86ede2cc066926572ea2e1f52774e7e89989808217471b3d0f495fc532d1948c04cc71292aa533133c5f65682670a3049bac4d3985fc8f001bac0fdb24a01fc483594efa6065feff5a32a18fdfd52374b7d69d55ac4375212adfd4dc57f712d7d964f9c92ee2dddcbae0107e64ad72326d539cfd2706d7e8698d46015319a0b1e5c38176ca10d99aa359c9693759bc5b55e25e6484c027e3ff82f6ec1ee6fe409087f37b572d0c2fd24d2c803f09c226e6cd59b0dfc94db7845c044a84fe7e86955902010b4326f8e7fea7b7cd9138de15964bc166b8903ed34d17a60a503740e48e7c0a209e8b8485016d9beaee647028f877ea40b9abca9b227c2fb09b53848820ca205d6fb8923fb7b3dcf2c929bf4c10b783499749ffecc6219fd676860de65c1b27ff1515d607fa96fcd60da39c76b972919617d49288d27c777fca53f5a931c57920e9fd68a1e6f812bf9ff3ecaf2082181154bb702a3028a60f6f3013bd021181430eb4c18ce2fc98255f70d8fd5a5b90922eaa6d6df2d6af450bc2a84b2d75e209b89fc41e245905b0f02d5af34ffa49f81f3daa13c574504a57c8fe9dee851320d9e614b16e59e83143ee18d7763abd0d54fcb4f7a37a9aa9ac96a31d0bf97e7a6a254b912233e57e5621254cc76ccdd4ffc0304deaef6a8cd986298ff6a1ab0d29f2295515c6c5919054f752238a276f89735651aefd0b2b43b2b80ba58897d8330b802071d3529e89a4922aaee19cc7d62f54cefd9f7d1880bc18759263b4d5c51547b818b1ab913db6639e009c8829bca49841e9bdf19083e78cefed7813f882784fa20e6078b4da4f9d2a80bf250e4188a3554ad9177d75ed7ada92ed888238acea120c264f1bf658ca9d3e8429c85e4cc40aeba82e6ab9eb74a56e848636c541e7ccd35bfc20e9105e559967fadf99b9bb702eff7da5d0b4b1b4414a5baff71f97dcb45453256ecb7fd53a43315795fa11f3854ab0e0441bc77dd14068a0eb31b7940822de471bdf04f7ba08218451528fd9d82387ff1e0706e8cd3e36deae9a638a175426c44835db0cee5a266b340cf1ac4b01e4ab8fd1e57e459ee2557cb846a47d2f3d15ee6a99856455686125ea8fdd25bb57511c0f39ec2dafecdfeece175375b56d0f515fd1aec154c96d6503e895cfbfbcfbc97d9bf21b0bbd27b5412999ae85", @nested={0x1aa, 0x8c, 0x0, 0x1, [@typed={0x14, 0x4f, 0x0, 0x0, @ipv6=@loopback}, @generic="5b0926cce0a634398a9215361fcb3799b034abfcc5a1033f27b965843edd3453bfa1e87e3c0e56622e18ff1b9e0a58c9ba494adac674deba8f1b1287e3dd015aa26940bf1d99bd64d1375a5bb06b674ac7055a63c355828981e6bc863f0b5786f4ef1e7010501d1822d961d3974b599eaa6ab867ea0ac42a326c9c12da241671b333ddd4782c79fa55e31737561b59ad29fe679e7e8c47d3c991017aff5249be600634332799a8a85cb803ac365230b0e91e18d8e9ab9287a47ee2d0d286717cb1100b3aad72415b", @typed={0x5, 0x1e, 0x0, 0x0, @str='\x00'}, @typed={0x8, 0x25, 0x0, 0x0, @str='\\\':\x00'}, @generic="b0eb92acffb50efeb0ecd8246d854671dc9ab79a89869f9169f3c41ba1c6fa873f4d9dbfaacced46eafb3513efb262df3d397c04a140c3418f40e276763d7c927801239a454fa62bf79d165afbd81ac1ffb41611093a4f4120c96c8057a57c80bd340a1397f6bec0dc945c557a56ed54765a1c2020c7061084e58bcf62729c1e882afbc5c286a75f9798d93225710567d850fb6819c399677cab93e0869fb3b083a52cdd2e3c9f3ec72e75b335617e528c0d490c1d0d0dc35910"]}, @generic="1478436126799d21a4986709c5b90cfd60f4c8af8942aca0672125164a54d5980a58b5792a293f8ed8338704a9335569a48b7c7187dd2276d797ff513ba400403fe01e363f165d5f98f7ffe0b11008d4cf9e552b31630b765fd5d7680193419dc2f8a9f187b6368b7157c2db6e177b689791ac6f6d6b20b6b450ff1ea8bf721edb06b718f6bc4b806845820c1025c224726df53320ac2860f89bea2acd1a172bd50713eecfffdc6cd6e79c35db61cc48616468449d2a0c"]}, 0x1370}, {&(0x7f00000036c0)={0x144, 0x37, 0x8, 0x70bd2a, 0x25dfdbfb, "", [@nested={0x6a, 0x54, 0x0, 0x1, [@generic="4c2fb5f835d6214b59adee83f0e072cd1c6291af6696fbee3296c07b3abce216e28fd38e03c9940264677f582b62", @typed={0x8, 0x7, 0x0, 0x0, @ipv4=@remote}, @generic="7174e86bb8f3e1f6debe7a8c3896ca7d32aa1036d2b0cf0e4177e4f38c342da89af4e731d3503b18df9d7529e0beb142"]}, @generic="92f8190a96ea28afcad029e1be7b30ddd0b046db49e647531a129e7b4b353a05f3dfb0ba781277deddb1f7beaf2c0c9c37bdd882aa13e0581c0354c36c2cc687d673ffc7c6035115e5a8df730f041af4e92eaad84cd1bf58af138bf3c58da29d746e9145609b023efbd6e90b95ff2413108b70f7f015bbbba9698e3f23971bff9c0b1bbccb31d9901d0b96d31c7d31c6ad9a067d6014fcec7b0731bb94445e39f04776f7eab8d90593ff709ea6d82ffa876d26738f4b881017688f323c3203b09b94144e798e"]}, 0x144}, {&(0x7f0000003840)={0x1348, 0x3a, 0x1, 0x70bd28, 0x25dfdbfe, "", [@nested={0x111a, 0x58, 0x0, 0x1, [@typed={0x8, 0x3b, 0x0, 0x0, @fd}, @generic="873a8ca1f987b7c67b3dca3ad86789a83e96964dead5d9d2dcfe5a1a4598248370850350134dd2c7e9dc61fc5c5b9fb9b1cbb42bf17cb906cae554bbbcecf7d0a4315ebd0c3bb0f06128019643497cd4ad3803ea37da7cf2cc8f301a6e2b9ded584c3e8bd4338d69fe41395251fc0df2680d3cbf76387e93270f51cd27aa8828c06632a7502fc91964fef2498881002ba9615666dadeb292b90c1bc2749a67cb2ace08ce49d828e2b450b66f4a34f72108c97a956576fde95bee02ac0a43cfb369e3683eab2d7e00ba47903c8063630c59cc208728b785c7c2afc92f2cb2772b472a1886b65da0b88ac3b5ebc115daf38407e957d7b19ab1f5a21d9eac43d4e7502ed707e5805294ec70bfcda32967b59283ccd77c0a10eea9a0938c6a21df3fd9072a4fea905135eff213a99db6e46e8e6e845e433fa001eb017ecb5ed0b5762bc2e4e3e8670fc7843bd4471eee96bef5a71ace3d611bfb4f0b9d121c6ee2cedf8fd5ec07fe894b611d8c2ac980a1a89c66e34c3f4e85ee46c60e85ed3a3a0dc1dcd5af80e3705763b01016648a5954e08f6257085e1ac4ae250f2bb889fda09e15f79a8a5817159cf1b78815f300bdfcd4aff1b778befd832592a6fdecc6f0aa77dfc8c6bbf69cb9cad136ee8287a267d128628848d4f2ac100d5174e1b4aae183b1f5c2fab5da615ef2003012e155da5c51cf16633f983dbe69d323ef9802f054f722afe79e4eb6f50cb559633c9e1b830b939280a0cf5fda062f7717c0589441ba9cb2885cfb585f825b4eb86c1d03688f579bdbe725ff0d7adc9374af514cb13a24e11e9bd951cd24a5a3cbcf28a01efd9c597a32f70b6cb8910ce34f1df981491456f527973919457679a616216476ddc0c1e0d06649bb38d2c3ed04122e9fb6f79911166fcba7c36be18df4ecd97608c72c39e93a3cb76bcd035c5afd853e4d6f93b84e7bedafbb5274355daad8a2002e75064ae3a4cc0b26b3b2e059093a5f832545e1bd3ebc77e3a30ade2ffde7375600454f1dab0a98f9e076aa48089a787991526238f09e5a95d3740c5d0b37e98cd4758d6fe67c21679b98dd0b23e22b9aa73e46f3e9f42eb4081b10a0cc6ae95d98add1fa3cb8a116f92916a68183c2b6c110815b17f0178693db231924b4c9e253384f1fab218fae0dc5e4b4481bef46b53b9371e9b5f83bf16e683458350811d67ccf907b6e6cd1e878b320577726e21cac0f1f68ca3a5cba7498e1a1c559c51f66e4d037cca6af9758e5ef298ec5c7501216bf585d65d589a75b9380b2fdf937391202714972223c96041faebd5af02f3c016e7611ff8abc991a4fa5a00d8ad0afb49e868bc2d8c057033d3aae8f072dfe51ac0131f7d5a6555b7dbfed869ed1ab3328844d42651edd18a00bd396b739709cb3cdbc21fd833aca8bd86bf281d7ab17105dffca131ed015aa7303d173e4eb8a29619d04375b9c55d9e0d2d4e212663cc9197b9b2ba0cf0bba18ac32b0188e4a8ac50eef8f9981cb7e78a9e64afe95022d6c24428b684886059cd6a98cdd0913b07d9d22bfc0ee1bbe1199eb05a9f5d4d13053891b2a8a7158884f57b8f975cb85868724c6342516cfa4620bb863bd7c6ef96efab1737acc2c235b610b4d7b613c30b928f5680376e858b8e661a3383815ccd239f94a38f9a844bbd7df18d31263cf96ef16ed0bbfa43eab5ab46b61340cda2fa20c6d0bb613d0eeb56380f746eeb8cc013b7fd67868b3176f50e8fd659b673a03bbc3ab67891c75e520b0e81affcf48b823f212caf116149ac3f023abd86a398a2459de3850ca25db853a262704c019513f487c7bee4d7332477a2ecf2ef66dc3b8ea3cf55e143f56fa28f4237a86905f3e367ffe09a24f0232f568acf6955d07d00643c9d419f123779c61cdf2ccc6b9150074a6913c86627d016a79f92c9f05bd589efa3fa13c339244efe9bdc65e0791363a2b3dc372acf066ca6f083e279e1def4bcb97526618ccc9e518935e11f58e8d9794f0e1ec3eb5449c9a0c5ebf6835ba4db8be0448ff9c9c36aa21cbc50d2b67b36d51dd4dcdae5ce8638ed23c67d88ea12c161c658e77607a809dd7158b5d8006ed58d82ab4d5ca64c87ebb5f7c989464c6a1f679debf63febdbef9cd0f8c621f3ee83c1a6f1c59c2ea8c49416af4baf63278af7105c900f29221ea6ac447bd742eddf1d7b0ab35efc4ae8f82f211964cbab59ddc7a5f46ccdad15fee426a0d45b9b54c9bde28a55c1ca8c7c8f57d1c4e1f0adc38063ca3911b7ab3b65a8b0ad1cfa2400b72fb23b3722bf196d9d8e5161f19950ef947688b94db9731d66059ad78da11761f46f880b80238618aa76042f543eaf522c57fb05534162eb6379ebbca434139b01761cb1284b7a19c5dd6139c30c78a781cbf574d18aa807f2824d60cc957ef4ea8917108da7554e138b5d80bf5a13406c623276de916f6029cfda470d079271ef235dde97a0bd2c6ffd74c3210b33a3502502ca0f938e354e49c0a4d1f5addda82f89c148a9033c65ac55bc782a313fa87ef6c26b92238575800799b71240a25712b34fe6d508d7631527487ffcca63b30a37bdd7c7a91be71e80fb46ecc0c2d625dab67420b63a9051575cfd62a31bb8e10c05bebf080ece890e640361e77fcf7604e6a86b33ddbb469432199c71b91ad214bb8324543d6225560046c8cc755747637ba8b485beac19c4f0c8c1a6870473a1cfb3f92989fc0265e4b9792ed28182d2ba6ea921dfebd7b688fe33465b14d782fbede4b71b69dd27ca5d9b62a087a8638517ab8b03ed7c61e15ad058a8292987a2ece397ce51772e016cf684e256c91922fac11b514f2e8c93cc33692f3e7d74e70488b016054966b3d14fdf2ef7a9feb39ffb8a0180f3254c95267597977b8a2bedf4f9e5e2d0d32ada4d071c1566f53faf8f68a10e6f92c90b7d6b28186ebacd2d682dceaf6373fcd6029817b06946cfa98dbf62952d6aeb1abe7abcc91601a69610f1bf00b24535d0bf09a4d1551fa4da42d5b75a6dfc25fefa82440fde9f27054f0778499289821137177c7c69de6f947b538546d6f0f15a14907279b40510819798ac5f70756045827f99116a357c5c3088816bc0f466927d0992acca949a659a1eca9098e4a0ad0efa760d501eb5bb075254a9bb3f1963ae7b07171051b13e8ac8f1098853ef9272325d07b13517d662fc3234659682300c48b13a41de6c746dbc8edb3adb30d7dfce7aa55b2ead328e9285f3767339c049e760eaed1ec04e47f38c83ce53e1d2042b5020ae8c17d333330d6130619284fd9d637e47ddd3d11eff8260e8a6afd09def4a5b663d527dea849dbc1436a50809a5f83cc323565327c30dbc65d24cd0c88c22dc42d74a4fa94d675b667ecd6011fea223d8177b46fdd85b476207a3484f9cd956c32e85fc0e267a9d70db097edb9aca76b427b6374d873aa3c7c237de1ae77698447a894147d2290db6dd62c2f89e288a2d7ff43b643f471a6a34f7d889ecd918a1a14cf5a977ca0124db0e4d2ec80558220b91da1f34b489ffcb85d22023d25e7a8bfa65b439650ade891cb148f946c0b980f900fffcf844aa5a4ffb6eeeda341d0c4d15963da85681b3d9642e2ae35238471c81e999fc631b40c0c532ea7f095e72266bc94be108f5bfaeb23abc4489a85168fb7af194849f41ce8909dff42c877ad8a4ec604eb0fd8c72d339cd2db7c04d41db2df099d722d807e4e738ad923b86b341ed2953f0d1a27763466013ae667eb54f499f20483e81591a672e14191917c70aaf9ed6baea2b0320a367b54811904bfe19dcc5ee117da10c16f35b23cd73c133f6b02c680eb2dce658d7a08ca9eb109a32f6e2eb52fcae21cc9d7f7d99c24a37011b99b5069033f25acdfca7a7d8b69c0d11c15c9ab6ec35549b347f2681a01d3d947b8b7af115aa72929d86539b1d91fe6098e5703eceaf20d21aa10625dd29898158c93910eccd04f18b94d8a771e72460ce314b3260d86e94383360ee0213e44e43b7a224a47f304a018f6b0fb0a134ba55795ce55210f487c405bec027dbe7ad35fa2b1171dad1cb0a460ae3ff36517b3b798c2e5442a1b46278e66d8fc06db3f4104a5ca841dc48138aa0fbc4fb4569ad2254c3847b9e9680c23a7e41f872570060a9c11646a7daac6be6fcf8d60a320fcf6189fba10ffdc32b85640e2672a788da14b675bab20f302e5723c6e906f47c824a5b9395728ba3e353f43ab9e7aa52496a105cc0207eb157951519380f5c52fbbcb9d8738f3424cfc63dc4c4b277bf32379435b7d02f11e896dcb8ed946838435da2df3081e93ae200ecdc6574276e4fb2e2f1b73d596c3810fa513168d09bc2fe30f966b9de0a2d4625ad1b5efe71f30c497f9f9063fc5a3ef2c81148a8c833732806d49312988c1b657574ea99c523f269969b1a3b588d86a7c127d8efe1e0447b1ce0b9bbff275248099573f9c1cd3d5592727d8506aabff2ff696a5a171f611b21db3c4b5161fcd7679e473662a2d1f385cf37e31039239369bcea16dbafa2785a2016ac0723e6bfa1d54648e2fd4bd46d356e2da58378c73f3c271c8ebbb21cab5ce35fa16ba51a75a4125af55e34b1ced9f5962a1a521933745907e280dab32ac3fe3487da6f5c1fc8d6e6173d26cfda8beb447c4650022bee917855c0afe8a04cbb3b52ef6c6810afadc0d046f63a9928182275d4dd11871f5c5702b13c6114ce54bcd7060a5b21625cf295a25332234434a685b2060cb1aa3d205b0cb9e88ed42ad4d322dbef0ff5b5c434332498d289773098fc1738f763d5738f4562b108c77d34ec5ea363d14aa921a92b01314821e24540d7dec42f2df6423b0d0fae3df116b5c86788c206e3a7ae11b934058a62153dcabc71ad889c589cafbf8824147a570be8def94b7f516a200106b114532beb20e20217d5e5f34081b27f1ba0270ee9d0969be0f887ace01b2cc9085a6e77a506da42676a15cb1dcf7d4a11c93d5d7086685488a401a5db59789c41f0f9d2ae9a907ed758321a0ad6b578c71260ea79ae6ff1aa6e38ae962a526a8725a3525beb59aa03335117a41a531aa289c01bb3cc15d9c907db6eb9aea06cc18921453d16047c1b139330ceafee526c3ba5b28859764befdac17421ec629290efa06ef34ccd79ff94cca46dee0781d5f3d95472a222a9e8e39e7b8b43b3323864784620d96cfd4904a53a2b44e4a76bfa97f1fffc6296fd7bdf8e2c784547568f3dde550300076a40d35f8c6fd184e14aea2d74bdb9e621e71263361dc092292ecf3eb5af897f86ba7358415c105581de051cd7ea48344a117b69fd125eefd4be12a493f07b568ee051e206f72a8dd43a359ac2f678d729def85cf180625f3d9788653090bf8bf7f260fbbcb6f91b04ac11107ea5be872e793d8852fdd4015d2457cf082f21d8c8e99a5fbb14d61487228296b1fd56feb488e76372996887dc6163c5a1ddd677e2fc8c2476ac2f7b2ffc5d2f79c4f073c83aec6a16d5ed051236c780f704afc65e1bb952ec87bd127b412c6b9a463c29e210346a653e350dbc7f2be186e886ffbb6ff2eac29df4efa34d22dcf307df67587a66f22cb0e747d99f4edca885ae7893bf260cae7784ff3fe55368a33825ebe66a369913b093061db3d4516e1da9c11f195af7e6b553335331f63c6391fe3cd358052c79fa871196c9ffe75228c226f8694f71ac382f5e9e12af395a5c67f42895c4098018b06e936e9c4ac88db2fa74a27b40f9a13ffa735211df61297fb8d77743db2bcdbdba3f67c7fc4", @typed={0x14, 0x7f, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}, @typed={0xc, 0xc, 0x0, 0x0, @u64=0xffff}, @generic="45c0a325f2bf4a2577def38716c29cefbba1a33c7cc0a44e740dc5ea4277311312f67064a3496ba5f7d4ee234382e938856f3e04f5d3337e874c858d7978c8adfadacb24ff786debc99730ac678d4926fe30773fa8aebab25a21b0343838f51c7361ed19e43652347e9010a25dee05446a560b22570b31e94872b427909f708470380b782b4ad84e63b99f79b97db781715c09f4731889230616e91e30c2ebbffd3c4cfbf92c7f77be9e17f85ddcbe1044c5a63c2450bf55079619d91b97d8c00f87263d4d19715a16eca4369293280d77eea9906734acf95273c233f983474afe68994e1f7d88e79a0690531adc"]}, @nested={0x151, 0x22, 0x0, 0x1, [@generic="4706d2e1663699d61274575953f1101d97f0f850b962a418cf06f0e76fa4d1d8d3a4d91789162410982a7d514ddbbc87f422960513fcf33cee6657453537966cab54575ade2a4c844a6aa71ed402548fb522cbd7414a54c83bb5558c8fe2ab2d5f40c24d37b3c257755c20b9f20158a4b1048dbd5e52fba0cb81fcfa62385670b4bee8ce19a9445b52d8", @generic="90ee825e89f2f8a7072f2b78857742089aae8caa87b1ef537f7c1a88abee158b67b824afb5475823d637eb8d495e36ed0af7b3124844c72364a3c7b9519111c77bb558ddeea1ea24382fe3c8f0c66c1fda69b1f7ef4697d277c6e8877498fae4db9f9981bc6d8a8b08d5b474a2aa1cfb793544d0d73239a1f2defc73cb2963203f920a4ef38fae100e81c08a220e6b59fb27323a8d028f4c47da195582c3ccc2139a4e5897b9e494efe86cd979ccd42047f3ffbc0e1d81b74010fca49514d5231c25f0"]}, @generic="b7f1c39d99a5557912f17efae36efd330a9fedb2934813a6a4481d1ae2668ab47467a5e969e6a434798ab7c4fafd22019c6645c356eb1ea5ba3fa8392d27d20f7d77d9da24c2b93c09b7305863be1ca7809d16421da7ef7027f7b3a9b8282efc2d37cde2cd9f4ac3a0ad4122163472070c8a200cda6fd84bf9fcf77d9f4fe97b6fd4b101c44538571a26dd4d27ad634f8208312baa66e5d9572133684c508c458f4f0b8d8b8219159e8a587ff9ba868435542b3240c2155955f354149dd875c5429d517a62"]}, 0x1348}], 0x7, &(0x7f0000004e80)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0, r1, r2]}}, @cred={{0x1c, 0x1, 0x2, {r3, r5, r6}}}], 0x140, 0x50}, 0x400d4) r7 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r7, 0x40405515, &(0x7f0000000000)) 05:02:43 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f00000000c0)={0x9f0000, 0x4, 0x4, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x9b0950, 0x6, [], @ptr=0x1000}}) ioctl$USBDEVFS_CLEAR_HALT(r2, 0x80045515, &(0x7f0000000100)={0xb, 0x1}) r3 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0x40405515, &(0x7f0000000180)) 05:02:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000080)=0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:43 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 196.542082] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 196.575118] ubi0: attaching mtd0 05:02:43 executing program 3: r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvme-fabrics\x00', 0x2000, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f00000000c0), &(0x7f0000000100)=0x40) r1 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000000)) [ 196.653749] ubi0: scanning is finished 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x581000, 0x94) readahead(r1, 0x8, 0xf97) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:44 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 196.754430] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 196.782784] ubi0: attaching mtd0 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x7, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$ax25_int(r2, 0x101, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 196.846197] ubi0: scanning is finished 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x0, 0x4, 0x0, 0x1}) 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvme-fabrics\x00', 0x404c80, 0x0) sendmsg$IPSET_CMD_LIST(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x201, 0x0, 0x0, {0x8, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x7}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008080) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f00000000c0)={0x1000, 0xffff, 0xffffffff}, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 196.982672] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 05:02:44 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 197.025884] ubi0: attaching mtd0 [ 197.083283] ubi0: scanning is finished 05:02:44 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x2fc7b2f14fb989c3) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x10080, 0x0) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f00000000c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 197.176032] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 197.196818] ubi0: attaching mtd0 [ 197.243964] ubi0: scanning is finished 05:02:44 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0x40405515, &(0x7f0000000000)={0x1, 0x4fb54c8c537584d1, 0x0, 0x401, 'syz1\x00'}) 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x420, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r2, 0x40184150, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)="3c93fbdf36cc755b3e1d10d26deeba36f1f18ba1bd2018797dd217dae3a83e7f333b007b4aa7776d4ab166b4245f25c828007098ef1bf9c3d830cb42b08c2dce45c01cda5a5da6581087c14353bf9a3aa2385fcec46e6d7fe4e2355c89e57a051912622c8d91ecc2303bd08e64f15bc234d58fc7ab35c812f7e9620d013beb6831f559f332f56aa953d7a51b62c75de6479b4e9d03a48560981aa735f977b89c8e343d0c74178532ed509954c7dc257ad5ca64c799c9c9ee1e8db090b2d285cab6", 0xc1}) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000280)={{0x5, 0x6, 0x1, 0x80000001, 'syz0\x00', 0xd42}, 0x0, 0x20, 0x0, r3, 0x2, 0x80000001, 'syz1\x00', &(0x7f0000000080)=['\x00', '\x00'], 0x2, [], [0x7, 0x9, 0xfff8, 0x400]}) [ 197.430809] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 197.438534] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 197.450273] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 197.482409] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 197.495182] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 197.508444] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 197.522310] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:44 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x7ca6, 0x10000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r3}}) r4 = dup(0xffffffffffffffff) r5 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766646e5c3d9cf78be3955dfe9d7fa5d4a86ba49fe30200000000000000b604876476", @ANYRESHEX=r4, @ANYBLOB="00fa08ffff000000001ceecee049422a7371b47f71963627f0305cbc0c5a3894e694d081439cb38f0a5ce86c4bd14b1121366cdd88c55a9bb604c379f0cf64eced90d41524e2582f47762e08e8c774ff228d9c844bc902ec61a5e966e11ebfd87a323656ea514175cff723a1b264f4bbc79ecc0d6e973bb19ec4bdd30fad166efbd154877ce351d5cc2ef03c3f9e291ad6842c4ff6cd3de196896b57e308a1ff4610a5551013a23bfc597653f5ad1f820cb28462", @ANYRESHEX=r6, @ANYBLOB=',k']) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000001c0)) write$FUSE_ATTR(r1, &(0x7f00000000c0)={0x78, 0x0, 0x3, {0x100000001, 0x9, 0x0, {0x5, 0x7ff, 0x2, 0x2, 0x2, 0x707, 0x3ae, 0x4, 0x6, 0x10000, 0x10001, r3, r6, 0x3, 0xffff}}}, 0x78) [ 197.532204] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 197.542542] ubi0: background thread "ubi_bgt0d" started, PID 10735 [ 197.542559] ubi0: detaching mtd0 [ 197.557869] ubi0: mtd0 is detached [ 197.568008] ubi0: attaching mtd0 [ 197.613590] ubi0: scanning is finished 05:02:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0xfff, 0xb6400) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x30000, 0x0) mmap$fb(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000004, 0x40010, r1, 0xe000) [ 197.680428] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 197.701627] ubi0: attaching mtd0 05:02:45 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 197.740216] ubi0: scanning is finished 05:02:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}) ioctl$DRM_IOCTL_MODE_SETPLANE(r3, 0xc03064b7, &(0x7f0000000240)={r6, 0x0, 0xff, 0x81, 0x100, 0x8, 0x3, 0x2a5a, 0x17c, 0x9, 0x3, 0x8}) r7 = socket(0x15, 0x803, 0xfffffff9) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r10}, 0x0, 0x0, 0x0, 0xfffffffffffffffd}) ioctl$SIOCAX25ADDUID(r7, 0x89e1, &(0x7f0000000000)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, r10}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="f4c0f1ea2de01c392017d712d1e808e8c2011aad65516357e6c24287ecdf77a00ce72a88c214ea52eaf6b29f28f4ac5aad9e54eef55ecdbaede1fd7075cf4f15bac699a58124bd4e8d83312cebe149175d6a67896bf811c1dd9a70aeec0e627ea30b4b5c608f6efee0ebea89e7dbfa58650335d72b997bc9a15ce991c213d7f088f8b5c9fa6134aa570451f0", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r8, @ANYBLOB], 0x1c}}, 0x0) 05:02:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x23dc797cd81a2f97}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r3, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) vmsplice(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)="1b8ceec2c7af6472ade20d013a87", 0xe}, {&(0x7f0000000240)="b213c7e2c22cdd35251b93bcbb26a2976c0f3446f2cd8aca02080d02d807e0d82ba6343155b387899f5c6c5758fe28337b099529c4ba794d18b028c260a73ddd9de8aca998314294777f4755bd9fb93af00f1f0d6552e9377616f905e3df79e47444127223c1e53655dfb544f24a46286ef512a7e603f0770b705bdc5781141a38ca721002605a264fca62d25acb253ab9aee88680787d195e16", 0x9a}, {&(0x7f0000000300)="ce6a3779e516fe3bf6e2c5599629a833954b9d8a01317e3e54d714b9f909baf7826ca9f7c96751fb3359c6a5e4bbe0d40017f4dbda598b4b855fe037d81c2beaa25c7fa0066f33ad644231fd64e5076dba1a98412309d2ad4a85fa838821907ea5aba6558a35617cc94628ffa20fb06ca0a87f28bcf6c12ac30fbef63c573493d092a4ccaeaf21875e2deec1db136272999ba6bae35cf39e8b8f4017fee9c91ab08fc28dacec8278b37df71bb6d0d5ecb7a59c64b5bb344406642c296d9ccdb8e3301e5495f876ba", 0xc8}], 0x3, 0x1) ioctl$RTC_UIE_OFF(r4, 0x7004) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) [ 197.875834] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 197.888394] ubi0: attaching mtd0 05:02:45 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 197.927343] ubi0: scanning is finished [ 198.056965] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 198.066342] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 198.074322] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 198.081468] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 198.088371] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 198.094472] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:45 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$poke(0x5, r1, &(0x7f0000000080), 0x401) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) 05:02:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x30ba40, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r7, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x48, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r10}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4d}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000010}, 0x8000) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="00007100e9b1692f040000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) [ 198.102156] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 198.112006] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 198.121824] ubi0: background thread "ubi_bgt0d" started, PID 10791 [ 198.124012] ubi0: detaching mtd0 [ 198.137838] ubi0: mtd0 is detached [ 198.141923] ubi0: attaching mtd0 05:02:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000080)="bac4ab25c21ab120e92ce9935731783b1322310b24493ef396fa5cc9d376937c404f4cebf720ae53322b20d72b33bc192fe2e4481a51495e2b73ab99dc4ca17c91ac5002295c49a8f694c775c9db62c8adcbcca1800b188b50dc2bcb30f70c482c0b70a514f944ebaae013ddac3bd4bb41f548cc95980d4d0ea996fd88bd4c85b8f1c84bb6f57f61169e998ac95d19c369dc6b0c12d87e6cee4421b1978eebcefc00333c1bed9d3f29ae9a5f3b515598b018985450db72884f6c6c988dc55be4782fe5dcd632f4235c49b1e427be223f4d6bd7b856c87916ce2dc3e791ba79bd20db453fed18721fc8d926680278cfee256a647ae7ff48c3768bb22847ec7e7c7f45b9313a73d170e44ea379c1d35bf49b8525d4eb4afcbe4b226cd56752f33f8bdc0daf1109d4beb3182c4f4a9cb7ecfce11737554dd38aa977c02f23a95950ba93a06f88a926359865ac29abde30d2fbc7155085463f9134b35fbc730a10204c11b82fb4bf60519f9314f8099fc70fd528593e7a270172170a74ef39827c08da9bec031f072db62f0073d2d82c591e15e3a6172c227b6f75a1c3df2c1d3c68d93ba55df47572ee9a26c48b71a66eb1c53fb72188b364d46083ab9a291062c1447b41154c7cb93201dc517e0a5763f337d31ef20658a95a7dfd7d9e545fdbb6d4960425b7cebf056d12431685f96f59c5a6dd274eba2c9bb3f320525537a9002e8225097f75e48238be9398e4186cc8b1671bfacbd783fcf0b6ba00e93c3b5431cd08619a531506863224faf3182ee3f27d5e529881f0fab5b285c5259dcb217c9892735df013185835c3d4a30c8423f8bad9bcbd9d16bb363eff89611df2eb96a6edd86a376728be1d46b7edeb4523427d1cdd79f2b2f74cfb5de86f9c1c085e2113515e287b349e38e2a022f59babebbfe407556965582adb994f1e7aa8ebca65e6d07376ca72033c178cbb8fe5ea34a5dd25680c01c2cac5f2f5827dee9bbd36e4cc1acc9f0fb4746157d5fecba4b78c47d7ad5ac9c8db98dad93c57dd1ce4001ed4e786babff9178747fb6e2245923fa217fe363aae498ec4daa470c86b5af9e2f914ecfa56494e535ca3aacf5918c6d776e5f2fe34eea557205e40fce5f89744f22cbffbe046a19ae1bf0c7b89c009855e2a1369e3344919b5b56cd64ebe38bd4c6b0aa0b8d4dc1a873df58bf18ce0127a72a6b489a30a5e0ac121880369b2eb132f8e0efb0ad9b7c05dbd128d70bc7ad82367f5b34a2bf3ae09e12bd000502d2de64db1650f794aa784268918e97659699f32b225ab5f6805497c46563f8b2f6cb17c9efebed705452e4e4ca3b3e0b56c16b307fe2563f88a96ccaf31fcedd592e4c95ea056dfbdfb954a8dc3c416755ff41c3fb61a28639ad95107a640a49067dedb10f9c84e6ab3069676f2008a174bf663f52f60bcf7b46438d6fb81389d968d7024d4d40e19358013228daa121a6bad79c05adaf4e87c6c066c13d45adc24f29e24001040236277c23334b8168a4a4bd51a79ddc440ef409ac24f1fc42f3d2ce919d7f677609eae24c69cf49c5f0b0797a653acf42e70bfe7f5ba74b1ea92ef5729ec4836a343222eea3a6b84acb7ebb38bfeb2c5daa1fc9812445b791e142c386e7ce56f25e6c738c51d4e5fa2c6aed7486718943e70444f4705b07ce9b75ab24b0b5a6f330b11cda03e111847ec0ac737d43cbd6166632139e349a0b820a37edbc61c6c1ae675dbeff2af18ca4f8597c0aa9bb3c72c98b152ece5d868d3876f50ddeffcc8869075fdf26624abe5d044333bd4629e892dae814157e75a8bc1c1d6f96c7749b2444a230ba15f5d06a38e33ef99c7049cb36eafdfc48fdf35384c8975cf3b4cbd7b38aa23a01c31897ebb660098eb1a60b955df1834d7ea72d005951390650b3b5e63e0558fc2dc2d7366986366ba51040e76902195d79674f801eeefa10051d21a8e400d814b28cf85ee8b1791a05701831f13e2d1af76d976e693d1a04ca699ad7721d24de1d74828961ba2c5fe24da539e8684560bab0dd14f901c43331c7c65d040d4e6c3f65c5d0e3cee15b879f42d99d109f1fc2b777b18c242aef47ebe2475afaaa0c479db87983126f10f1b24c8a0acf042dd46b19c36fdd024e65b4b5321ca3c623e4107063a94fc3c58011202d6cc3c7e95905c616e42f212daa7cdd87a5235210d53713ec9c0fb5c6502df7ef47b1ff877f142d0012f89ce57c29ae6403273f639eed3517703a39d32d6260e82dfeac7318310648eb42f4e029e20f62f47dfa24c22e1d5c635f6d0881a7074355f628d2c596a9d973b6c7280f0d21830043b33b04243eeb95cc8e48a7cbdd887a215675d6f1a6eaaee9c58b502cfc4b653ccf85bfac1ae90607196e03ce73470c741977c1e0432426d1219269dd3ff1a3a7b21b617b2a577a23d1171a3db635a8ab485d155e6b486fb8525b9fb9c2217d43d8d9eb4162a0616750788957a5736ba0a23bed8a614f514179516f6e25c8dbefa4fe5a4f588e49e156463569f9b9a277bb84bf59cba5145ee6b706412e0a215dd54c6829b2499427faf74410aee125d9cd6da2df7f01a8fdc68774c77bb6ee62b37c2c676d990abca3d95845a4b392c184b5e0d7642a154f29f66b8669b0b75460e7316535498ca8991ec8ccbcf78719fc6fdd7e4a2acbfa26d193a5eba974001c1eb32fcf8d087d434761ca441c80fc8cb12e57a8f782e2b043047f7f682aa433199e7edd5d5aa86877215bb24a3cf87a4e3cdcac744a4f1d6a11c9a4b14c5560373a9916bcaa5d4cd6b2bac4a8f3bd052b72a0fb49367443d6243be6aa4680c00ada1dad43f9e8d257dbb7fbb36f9a5ec04772afdbdd8b6c1ae2143f2790807ebfb06013c2f97da16baf14a81e3121506faf276441801e14981dfbb70dc6e0e3eafa853abf6405ba7e46591acb2ab07da803dfdb3e7dbf1742d3365809dbdfd6050b6b590214080eb839c1518675e28097d7363acd660d0b098e1d77c16758f568d6613b1d69d914ba179bb3d6848f3db9fcf78c1978add6439b9644521ad93ad1a6e16ad62a71c086ff9b95236b63878b22d02fd275a552cf61003e4733b0602bae637f2921bcb5eda56567ad56c7274b4aa4c7c8a05f88925920beb6b8371d4c6c5a391fd3a7579f01190cfaa7753825cdd4729a7371754bd3d43dd4ecb6f8095fa19c8105c4bcfba201c450db9d0696fc80f84c3dcf642274c7f360e03f201e7c626bb5d2f6e96fe9555b3b9baa08409003944aa42b101b38ef064bc5e33cb1dad98ede7551253ed5d4316fb91f4df93965cdaa67b6614a28088a980ef39a58e976704c95ce37909a88a9b3ba7e0bc39f6caaba538d697e266f8a3d762ae0ead72fc474aecc53307387c71a3912eda4c292065f6c40901afb4595d52469cb95d3af31204163a51a544a776a3bd846dda115e303d3f109354e7b4283861edfb3f280793a9f297ebb0515c3c118b87640f3028d94685bb321740f262ef1b7be58b08fee4461496e415f162835d0b496facaa684f509fa78fb44fcc2710ab383fb559d617b07c6b8e71617e0bed179682660f8a91f73c607c16b2169ef050eb69505d9de42f49636957e370220596a7d6cfb28d6a5f4e0510b299e16a7910be142e9b6c03e97e0f1c2c5fd880a08cb0eaf62d612b552c937497acc8e87e0791a2806e6a9c7933a0e3cf223cbfa226db3e1cb99425dc801e919b4d9b04a44392dcc33a32fa437f4e90882ce8dcb5ec68a80023b715482c364713c2a859e0b2cfde82a0d416a5526ced6741600b0959211df65beedbeef68a68840ac54433a11dd42490a18071be2b94306a001b87616a6b6fa2d5def479a330cc87ce72b2a0e214cb23e1fe77d8d15cabd27e5aaae3f71bb504ca956f2478d09e7a378331f0b863ddc258cbf76da817886ea102dd4924ea6db857fe7106a8629f7446f247f31a50689e011dadc29a3ad26d2ceb0b62c4a0139cd928e927d389fc63cedca5766b6e9b73438aa4d5c8f62243698be1cd921bf275c4133b01d2cd59703c274b100d46e40ff67288a1fb4d94b3f1d5a24f70016b90f32e786f75c82f4f584ac29527c3044274f2544b171c27f00155bf44c79cddfc7fdd3cf481021f7991a43ae8b7855698119e6b5b8023a557d8a3ead5916374df7b7b920b670e6eefeae1fa43ffafb45e5fb837d16f94110fa500ec145d56caef3b46b947550dfa280dd77e356f18de6ce920cbbaacaa6849f97204e07b2f3eeb88d8c380da80100530d1a1479c5556a916ceacaa751d1445f1da40b55d93753cf3950a0801fcff3c96da63cb446313744c00f109f158b3fbb1587ecf572a81917748a368f5b17bc4cf1c0787484fa81281203d800ce97b5ee72be7efe5171803c3942a4c647c46ee6a7937190c4874c88d758fa68f442fd87c293fe19374556ea1edaee81d11ffab52e2258db8c15e08742278dbd9cdaba0715de1696bf77591acd4415a5ccab6085b7b657d58f6374a00685c4c11ad61f7f93130ebd2adb3b7c466cafecf17cf6d3f57aa7b7812d1df7bf4ae32ef3730aaae8d07d6811b6949843c3955630be2ac134a437ef12091fde97fc608d8de39e204c2c4e6de703b9581324d0102c06d10a2da24d3bffed013022e2b2f6e41c171113a2ac26493b0458404c53712fa28d98a257b5e8a822316bd6453359c3166ff581e3cce37b405e853417a9539bedf826e63f961e3234d638fee2174c5a184f91f79ffffa2fd5372a8f145b551aa63b2e1181c9f53c3da71ceba01d264edebe7f048c35b047901cbc7ff7b38082fb876cbc41d5932fc12578c4eb04823ef7f2c975d45e92ecc5e38315e494b65d5307a7c17d44cd7076ab81c50a909517f0d20943c48f8994a6cfb5e3b6a2f196a1e9e1f44423e31b7bda92a4c08c64c64cac142e1a61b7ce3a2c40df36324fa1e8689f571222f99855edd3cd88750728bfce302d28e0b1bcf1d10db2674470af757ca863faa7c6c34094d34ec8dcd24a71746b48dafb63633de4b8e943a933edd31ab520b7d2a7219f20ffdbbd634cc2409cdda7739d9b554715f5c76aca942965973d7d653ace61520ef091ffc2740a207d9f472447591220ed63c526efbf5d5a6b4cac0c19c54f9a66a41549bbad365f0548d22ce7a32c800cd07d8c202cf632a81c2541407bf18ee4dccb9086c90bc2a6ace49937483b38d89a02fb7a5fa9fb44e489ee48d39d6dfe0586edf5534e03417a66407ba63f00b2d4c479d0e86976d789acc5655410e13f971ede1fa7348439ac85e26d5b287265f96d83525d74c0f1ca3676f5fdcdbec17e685cf3df2a6bff8e6d7da8e260e170ab27d33e41b2993575e6750e60152191d79377285f56cee50fcb72a7c2a1feccdb4ffea5de4f314569e5e0928c80812593f3dc729ca6f88df385ae2ff45db63764b36113a3faed11d181df62bfa47525bdf237e84887c795e369cbd321c22aba1225620fee7adb3aab318460373613511056781dd3db747b7eef5822630043e2a6f068caeb5fb3f7b79098158fc56dfbd325a0e5e33366383a0fe234bbcc500428f474e422b703e99cdc8ab7798d1161c78c2a37c477e98d3c8489d878b8c4987d19d24300097921630c2035a7e3d62d9e84e1a01fc717f5ec15d275bcf42dadbf8ec26ea292bbe0e5ee5b858d1c4dfb2ad462058155678a67ae9509d2c3b131e7630d1341322203c10ba24b29690c7345b5c87846328492894a760e9316d4d7758e4668cf0130a0d953ef65c33e7c8161abcc536c1afb55638447a850c") ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 198.224146] ubi0: scanning is finished [ 198.232921] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 198.279986] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 198.408791] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 198.415858] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 198.432757] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 198.445932] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 198.460704] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 198.473661] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 198.482138] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 198.492180] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 198.502215] ubi0: background thread "ubi_bgt0d" started, PID 10822 [ 198.509476] ubi0: detaching mtd0 [ 198.520089] ubi0: mtd0 is detached [ 198.528435] ubi0: attaching mtd0 05:02:45 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x0, 0x6, 0x0, 0xfffffffc}) r1 = dup(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(0xffffffffffffffff, 0xc0045520, &(0x7f0000000100)=0xff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000000c0)={0x0, &(0x7f00000000c0)}) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10) 05:02:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="38b12886463b0ba2086d5b33318a", @ANYRES16=r4, @ANYBLOB="dd0700000000000000000f000000"], 0x14}}, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x60, r4, 0x10, 0x70bd26, 0x25dfdbfc, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x2}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40801}, 0x8000) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000300)={0x0, 'macvlan1\x00', {0x1}}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r5, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) [ 198.560895] ubi0: scanning is finished 05:02:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) exit_group(0x5) 05:02:46 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 198.674444] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 198.706997] ubi0: attaching mtd0 05:02:46 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x52040) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x2, 0x1, 0x0, 0x0, '\x00', 0xfffffffe}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_PCM_IOCTL_USER_PVERSION(r4, 0x40044104, &(0x7f0000000000)=0xffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = getpid() ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f00000000c0)={{0x4, 0x2, 0x0, 0x5, 'syz1\x00', 0x5c0d10fd}, 0x1, 0x4, 0x1f, r5, 0x0, 0x1, 'syz0\x00', &(0x7f0000000000), 0x0, [], [0x4, 0x4, 0x1, 0x9]}) [ 198.766912] ubi0: scanning is finished 05:02:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000000240)={0x5c, 0xc, 0x1, 0x2, 0x0, [@mcast2, @remote, @private0, @empty, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, 0x68) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) [ 198.914947] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 198.932763] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 198.973865] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 198.982257] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 198.993379] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 199.004629] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:46 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 199.015974] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 199.029710] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 199.039798] ubi0: background thread "ubi_bgt0d" started, PID 10859 [ 199.046320] ubi0: detaching mtd0 [ 199.054096] ubi0: mtd0 is detached [ 199.062205] ubi0: attaching mtd0 [ 199.066510] ubi0: scanning is finished 05:02:46 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:46 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000100)=[0x7ff, 0x0, 0xea]}) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000080)=0x1, 0x4) 05:02:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x220001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmsg$NFNL_MSG_ACCT_NEW(r4, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000140)={0x20, 0x0, 0x7, 0x5, 0x0, 0x0, {0xc}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x6}]}, 0x20}, 0x1, 0x0, 0x0, 0x51}, 0x4c050) write$snddsp(r2, &(0x7f0000000240)="560b88e78caa58bcaa3f24943207e9fa6b89b860c554206cae908174f3f2a67eab583e9199da506750bc1c18a416c9adf61fb2ae2ef642a51d92164518b7504731f0964433e104afef5cd476348e27bcb8f766ecc80e2314c6b1c52a08092358f74e57f0826dc40ad735edd60931d169ad2e903b62f71b8ef594aa148e070454601a6143e5ec5da661aff77f3fd87900f9ff4f3d33ddc644f577739ced45a54bf6", 0xa1) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x851}, 0x20000880) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) [ 199.147532] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 199.175780] ubi0: attaching mtd0 05:02:46 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) chmod(&(0x7f0000000100)='./file0\x00', 0x1) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x8, 0x0, &(0x7f0000000180)) r2 = perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x42000) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f00000000c0)) r3 = dup(r1) write$UHID_DESTROY(r3, &(0x7f0000000080), 0x4) [ 199.265858] ubi0: scanning is finished 05:02:46 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000e0f035c105c398d62b707f19f56788bda65947b25f9688bf1c2c8bc4c01060e1b6b87b55088bcd25672148294c846222a6a3a3634149d42eac5eab3d29b5f0f431153ce0d3bde0689b0bd3fb786d666c7b05d6c9608eacfad132cca3f6085abac22d9b7bb4d25bcf297ffe0e0fcfb12863b199e0be837d78890f432a78722eaa0e78342f5f5fd35ae98ae6e23f2d2e6d33ac6d0803faa46377774f61fe6a730d278a7615400542ca9a8ec02d9aabd81cbf6631f2c6c84d8837ffdcb59a41ba94e7165ba5e6807e661daa2b9bd1758d35", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) [ 199.512116] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 199.546078] ubi0: attaching mtd0 [ 199.586289] ubi0: scanning is finished 05:02:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000800", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) [ 199.731370] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 199.757222] ubi0: attaching mtd0 05:02:47 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 199.792207] ubi0: scanning is finished [ 200.083804] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 200.123656] ubi0: attaching mtd0 05:02:47 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:47 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ocfs2_control\x00', 0x100, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000080)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000240)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, 0x0, 0x0) r7 = dup(0xffffffffffffffff) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$inet6_tcp_int(r7, 0x6, 0x24, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$TUNSETLINK(r1, 0x400454cd, 0x307) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)) [ 200.139762] ubi0: scanning is finished 05:02:47 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) write$P9_RWRITE(r3, &(0x7f00000000c0)={0xb, 0x77, 0x2, 0x8}, 0xb) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x3}) 05:02:47 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:47 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 200.234852] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 200.258192] ubi0: attaching mtd0 05:02:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x14, 0x3, 0x2, 0x201, 0x0, 0x0, {0x1, 0x0, 0x3}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8008}, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) getsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x11, &(0x7f0000003980)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000003a80)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000003ac0)={@multicast2, @dev, 0x0}, &(0x7f0000003b00)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000004440)={&(0x7f0000003b40)={0x8e8, 0x0, 0x2, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x9}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x14, 0x4, [{0x40, 0xfc, 0xfc, 0x8001}, {0x8, 0x7, 0x1f, 0xe4}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x923}}, {0x8}}}]}}, {{0x8}, {0x1f0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0xb5c5}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x633}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0xc17}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x1}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0xffffff9b}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0xfffffffe}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}]}}, {{0x8}, {0x80, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x7ff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0xc7}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x80000000}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0xff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x490}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x15c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x7ff}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x4}}}]}}]}, 0x8e8}, 0x1, 0x0, 0x0, 0x840}, 0x24000000) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x0) [ 200.330383] ubi0: scanning is finished [ 200.383817] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=515 sclass=netlink_route_socket pid=10954 comm=syz-executor.5 [ 200.399217] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 200.430142] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=515 sclass=netlink_route_socket pid=10954 comm=syz-executor.5 [ 200.458957] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 200.471382] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 05:02:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) syncfs(r2) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r3) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syzkaller1\x00'}) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) set_thread_area(&(0x7f0000000000)={0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0x1}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b7230000a300000000000a00000008000300", @ANYRES32=r4, @ANYBLOB="ff69954ddfba373f48fd4d00642616af562e766c112eca9d456f0bcff713da210559bb4433ab8fd9f321fcc9e827c242eb2faeff6459290b8f43796786267ab9bde450c636693672439be30b08c9528dbbe44c5a0205de3f92a38673d134e408962cf37095c3a676348ed072bff90de8709627a02e16a824974cf0f357ff4afd41c8763efae223f064c39cc4abccfefa4701a55e8e7142fdd02a2b85f4a2c17f43"], 0x1c}}, 0x0) [ 200.482267] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 200.489185] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 200.496303] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 200.503244] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 200.509857] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 200.517386] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:47 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 200.536910] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 200.556293] ubi0: background thread "ubi_bgt0d" started, PID 10966 [ 200.562952] ubi0: detaching mtd0 [ 200.580087] ubi0: mtd0 is detached [ 200.590503] ubi0: attaching mtd0 05:02:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) [ 200.644321] ubi0: scanning is finished [ 200.703587] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 200.731421] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 200.738926] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 200.784302] ubi0: attaching mtd0 05:02:48 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 200.845630] ubi0: scanning is finished [ 200.961570] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 200.985742] ubi0: attaching mtd0 05:02:48 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 201.057594] ubi0: scanning is finished 05:02:48 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 201.144945] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 201.159866] ubi0: attaching mtd0 [ 201.164288] ubi0: scanning is finished [ 201.219711] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 201.230686] ubi0: attaching mtd0 05:02:48 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 201.266599] ubi0: scanning is finished [ 201.412886] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 201.424969] ubi0: attaching mtd0 05:02:48 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 201.508937] ubi0: scanning is finished [ 201.632040] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 201.644073] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 201.655974] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 201.664361] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 201.672125] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 05:02:49 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 201.681420] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 201.692477] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 201.702814] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 201.713008] ubi0: background thread "ubi_bgt0d" started, PID 11052 [ 201.720489] ubi0: detaching mtd0 [ 201.737060] ubi0: mtd0 is detached [ 201.748859] ubi0: attaching mtd0 05:02:49 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 201.784729] ubi0: scanning is finished [ 201.939190] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 201.946374] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 201.960498] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 201.970142] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 201.980952] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 201.989868] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 201.999834] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 202.011933] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 202.024260] ubi0: background thread "ubi_bgt0d" started, PID 11068 [ 202.033354] ubi0: detaching mtd0 05:02:49 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 202.041486] ubi0: mtd0 is detached [ 202.047346] ubi0: attaching mtd0 [ 202.097573] ubi0: scanning is finished [ 202.190783] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 202.218774] ubi0: attaching mtd0 05:02:49 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 202.253507] ubi0: scanning is finished 05:02:49 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 202.384920] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 202.410018] ubi0: attaching mtd0 05:02:49 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 202.454899] ubi0: scanning is finished [ 202.600676] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 202.628382] ubi0: attaching mtd0 05:02:49 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 202.679997] ubi0: scanning is finished [ 202.894431] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 202.911173] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 202.937234] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 202.961579] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 202.982189] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 202.993389] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 203.013992] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 203.032234] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 203.054545] ubi0: background thread "ubi_bgt0d" started, PID 11114 [ 203.064961] ubi0: detaching mtd0 [ 203.073454] ubi0: mtd0 is detached 05:02:50 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 203.086181] ubi0: attaching mtd0 [ 203.092400] ubi0: scanning is finished [ 203.163485] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 203.198487] ubi0: attaching mtd0 05:02:50 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:50 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 203.215966] ubi0: scanning is finished [ 203.333879] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 203.359693] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 203.370178] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 203.380606] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 203.390240] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 203.396579] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 203.410684] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 203.422002] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 05:02:50 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 203.434953] ubi0: background thread "ubi_bgt0d" started, PID 11139 [ 203.441482] ubi0: detaching mtd0 [ 203.453324] ubi0: mtd0 is detached [ 203.457770] ubi0: attaching mtd0 [ 203.500648] ubi0: scanning is finished [ 203.588938] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 203.599959] ubi0: attaching mtd0 05:02:50 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 203.650098] ubi0: scanning is finished 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, 0x5c}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r1, 0x400, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000c0}, 0x240040c0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r3 = socket(0x10, 0x803, 0x0) msgget$private(0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$DRM_IOCTL_AGP_ALLOC(r7, 0xc0206434, &(0x7f0000000000)={0x3, 0x0, 0x10001, 0x9}) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000080)={0x8, r8}) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r2, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x0) 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40c2c0, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r3, 0x8983, &(0x7f0000000080)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}}, 0x0) [ 203.811279] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 203.818953] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 203.825864] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 203.837647] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 203.844882] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 203.855684] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 203.865944] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 203.882664] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 203.893311] ubi0: background thread "ubi_bgt0d" started, PID 11160 [ 203.893437] ubi0: detaching mtd0 [ 203.914216] ubi0: mtd0 is detached 05:02:51 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:51 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) [ 203.938155] ubi0: attaching mtd0 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x80000000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x20, r5, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf000}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0xa8, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x64, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x17c8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x81}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5aaf}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x10) 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c198000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) [ 204.001879] ubi0: scanning is finished 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) getpgid(r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r4 = perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x42000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x808c0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x8, 0x0, &(0x7f0000000240)) ioctl$FS_IOC_GETFLAGS(r5, 0x80086601, &(0x7f0000000080)) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000000)={0x0, r5, 0x4, 0x5591, 0x3f, 0x317}) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) 05:02:51 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000380)={{{@in6=@dev, @in=@loopback}}, {{@in=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000480)=0xe8) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f00000002c0)=0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000ea", @ANYRES16=r7, @ANYBLOB="b72327bd7000000000000c00000005002d000000000008003100060000000600280002000000080034000ff4ad1f05002e000100000008000300", @ANYRES32=0x0, @ANYBLOB="0500370001000000"], 0x4c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x44, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0xc080}, 0x40001) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 204.124214] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 204.135362] ubi0: attaching mtd0 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000080)) lseek(r1, 0xffffffffffff69b1, 0x3) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r2, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}}, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x4c, 0x2, 0x7, 0x5, 0x0, 0x0, {0x5, 0x0, 0x9}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x10000}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x5}]}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4c841}, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000640)={{0x3, 0x5, 0x9, 0x10000, 'syz0\x00', 0x80000000}, 0x0, [0x0, 0x8, 0x4, 0x5, 0x6, 0x6, 0xa7, 0xad1, 0x400, 0x0, 0xb01, 0x8, 0x4, 0xff, 0x9, 0x579, 0x5, 0x2, 0x7ff, 0x6, 0x9, 0xa47, 0xffff, 0x0, 0x4, 0xffff, 0x85, 0x101, 0x0, 0x9, 0x0, 0x3f, 0xfff, 0x5, 0xff, 0x8, 0x5, 0x4, 0x3, 0x7b1, 0x0, 0x1, 0x6, 0x400, 0x7, 0x100, 0x3ff, 0x8, 0x7, 0x5, 0x7, 0x100000001, 0x4, 0x200, 0x400, 0x8, 0x100000000000000, 0x3ff, 0x8000, 0x1, 0x5, 0x8, 0x7fffffff, 0xc32, 0x7, 0x80000000, 0x1f, 0x6, 0x8, 0xff, 0xf9, 0x1, 0x7fffffff, 0x7, 0x4, 0xffffffff, 0x9, 0xfbd9, 0xffffffffffffffff, 0x314b, 0x4674, 0xa205, 0x7fff, 0x2, 0xd71d, 0x3f, 0x5, 0xfffffffffffffffa, 0x5, 0x81, 0x6, 0x1, 0x40, 0x6, 0x84, 0x3, 0x2, 0x3, 0x3, 0x8, 0x5, 0x20, 0x7fff, 0x1, 0x0, 0x40000, 0x80000000, 0x8, 0xff, 0x80000001, 0x6, 0x5, 0x40, 0x401, 0x2, 0x8, 0x8, 0x5, 0x4, 0x9fc, 0x10001, 0x4, 0x0, 0x7fffffff, 0x4, 0x3, 0x7, 0x7ff]}) [ 204.189300] ubi0: scanning is finished [ 204.235784] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1794 sclass=netlink_route_socket pid=11202 comm=syz-executor.5 [ 204.270266] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1794 sclass=netlink_route_socket pid=11203 comm=syz-executor.5 [ 204.321597] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 204.332589] ubi0: attaching mtd0 05:02:51 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 204.375934] ubi0: scanning is finished [ 204.495983] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 204.505573] ubi0: attaching mtd0 05:02:51 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x200000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r6) r7 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r6, 0x84, 0x76, &(0x7f0000000440)={r8}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f0000000140)={r8, 0x90}, &(0x7f0000000240)=0xc) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, &(0x7f0000000280)={r9, @in6={{0xa, 0x4e20, 0x401, @remote, 0x200}}}, 0x84) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xf) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x0) 05:02:51 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 204.553368] ubi0: scanning is finished [ 204.668648] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 204.675724] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 204.683640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 204.690687] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 204.698242] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 204.704543] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:52 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) [ 204.713779] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 204.724162] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 204.734466] ubi0: background thread "ubi_bgt0d" started, PID 11236 [ 204.741042] ubi0: detaching mtd0 [ 204.751973] ubi0: mtd0 is detached [ 204.761362] ubi0: attaching mtd0 [ 204.790812] ubi0: scanning is finished [ 204.875269] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 204.882748] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 204.890836] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 204.899116] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 204.905969] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 204.912473] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:52 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:52 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 204.920342] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 204.929999] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 204.939813] ubi0: background thread "ubi_bgt0d" started, PID 11248 [ 204.941979] ubi0: detaching mtd0 [ 204.955381] ubi0: mtd0 is detached [ 204.964812] ubi0: attaching mtd0 05:02:52 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 205.006010] ubi0: scanning is finished [ 205.134886] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 205.142051] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 205.150057] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 205.161356] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 205.168382] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 205.174558] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:52 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 205.183662] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 205.194115] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 205.203921] ubi0: background thread "ubi_bgt0d" started, PID 11269 [ 205.207437] ubi0: detaching mtd0 [ 205.219666] ubi0: mtd0 is detached [ 205.225836] ubi0: attaching mtd0 [ 205.264484] ubi0: scanning is finished [ 205.346279] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 205.353574] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 205.361063] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 205.368300] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 205.375155] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 205.382174] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x8, 0x0, &(0x7f0000000180)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, &(0x7f0000000380)) r5 = accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000240)={'raw\x00', 0x45, "7c0d85357cb825ab5b5fcc70ca1b77ba4d81849bc4f20deffb3768159cd47550713e0751df673b9faa8c03c6968bee7e26af8384709a0ce0245a03e9146fb3b7984c188f04"}, &(0x7f0000000140)=0x69) r6 = syz_open_dev$radio(&(0x7f00000002c0)='/dev/radio#\x00', 0x1, 0x2) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r6, 0x4020565b, &(0x7f0000000300)={0x0, 0xffffff81, 0x1}) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}}, 0x0) 05:02:52 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) getsockname$packet(r0, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 205.391476] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 205.402580] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 205.413627] ubi0: background thread "ubi_bgt0d" started, PID 11279 [ 205.421170] ubi0: detaching mtd0 [ 205.429521] ubi0: mtd0 is detached [ 205.433711] ubi0: attaching mtd0 05:02:52 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) 05:02:52 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) [ 205.492920] ubi0: scanning is finished 05:02:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x14, r1, 0x200, 0x0, 0x0, {0xa}}, 0x14}}, 0x40000) 05:02:52 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) getsockname$packet(r0, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b723000000000000027353a7ce2ea4c30300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) 05:02:52 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) getsockname$packet(r0, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 205.683937] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 205.694131] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 205.705605] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 205.713429] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 205.723630] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 205.733159] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 205.741986] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 205.752547] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 205.763406] ubi0: background thread "ubi_bgt0d" started, PID 11308 [ 205.771045] ubi0: detaching mtd0 05:02:53 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x40004}, 0x20040015) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$sock_inet_SIOCSIFBRDADDR(r4, 0x891a, &(0x7f0000000480)={'hsr0\x00', {0x2, 0x4e21, @rand_addr=0x64010100}}) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000280)=0xc) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000340)=[@in6={0xa, 0x4e20, 0x10001, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1f}, @in6={0xa, 0x4e20, 0x68eb1e28, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}, @in6={0xa, 0x4e22, 0x40, @remote, 0x5}], 0x54) umount2(&(0x7f00000004c0)='./file0\x00', 0x2) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, r6}}) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080)='NLBL_CALIPSO\x00') keyctl$join(0x1, &(0x7f00000000c0)={'syz', 0x0}) ioctl$USBDEVFS_CONNECTINFO(0xffffffffffffffff, 0x40085511, &(0x7f0000000500)) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r7, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}}, 0x8040) ioprio_get$uid(0x0, r6) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c00005170362de75e1d3e7a1d7600a45138b1388fc7cd1f03ae9b550b8c959590a5f3283ba2ef8ac27c67", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r5, @ANYBLOB], 0x1c}}, 0x0) 05:02:53 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 205.782605] ubi0: mtd0 is detached [ 205.788196] ubi0: attaching mtd0 [ 205.814576] ubi0: scanning is finished [ 205.963762] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 205.971055] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 205.980491] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 205.988878] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 206.001892] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 05:02:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$LOOP_CHANGE_FD(r5, 0x4c06, r2) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 05:02:53 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 206.011118] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 206.019301] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 206.029068] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 206.040009] ubi0: background thread "ubi_bgt0d" started, PID 11330 [ 206.043346] ubi0: detaching mtd0 [ 206.059747] ubi0: mtd0 is detached [ 206.090832] ubi0: attaching mtd0 05:02:53 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_PCM_IOCTL_HWSYNC(r5, 0x4122, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="1be400000000000000000a00000008009d006ddeff9b2b430576cf58ad0300baf4ad197b223e7dfe2d3673c311115dcdfa3846e067", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) [ 206.124373] ubi0: scanning is finished [ 206.291218] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 206.299687] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 206.306467] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 206.313213] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 206.320251] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 206.326429] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:53 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 05:02:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 206.334464] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 206.343847] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 206.353192] ubi0: background thread "ubi_bgt0d" started, PID 11356 [ 206.359982] ubi0: detaching mtd0 [ 206.378003] ubi0: mtd0 is detached [ 206.382203] ubi0: attaching mtd0 05:02:53 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 206.402440] ubi0: scanning is finished 05:02:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) write$evdev(r1, &(0x7f0000000280)=[{{}, 0x4, 0x81, 0x2}, {{}, 0x5, 0x6}, {{r2, r3/1000+60000}, 0x11, 0x3, 0x9}, {{r4, r5/1000+60000}, 0x17, 0x1, 0x1}, {{r6, r7/1000+60000}, 0x16, 0x8b3, 0x4}, {{r8, r9/1000+60000}, 0x16, 0x8, 0x8}, {{}, 0x4, 0x7, 0xffff}, {{0x0, 0xea60}, 0x14, 0xfff, 0x8000}], 0xc0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r12 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r11, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r13}]}, 0x1c}}, 0x0) 05:02:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x6004040) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x5841) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1cebff00", @ANYRES16=r4, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r7, @ANYBLOB="cd1385af098fc04068415b5ed8f2ead9a817fcb86148583f36dbd80dcd85b520a5a8b34fe827502b9b16e68690971240b66b94c93e0ff4f13c6c0c91836278636fab8ca764a00a70d38e9020308dafa220465b7f47b09d3f941b0f038dbd3910aa346b90ee6de0275347f3536940634d"], 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r7}]}, 0x1c}}, 0x0) [ 206.593034] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 206.609407] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 206.641909] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 206.652940] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 206.668882] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 206.675189] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:54 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x5c, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, 0x5c}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x5c, r4, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xfffffffffffffff7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x40}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x20000004) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340)='batadv\x00') r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c009879c15654000cb4347b17cd22c995d8e1cb4d1e9386b37fd19a0274f078c1c26d6f9e7e8b15ebd8a8ed3371d44d8c5e977d746eaa1fa60bdd63acd24c1b01833b409cafe0ee1d83db748f8fdded18712ca383e91c63bcc1e6eb7518014ba40ad24ef1a9583f8340a49fb49821e5f80a7246c42d4001359b79aab2934c585bd882782e0b7f7f4865839aea823ffb9f315783cf9ab2fedfc34d770df3317776", @ANYRES16=r5, @ANYBLOB="b72300000000ebffffff0900000008000300", @ANYRES32=r7, @ANYBLOB], 0x1c}}, 0x0) 05:02:54 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 206.685624] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 206.695473] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 206.707541] ubi0: detaching mtd0 [ 206.707568] ubi0: background thread "ubi_bgt0d" started, PID 11382 [ 206.720295] ubi0: mtd0 is detached [ 206.724589] ubi0: attaching mtd0 [ 206.731524] ubi0: scanning is finished 05:02:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000240)={0x0, @reserved}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket(0x23, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\a#@}', @ANYRES16=r3, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r5, @ANYBLOB], 0x1c}}, 0x0) [ 206.787632] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. [ 206.808408] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 05:02:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_LISTALL(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00082abd7000fcdbdf250300c4afefc0961d49790000080004000300000008000700ac1414aa080002020009000006000b001d000000080007190a010102"], 0x44}, 0x1, 0x0, 0x0, 0x5}, 0x800) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 206.834107] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 206.854640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 206.881519] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 206.896353] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 206.902624] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=11407 comm=syz-executor.5 [ 206.920735] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:54 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 206.925788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=11411 comm=syz-executor.5 [ 206.928624] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 206.954675] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 206.965072] ubi0: detaching mtd0 [ 206.965095] ubi0: background thread "ubi_bgt0d" started, PID 11399 [ 206.999627] ubi0: mtd0 is detached [ 207.003595] ubi0: attaching mtd0 05:02:54 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 207.044262] ubi0: scanning is finished [ 207.207982] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 207.232365] ubi0: attaching mtd0 [ 207.248338] ubi0: scanning is finished 05:02:54 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) 05:02:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r3, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000380)={'batadv_slave_0\x00', r6}) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f00000003c0)={0x160, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [{{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x1000}}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r7}}}]}}]}, 0x160}, 0x1, 0x0, 0x0, 0x4c80}, 0x40000) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r8, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x0) 05:02:54 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:54 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:54 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 207.331696] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 207.371374] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 207.389253] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 207.423389] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 207.430990] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 207.441894] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 207.443918] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 207.461103] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 207.469331] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:54 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:54 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 207.485736] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 207.495714] ubi0: background thread "ubi_bgt0d" started, PID 11446 [ 207.507286] ubi0: detaching mtd0 [ 207.515959] ubi0: mtd0 is detached [ 207.538271] ubi0: attaching mtd0 05:02:54 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:54 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r6) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r6, 0x84, 0x76, &(0x7f0000000440)={r8}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f0000000000)={r8, 0xffff}, &(0x7f0000000080)=0x8) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 207.614632] ubi0: scanning is finished [ 207.763063] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 207.774903] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 207.783791] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 207.795629] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 207.818961] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 207.825391] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 207.834348] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 207.844121] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 207.853711] ubi0: background thread "ubi_bgt0d" started, PID 11493 [ 207.855521] ubi0: detaching mtd0 [ 207.865964] ubi0: mtd0 is detached 05:02:55 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:55 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:55 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) [ 207.870127] ubi0: attaching mtd0 [ 207.881120] ubi0: scanning is finished [ 207.945342] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 207.955151] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 207.973334] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 207.981911] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 207.991872] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 207.999990] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 208.013548] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 208.024900] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 05:02:55 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:55 executing program 4: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 208.043836] ubi0: background thread "ubi_bgt0d" started, PID 11503 [ 208.051535] ubi: mtd0 is already attached to ubi0 [ 208.062179] ubi0: detaching mtd0 [ 208.073862] ubi0: mtd0 is detached [ 208.086008] ubi0: attaching mtd0 [ 208.091890] ubi0: scanning is finished 05:02:55 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 208.181819] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 208.188988] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 208.195662] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 208.222820] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 208.231974] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 208.240681] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 208.249814] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 208.260884] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 05:02:55 executing program 4: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:55 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) 05:02:55 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 208.271930] ubi0: background thread "ubi_bgt0d" started, PID 11527 [ 208.271936] ubi0: detaching mtd0 [ 208.288798] ubi0: mtd0 is detached [ 208.292748] ubi0: attaching mtd0 [ 208.368321] ubi0: scanning is finished [ 208.477618] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 208.484940] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 208.495512] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 208.503174] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 208.520065] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 05:02:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x420001, 0x22) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x72) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = gettid() ptrace$setopts(0x4206, r6, 0x0, 0x0) tkill(r6, 0x3c) ptrace$cont(0x18, r6, 0x0, 0x0) ptrace$setregs(0xd, r6, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r6, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(r5, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f00000028c0)=ANY=[@ANYBLOB="240000005a00020028bd7000fedbdf250008000200", @ANYRES32=r6, @ANYBLOB="08000200e3617ff4de0e934220cac2a29792be7a829bba6ec5ca9e259d1cd560eca1f94f884f1704e10686c77ed4495f3022c6f443b444649fef8c9124539d31ea03035a33496059adc5bbde5c27871bc7035f5abee222774458a03634cc7eea4f89d6b2eacc518d975af527ff42120ecbcbbf5897d53feed652bc2d1efd5a9ab98418", @ANYRES32=r7, @ANYBLOB="6c94004829c1ed4d42d89e427dc3ac9a697c2f25ab59c7bdf455b4b68241d169553ce1a0c5b7cf602e79a3caf0990132fbe356a65c5b9f7eb6ac4914da8a464be7f3434dd0059e1b4fd8", @ANYRESOCT=r6, @ANYRESOCT=r8, @ANYRESOCT, @ANYBLOB="f1b795f2d195c67064c436c510508ed70685b28be169e43052a10eabc2a6d74a0d8c0f031fe6f591ebccd530133213b320ea8f49a972b2a03e84c8bd6cb82cf5fe8d67b7da6ec3f61e95e63d3435c841f1a0e536ea2f195ada7abb13a8a139fba73d5f8f179061bc62f3c6d8eb9a7a0664c8d3ca834e3eeff86f5b6dc4cf508f90e00978e9e3c8c4f9240224043752504636d668ab6be08e6262cf9ed624de0a69cb18a208018c7a5fc2c715c16798c5289e7be187243d70671a055c6589233bf0b1bd29e4b4a7834a3687b9f62d3dfa20eb3bb69b4d3a0b81fec9c6e57862928578bebfac2384bb70d0156bc3400e77d1d13b66c8a6b0b4c5adda1c96fe7198c7debc1f783c44d9d942e0dee8c9a8f7ac3921239d043378d921600c158a56b2f22dbff7e974dc9211bbc7a49885aec180cdb86dd82c1824c55ba564b7af852b50e872f94a54d4f1709b7ab50678b2cd2d655bce828dd73a5dd7c9a14ff6255b31bdbd9c8c600dacd7b01f963aa061ceddc73a765789ae6b91119abc50275d0e062e0bdd8b896ec191408bb5af023481ede5f31ec69fb4e6c7a001cb5db2365944b29eaed4c55736584c91616c13c13a81984c4ed66c1fd916ae6932b04a213fbd38b6e7520dde795d3de17a66a256722829642cfc486ac00209e30f92091d6a5f3c7698f445e0ad51b10fae8f399f84ebea34ad1d0e96c6ff9f7e88f2c4fec1919a5498ac337e1a333cef72b568b67c6c2fbb8d40156465f0df57fe3cac97a30f579eca07655cd7cf514ea99db9d3eb2e0ab76e444380c8892c41940f84484c6746774f2a014d32e38b55109738123dbc227af87d2178928d29c97b84f469a484c2582d6449fd3bfe939cd9f2dece2be1e4499f0570905f4ee65ce13c11ea6f5aecca5a5d4d1b9a386641aeee63da7ef99677b44f3e2aad4659fef76ddbf7320e549ccd8d8a95d27baddd350025f428fa2ae889deee1f31b1135f3a02a60f6877e12864de382881cddd8654cc2b5085089102393591fcd6e9b8aaa54ab632e65232a24d10c50c63e5052ee746e45964a035a52104d4d3430f2050e5d26d440950048c3cafaa88f588c6b440ef8a8926600d7bdcbdeaa4e534389954fcd8a4a62d29599f41e898ae9b77984d2c79a7b88e4a0d39174170ded698173422004c5863edca6492c9fff0999e9705d51efb1a1da3ad40f6dbb513e0bea7eb0e09d1da1b7842f335c1fa51d56d07b1442dec15dda5e5f53198c1d75c5ea0b2644990c058a0db3213e203a21a158af467ead36a3c135aa3877671e0f5ddcbf95d748f2b666c90c209242f9a48c00f04701fa9259869231e5b64c4f2a9454f2d2c268125e6b8c675e9eb9bf7e2d1a99ada6474ec30b2587fee8da3b9936799d77b2a3a56b3136e8ec2a3538e17756e59a87e381fcc465168edc5abd403e6d08b9a7d3e9e163fe379e75b0b2b90a181bcf993a8c5a29c5363a8ce849fa4f1f8658a11ca465f16f4cee99b64022216b300f7524bcdd0915655e7aba89bb87f872b5649e406f404e3017ef8eec190e547a76dc2843743979ae872288ffe8f18268ac9d3df8db4723b5a7375f5e84fd0315c54c5853d0ad60682089927ea312c6c445edcd0fb6c7b6fed5a8e6f9028ab083e6b3734bfcb100f207693ab8cce5caa9a79af363bb1b36384a4d4a9556b4bee623170b14b4de1640de381b7bdc3123b93f8d9c42de7f0978868599fc386461f420bfa51620a2f57cce57a4ae9dd3eb2e5abc4d3cfd9fa0cb5cd0928dc20d515883b56a833ec2bc8beccec5199e8156cdb35a0b146746813def282972782e11cd1b18ea538c8ffc8c167078dbd3ff0dc846208fc20a6ca01319bd04f517c2a46c590da96d3d8614f2a60e6724dbacdbcfeb729399eff72df671af30f8ea1e667ce0fb0ae843c9926e7d6523cfee1e0cb1915b1cbd43cd0d44992fb1d18c54458161453fa409a304ef944185b2a21e8242d35f86bb2666375476ba148c362ca7a99be06945e467ab5872eca6d452940df2a3eb79098ac9574a1ea7684452a666280b875c954de5ef359605ae78a131337fc6b024bcdc48fd49acfded38c2acbc480c0e4efa1d2cde5c9202a30fc2126f8848b9cbbaa03e6616bafe91c65ff68331ad07f2f0fe2339e932b3fea1dbaebce73fcca810fa07ceed1e2fc869959f71addfbdec54ab098876f42b675416cd20e49f833b48bf08f74b2ad02fe708ee88ab6e8d6f52cd2fe4aefbf3f8ae2b81501c2f0ca314ae646ef12ceb37489c22926647def4905e450dacc2cc6c712747271024b4d4fc4c420130d43e17ecca0629cc4adbd776e718f337c18169ac109beaae327df9a59568fff3894a81a7e41d5e81b7f81c63c44bdb95df3133c0043e9f5d1e3a20c8963297c33801d8bfd2a70e74cecc2efd42f477de7ca7974145e51f02c5398027ec61ab867cf5543375a44708bc2f13f55a4ca12dd33f6c904b9970f235c91e05b1d42ba40588fbb59a72a6464bcbf5c86bb1206d8fe5a75ebc2aa02acc906bae0c345b84268d5945669a84e00e4ad16cff0048ad15399b94aac958a13b6bf0bad3a4721efc8e27afb888b141a444a95bebb485c5a2cf8ecdcaf41ce367bbba6ce27dfb417f8e71caab8ce9e3d1898fe1d76af05bcfe1f4c5c9f2f045b042f35be6ef82fcd4fc3ed4af390442390f18618c38ce27b15d19ebdbc7ce7ffcda9dd1e3872c1cf4d676817ec50833bbebeb272baa6b95f1e06f5d54bfdd39f45b91fc5af2324d45102a2dee6aab705829127492389115286bc1c6ddef58afcfeb8972ca4049110e2e7923a59b768057f4dd99daf1413fc802a80641f7e71a6842da3a6b91a127d7f7bb92cce3331ce29f1ef26d6d2cae90ac5d5e5998654a21b4c57091b30b4f04e83a0a002000000000000003fb79f189c4f5fa869a0a5ba032f7bda5ec59f59b02626e41570164bf7a561de7a20104219f9de9c21810f9fb6fff499a41db30b43495deb44e35b9eb5abcb8802c572e056e305d69686419a0799a79e9a6481e7b885b9a654ba0c003aca79e557f5677184c5055a1c02da3c56457d76a8373f8f7e13422ca54733cfd6c3d6af1d8361810fd84a202dee127306ef0998b8aab887129390b8fe7261508e8ebf031689f0509a1915165058ac0353d155eb69379755330489bcd07bb937b9762609bbd880a9267da99cf8039a90e419a62f2cae4ca7a49ba9c13a0899f1274a6ae76372770691bb7cfc15c3051471367b525052054b0696c3ff5581d340640b20875099177e6ac398fef142517d54241121b3f71f6f6edf87b9ecda2c67ab42851fa471a2d24f792adf7b259372dcd7017e21356068d1d55386c686e5cc5f1385b0acabf5b266b9342096479024a56f8b8ecebb07dbb5ea396f7fe58725481d6898a32536d48171cf653cdfcdc2c04677b42d78e53054fec08de6301c1e86ec0438be04916b876af0f16d737dae8a7c92fd8fd19a5a692c8302eecb2b2b0c040d7f48bd67b7a65ff030e703ce6680c44d2dfb45573f14886309a7947b3df5d9e918784cb2ac27d2c14638b77a87e197945f7b7da8ce118e9596ec7b3e584f978c61d5e50d6bae9a70f5be0da8dfaa4610190b8847c809339a62a7cdc887a5987f9fdc62a58b082203a2f4e07dd2f9fc37c58be1a9fa66fcfdf1b55a48d1cb2dc1c036c7f39f9aef44a7375e80b1954fe93f39b7ef224e09a5f813adf3bc64ccfed750ec1e6b2ea7baed0c1a280018b71ca1e0609c443506598645c002bab80008ca466ed3a42a1593a20f249f8a55c3f8c75d427ee6faa755e4d5522ac4682124f2d53ebafe29329ae20ef5d0d31d7b85a955720fd4b4e55635d4c9123259550594c301b2f03d6e021989306533c5b3a3a8e4c9a51f3c600644eaf4040830f9aaa42263b7db041ae27f0b81d0d18373509150b7db30bf69ff668d6b86514ab747b1e2ddfeb7a75bafc285ffef44475830450c8e6d20fe3e526f67205e376d694a27a3fbd9e2e11e4aeaba54d11b59fb84e9d673b7d99091dfd31dae1737481f05f39d0c8bd0781098f6f44fea2deb725ced6f836e983a43b07eafd150a8fcff364cb2b0bd81ddca06bbbc18c165f2e01f4e2a56372501f1a60f6ee05b8d0c393f6c3bf8de0708cd044bc9963e57d6c922bcc265dd4284b2ce807d3c8b4bccdae29d390015ce602587d10969c5079c699f462735a68cd37db86069f3c130e6a32b31544b24768de805ec7c64edb7a2e5e4d450cadd67db76de81ff1055ad512d4b46cd1a9d27910cc54223b7b6c44ea7aed81d07930cdac5a7c8af289f56bd87ac0f96e122639bb05a6dda0a1a11cddcb5d6827c3867e42a5e9e8db12afc4955d8780373451480ee6e39733586dffcbb97466dfa3aee6a4428f27f3591c7f44313fc35881fdeab51d7178b9836f9cedc7e817045db9c5f0da6857233a839c477d332d37dee1d32ab386f8c58b0fbef0d1942d5f979c6b5782cae8984a066fe727ffbb1cfe23f4805949bf0ecb3548a43fecb4ee5f3440306bfb9a511680a84988a5983b6057731c85906defeee219ab6191c54282263d8061e9a7efd2529d49b41ef3346a1d5338d6ac57b91f4dae702450c91f1905a7ce76f4aad7f17a6b8abb02b42236f077d6e19eda69e9aaa7149f5a9894b0198cfe7f19a944e7b1fe5739a8316d706bd3e74a8b6be80fcbdd242300281a6b6d648f1e52f36ec3d7467d37178d8356d76d6e744e8cef3e4efafecfdbc41a89282748733582d773db7d8a65fb9a925d63f084dc333734f07153a45d463b311b9df47aab8658311e980b0168d615e6efd82f80fcf2c856178f092f4bcdfc0409eed5b841b9f8feb901e653934bc3daedb5ae5ff62e7025ba0f962825c556f68a872d127d9b14a0823fb748f379bd8d9b56c559cfcb409903e537ce186f9dcf24e40bbe24709d72fa6ea20d103cbcd12aa002ddec1dab340621809f4e96c466a6ca2c7da9dd8a6d71f0114276f800570f89828813238e1ecd6ee70da6772901f65f3b94bee972a31e9678553e72fa99e1962bd56b8fb035956188985bac1b9bd64da3af7d512aa80b0e260fd74854da61c44bf4ede619423a4df594ba7c143b59d49ecb46843f824a0351dfb33cad7ded0248e39c9560fe43c8c5f877e7cc03d31b005b016735c13a6c49ce7546b45d674548fa217926f9d23b75d66ec10de97d6e1ac56ad5dddaf5ec1456a6cbf5306541edccabe8ed516ca8cd9fc7fa1b7789c469f0df1e11d9422953c757e91de8f4754c3a93f644a8001f2d8f310a7e1b3751579fb226ee7b1c902ca50135976cb0f81ebf351d461882a95f73a13d8c546d85f785a8d4b5f54a7608b89f09a3c28aab5a85b768ec4592ba94513f3bd65f9b5fc9ee73ad84a4af65a86fa34eb29969797bb1351cd951852831e9f703b58cb02f268dcf137f829832bb3cb75ed085a929868a5bd51a39e5b97e5a50a0677dd01982b2f998ce1abca5c8b0a77e9e5b2bd1ab806a20fe193cf117f13a5bd16d9779f0b7fd45ea58b042200f90a9454c7fb7025ae66d5f358d07807cde9d511fbacbd4675d24d7fad118a8bcedec4454b0dacc8f13f7c50c19f0eae4227ad68e688c8a60f22eb0613cda33239b529c78eb8a5946341653124a95dda11d932a2986e8ffe7b0ec2763401b20865546f16de366d244927a7d05fa15cf78730d49a14b96b050793e1bff1a790ce2bf65086a1a0bd5edb428fa6ff4e09e3e7de5f03e49a7cdc810dc096e8559f397cafcb971b650a999b9b4468899d733c0cf411", @ANYRESOCT=r6, @ANYRESDEC=r3], 0x24}, 0x1, 0x0, 0x0, 0x4000080}, 0x4008040) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 208.526348] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 208.544150] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 208.564425] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 05:02:55 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 208.577583] ubi0: background thread "ubi_bgt0d" started, PID 11555 [ 208.584410] ubi: mtd0 is already attached to ubi0 [ 208.592459] ubi0: detaching mtd0 05:02:55 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) 05:02:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x20004000}, 0x8040) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700)='nl80211\x00') sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYRES16=r6, @ANYBLOB="96af14a8128c6fefa8f1", @ANYRES64=r6], 0x6}, 0x1, 0x0, 0x0, 0x2004ccd1}, 0x4000810) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10002}, 0xc, &(0x7f0000000180)={&(0x7f0000000640)={0x103c, r6, 0x30, 0x70bd28, 0x25dfdbfb, {}, [@NL80211_ATTR_BEACON_HEAD={0x7c3, 0xe, "1a948753a13944cee0d4d8efd0156c7941735dc54af138af2d43886428f0595ff2945fb557b3928af0bdff8306b8dc0d51e868071a18785d04e72625b12d8bc107fad5d2e30eef8d43b9d160b36416938898d709d8afe7942dba37884952f58c0c82224e1ec23b0c607a5a0253bbc3e0468d7e1f7828077d91ad65d7a8bed4899ff4b476770d9e066420148063aa94ea4824807bcec3d5fd20eab8efd2452d306bbba3eb67c5e21f55d0912ad2dd3b78f285dfa4a9e6508bd4e3905cc7faafa17c2c762a84d29c2445e1d3d8a45399df3398292495018ca993de32859e7de2e84b15ed88bf98bb7f0bb206637aecf2c353e61ccf6d800ddba900658ec8fd4bd67e848a76b4975dbda1948d85d085c0df368a7a8dadbe2391e656561102295dc15591b0747924db95320ae73335a2e6df035f126b88a3d3087cf9b3545c434e365d2de801ae42c833b283aac913c3c098d49b89cfab81da92aa7efc611f1e183e6dbed5fb8acb0cc70cab03b515e343f9ca5e76c45bd4725a1230c0a1b8bda88856fc2179ade290160ce093c1d58d3dcbf2f5da17c546f3cb3aaf710bcdb06e14722112f5b003aea83d32cfd051c40f8e4533b29251f32b6ffe82165ecbf146ca4214a15a8dd80c061d720cdcba2a8eef90ba6eef41dbf324a1f57e05d8b468e13808038247635e2420398121593d4867a2e5dffd17470a2d452d6e102cadb6477f9e5b8824ffd031b107ed4c9f0f2596a80353b6348efafa2e9906bdb94d31fa7918f223581e369cb99d9bcc1498f7f9b91c80cf681596e4b10958e1c8e0bbc7c65e3ef22e0127da65c5650b9e470872e0b1602bb79a9a03bcb3d883c5caf9da2c5bef2b09f04fbb66826ecd778b975ab1cb831fecc37b3a0a95102ca56e42368e2914cd78ee5e631712b3c65995cafa70be043c92264095fd330544ef604f44c5c7c8be26b4d336840c0f256fe443f7ac4a2aeaa49798dc6274ba192246511b106781d0548cff8be959846a1a8fd28d58c133198395559eb3834ab49b8eb32de44430e5fce0e25844b576e1af6c9eb106b884d1451c617e0ed9295466866eb42346d146c2fa675ffdd75741ed6826a9cd5e42046e748ba4154164b4464eb1a2c21e2dd788d1b23fdc0172aa10532c6492a23d8724e5c7ca7aeb223949f680430fa7a440682494a297b76cd3cdbba30eade22eac723cddd1daca542e09e91e87f66a2714c315573c984939a90886a93065a6e89ce92c813511bc9470f7d44dedeb6140fd44c758ad44f2c946ce8b4e4696a0959c714bf6da5ccb660f09a8cc282859c0b27e5a59f219a7fc1907aff924e04f97743f00467db5816d2f438722b1b58245b5b5b15ea588662acffc663f1c79872cdda4c7e712bca9fa3d27c217298a7a3be1fc14ab617e46441f42d95aa523be5bf52befab1d07b6c044911d8111d218ae34d5f3c49fb1deaa7b187515b3e8d5d9233aee6a66e114362333343369bd6eb9cfdc7b7aa817211e1fdfd53e415c300e6fb37cf553355b064b5f7935656c962484eb820ae803fb0c7c77925e2328eea5bc877251dacf05c89880830223ac096b52ab436e8ed9c717f33e2e80c68b49215ca2bd0f86d69f07f3f63a80224857c941ba20c93ad2ad89a908efce07096b31a812daac09b69dd391268a5214a5d493c49e98255ca0c1d70557121bacda8885784d185e15a6f12ac2e30189257fd07aa0648ebbad00234fe4bbdbe1d37c39a1327830eb683b9892d03e3f9dce458e54a4cb032aff246f7054d3f2bd88e78eb6cd073ca9a994838b3480921e206dec7d81aafe26302917db2f28d5152e5bfd0252cb6dd027146cf7cdc26a90261b6aa62daf397a54bf667e50b206c18b2af1883c6532192d2c61d6baae930323868c150a4f95d43908ac3cb6b7fd2b3b1ef16769a04d0118c12d4f7202e547816afa3568b7eed24fb12747b501a72dcf82ee0ddac636e783d03d7c5e41efd042e5b821aa2d54fdec88484a1846229e13c585dfee2782ea4326f5e6d3a08932deafaeab99cda77d44c12271a04dca9800f7d38105007b6a0026f4f0e0ef75991117019c498da455f65fdf9a33488d31efcc686c63cde6c3cd6a959346b909c9cd35bd36e6f9d1de305a04de615c8c86336edb2ac6efc2de86cb8b7f79fd9f1ae5e1a8413428602fc251919c93e379b6fe6f0560bc82f07cdcb197471fb74b87cab0a1b2b8032a13588e3e3bf33302860aad48474af5974c36fdb9a4a513c92f4c0565d284501094977471801993083827e1e28241fafbb2dcefc9f0ced4390ffd53cc253c5d65ecb3f66ca868e818992f57431e6f562154b463e74a7aea3410ea3e3cbeea5541dffea5ef5c5b3380302c73f328d42722a733478f93a9927b880ba9ea09cb71316aee3e32715e65fead5bcc546b330c1e814c4a8abbf12450ed440a63252c496f0a43c83ee72e0f6f3c245b395e3e069d2b2b9567d2906dc9b07a4796aa27839620967af33e9c358811d339666548c1a6db95ce2e9604ebafa12b08019fc95f151e7e48a290d68b184cf56d67218e4d8676d5b47c5480946d9f36cfe9a6c54a3e9e7cff017c02fa991f030352d32be9ef924ef0200e7a32d1d0cb9902ec134e1f9671a66e0e7797d05217dabb33dac0faba291a00a500acb129a6135e642c3f212bdcf4caf819a4e9676afb551ef1aa2d8d001fed396ad2793fb599fd71cea9d075141ae138fd80acc03bdcc678231d6e6f0c607ca90aee37a3b7b989fe776afc5cb0df84454ba6bdb6a6fc1154aa18734a2c1b8ea57443ad80"}, @NL80211_ATTR_IE_ASSOC_RESP={0x1c0, 0x80, "6e3374913fbd98521f6f33173eec6330f3db80449c291de0b121dd7ce38c93048ab373df7f19b30cdc75ff2684d1a96dda468b61c7de256766c082e5ff33ef3eea9db83fcfe3ce84b099fe8907a044c916457338837f4c242a63f60ab0af33a27dd6b54eaf9c0dc65c6b9e3b4c74ab0e0b08119347360bc46654c03938cdfcc71fed52cf826a06b8043ea6c3c8dcd52ca661fc25e70b16b2b633bf1cef5b3aefbc0bbbb793887a62b098ac741be61dbbfddd743be9b0652bb3170bae0d221bbd861b3f5be16c6c5883ecfde1486665f50773cebe874bc7aff8c5a1ae4ac934b106e47de0963c13275e85993ccaf9731dd94b79d0521984b5bb0972214db10f05264098c4f68e8cdddcd75c737113437792d11bbf0c2af1a93d5eabf202942d432f98cadca0d0aa4e0d251505510baf3b37d142078911943b17866009f1f502145b1979fcbf2dddd3c23315ed180c51718b35277331f433bcc9bafd23b6500f4f0cdf835b6692ee8949859d5549b74c5ecd133d87df1d65be40a3014963d00acca586fc502f7dbe1c97a0bb2682fa73d75ced1ce9d36e1aa8e30d3f468d28f2f4abee048dfc732462a7239be0aa3ce2b1c470870f3728f619987f8152"}, @NL80211_ATTR_IE_ASSOC_RESP={0x69b, 0x80, "f03de449842fb76adfd9f611ad0c763b4ed5133e3c241defe9f49686fc67ade1dc351f1c19c7d281d4890bc4eedb21e423e142ee3cce71e4fd690a1b9ff9ce1672e9f702ec20b65f9112f8df9c06452ed12ec807cb9276d4cd411ae4b98badb353bc8cd6b1e4192424161f029c508f1574e78e074e05c7ae147dbc070bec1755875230ce4be11497b4b30a694c4077a71e7003da5deb1835d20f3aeabfa4ffc66731c946532cfdd13b0f1a80022a8c2320858472a0ab260281e1dcbbd71141f2bca19329423340ca861a0c3ee51330e8c32f55e525dd1985bb5972385e75142debcca2f2ca41e29746e6d2f109391f26870c49974ec69e2e4c8fdddf5f877abf37ac45ef528437bbcec6e57430c44a90262649a8b0d9f0f1a2acd6be319b5e45beb9dccc437acbe0b8c6cac32c5e64d3c9e84cd1d24d86ee7130c3fa81f996d877ac5ba59ed47ae600e487c5187d6d0900234e22b6032c646db32eb565b745a1103e9b218bb890571c34a710ec2d596b3a9f833cce7785c86fee4ad10980cd70acb0fab665d39f03780df0d9e15765e7a8a0d7e689555436e566c30f8f8dd93b9dadfde1b635478ca7e653b27d91c0bed291227383b2d8efd3cf3d5db09bf569c3f02fd280c5c02c548c9017f3a853497bce35ce41c99449bb7c1d209afe8c2da8f00c28a859f2069dc7abe4c4949c885edf005fbc843f054d96f521fde8bd7a8d1afbd2e1d463f37703dc3cad72c5029f5512032ff686801e9ed1b119b7c09abfa4e56540509416739d20ae1a1fb747192cd384b050ba116ee0b9be6e1a62f1d03c0caf79f6e86799ae1275bff281a6109fa2753d1e56cc20660943fe165c5e47e56cd3516d6e0b3e64c5dbc1dcf39376247cd846a8a87a4bb3bba478990e36a159bb9c03a1f85a517ab238ac2a65f152ee9f3684d7b89c6d822890d3af6dd8d1a0a3c30640b4e549dd456015d5bcaa6a66b4c8742c0915cec2ca0c3d2a44137b5f67d4579cd6fc05f3d2daae3fb0695152f87dd84774d4a910949b040afeda9bab9c80b0566048fdc5e56a6111a5ab9dabca6a13c18fc516d8b16b89c35a03b92825548bb9567a156717f74c8a0bdeff118d9c7d08d6e4d553bfb34def6582a3327e543770c00c9a2bdcb6c44a9f83c9148a0b425ad54f70e6d57f232f4ca314bc1f9dc692e700f840d2c2f88d41eafe19d45b76172434f7778d71fd39b1b852558ff5f974d9249305db3a0748a68385918d1dac415e11b81522f6772022b24c53f0bf53118960401676e702dc6dd81eed2b8dea8a8f698a157533324302dc9dad933d0bffbdb881f548410d41b86efb20c259c733a522997793ab175b76cce905883f810483264a76d3b63a97957fb3fe9c354bdd6446eb4fc4db5b7caf5d1a4b095d51774bede29aea75f36af2a77b729126d5048c46aec0d574f83a4d43589b8d819f5b4d36ab698a2ffd49822d94dc9ba80663a82a4a52c5c89242f4cfcf2ee40d613e342a71656bb25ca138e150d800c01ecbba7b89b84c77b451774873d63d3264356173161cca9913bfb7ab82151bdb2105983597ed61cfaab608cf04f9ecb52fd90b9b38d3b33be4c23b500d6459beeb80f5f7c364b7f5f1c8e366276bf6ce6d4158d2aed8c33d152f683cde20d8a0100d23f741f9d4e40265cd3e142b9da484d2f229189c8a3425b4e9137c4022d15b61ccdd1e8a384757699f005368f313c6353fe3865e5354880befedf166decee7297ecfd9051a4b5049cd37d96e9ba0d64437b6c09e887106c06d024bb9828d340914b86f0b2bbd246142c3471e3598678aead523f320eb4ab5e5b7a90c6401ada9701cf97676c859415dfd8dfbb0f345dd60ae1d1c2c730743ab4522c7acbc54d512de3b05016fbd5b7bd38ded59b1167f13b7416e22ad885afc15f43e4051f3f4fb774bc888535d6dc271d3a869a6947780ad9dafe5ae5ab59407e0929569bd05bee0eff787012a4945de828cb9912fab8d9023a01b7b3f914cad7ab17739284390c9b88358e76c62d27df8fdbd9e33f80e1b3713bbcd72444fcb57e88613bca807e9a0a50d886ed76d3b680b351c4635865fe3fac54090feed2591e185a0552546f7f9a955ca75aabd3c40e12631e0718abee54fec1c27be21ec2505fc862b66aec1cb35d2bbb4089d0bb0dff78e8df2c296adb84c38feddcf3ee30a77fccc0cad844cb69f3846c182cfbd314ce50531d0ba92cc2db05fefc110fc2931fcd0aa234bfde1f887f0b7a0c6912b24fd349fc2f579257bf5d9af02f7461f142fb6a3c5c27717e31be8d59d55b081bfe0ac412aa6e1d6f7859cdf9b574d6f516f093da1ca00627778f04e856336c59ff7a7f23030465baae4a2622a96b7834dd75ce927"}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x6}]}, 0x103c}, 0x1, 0x0, 0x0, 0x4000004}, 0x90) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000240)=""/200, 0xc8) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 208.630828] ubi0: mtd0 is detached 05:02:55 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) [ 208.652206] ubi0: attaching mtd0 05:02:55 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 208.674082] ubi0: scanning is finished 05:02:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB="7a1354c5449eb5edc74440bd54e0f14baa287ba0c2ca209c3b2d4ac49aefb6097364149088aff3e1aef7f4d0bce66af9dee79c5c1882363e0368ccb8ba34ef82f4fc3517c2a980591d8fc65d566af8709d1b1a4bd3b153f059d0e121e600a4a29ede22a7d71d3e310bf033e29f0b274436ae73359b00340f8301a9bfac177dfa2d279b7e98ca"], 0x1c}}, 0x0) 05:02:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="281000008365d3da3f328396f4485464107990139be52d3973e134e5c54b0429ae", @ANYRES16=r3, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r6, @ANYBLOB], 0x1c}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fcdbdf2507000000080001000400000008000300", @ANYRES32=r1, @ANYBLOB="080005800c0000000c00990002ba0fea606747ba9e92372d32c38605f68a4a5ec44e000009000000c11f", @ANYRES32=r6, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="b723000000000000000004e8faff08000300", @ANYRES32=r9, @ANYBLOB], 0x1c}}, 0x0) [ 208.812280] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 208.846661] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 208.872745] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 208.881069] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 208.888545] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 208.892600] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 208.906591] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 208.921037] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 208.932265] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 208.947474] ubi0: background thread "ubi_bgt0d" started, PID 11592 [ 208.948427] ubi: mtd0 is already attached to ubi0 [ 208.969150] ubi0: detaching mtd0 05:02:56 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:56 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) 05:02:56 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:56 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 208.973045] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 208.974368] ubi0: mtd0 is detached [ 208.994985] ubi0: attaching mtd0 [ 208.999511] ubi0: scanning is finished [ 209.095616] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 209.110731] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 209.121155] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 05:02:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000001980)={0x1334, r3, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0x104, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x41}}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast2}}}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3cf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x20, @private0, 0x7}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x26, @empty, 0x2}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x30f6866b, @empty, 0x800}}, {0x14, 0x2, @in={0x2, 0x4e20, @empty}}}}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}]}, @TIPC_NLA_NODE={0x1088, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x1004, 0x3, "8dc90915f28bd77a44faf962930d4f08e280f04de6b407ccc0ede898afa09f40f6de71113053ec1abbd722545b158befb17d8173983c5d87d598e75bd826c71d7ccfbe5d8bf69ebe8a2eda30989993c34e995ab024fef0ab17ee8443ae64a89c71f400db83d2cf61d0f549e7518ed13a9f26e62b5c86e6c45db54e6915aabe16a0ffa75dfa8053443205126bfe090596e38a14090618f990a83c5367f717e6256c78cf378a282eb1b61766a619bcd1f2f3f7b13b01cc9aea3eb589246f951916d07ad5c6c04d49852a3d8e015ac78d906414b1909251c4de769e4652591bf0c41980d8028a5ca36d7ac99939e3cefe55034f8d040d5dc79ef4c7285ce1ef2dbc6b2d9cf89a6a7eb43886d13a811c3244604768c7faae98551f182fce4916e7f8e623304fc337ac17a628292088d752912617db397125d25d8feaf34a64619bee0bddbff529236ab701ce28329d8c460405365a0e46f507664666b28f012b1b30f6b4995f80433e2c3418280aa68eb0505c749481b4b63c6a44153b015e3b46f2ddaaac8fd7a8002a512b5c37f44a5781fdf10c8086275914ce69a632ea019ad257c68cfa964180dc87c4c10bd167596435d16e1f59bed8cf8f7b349ad2ecb291178e40fc792600ae6e57ccc4b9a2d9d74bf59ed9c389c1e968739c5e7f587bfb17fd35f421053f15ff3a83985179234f7a697d0dd9e8a44a4779ce8e5648bcef7faaf0d40dd66b3a1cb5477b36df8bd56a1bcf31ba5059f77e1a68480778718883cf173d40da31d5c823afa7e7e4bde45d9ccabb99f86ddb9bf4f86d497618dd0c76d763e0354e9206f510a90d0b5ea8479ea81b1b93fc7c3cb90b9fbd0999d3cd0e4b4d9a1e704b6140c8469d5133fdb1e7027f138710ff191db0d7aa46cea62fcd85c4d4a1d1f84167699716ea2bf76f5f1e44cc352fd5c23986345ebb67d450bc4e987625e6e443a89a3ecb7ec5e86bb276b1f987ed97ca0b076f707903ca5835adf1f22920a8c5d9628629a42651b8fdb99d825fea5e64bdc0e16e78b87ad6f253995a16cdf3ee7ade9a6784ee5f862b073c0d1b95e75152a27ab0379e90c749a0083508995b61ad1fe74b283bb0e631e5f2a1a7c1aaf0a5d9b61150f65b503fe28f7f04d684340c1bc20f9508d69d355faa8f04b8a8740e7608c3d8a9d664359e54173d66e7a4352ddb3b48cc1c2d997be5c1a8d4435a2e52f1993bc8c9d5e49642869a4734020ef38cbbef4df91a35d646fb33738f64900e125d84491a21e236c5b7c09eb727433d38affdd7f5bd0a06f7e9a7ff60e335b1cdf8b2d837d52f54476737ed31a4eb6b23c1a4bf6d0aabcb958e7e8c2c4af5389c6ae7aebb9c0411f6f437b321aff316aefd21ca5f3eecb661a72f9364bd01dbc1c16f9604fc648d9145828a3c89c0f5b42bc5f9b66be372dac0b32b9b5d94acc99c0156462512269d7d8df71cac135e73e2099bd4613569fac60dd828d79647f2d4feb9523f272d5f18a2563001bc6a9359eb274151ee19a51840ed3ef7d06a9b1a8b9120d4d22a81afce1ab8e3f7a7c781e6272340e242783dbc88ad6072c38324f8374cc71e6e88bc2ce3f0f8a1aa89d1241132e5a4155093e091c54f6b56fb052d78d1c9327317202d083cb31338f6f61a69a7b6eb9dd0be249b3aab1fb087afc8dae36b956ee72c38390556f3dfbfd8565a20d57d4a70da63b32aeaaf8a292c5a778d7c56f866b3fec9ed6c133cd5ed9ee560a29f84247d0536cc3e60cbc0f5ccc8fa2cc3b18b037927d5cb2698f2abed6705631aa859c775584d7510f55370939a4973ba7ce9ffa6976e44f8d3784761e9c2f89bc41f246a24c228b483cfede5d4f4090f265c23e6b69e013a1c7096fa4f7150f8c4afbe0301baedc19ed80b1265fe33a48873bce634dcb9d66ad21f09ea174cdb0e379c45b66b0a857257ff2077ee6de1ea7881d617e95a7f5a0fab5fa81d7dac10102f7ed7d496d258bbd9c7806172c73395556964c6d26a2d66910d03160728dc021cd9d67c4b291bfbce9ff1cedd5540b40d240b3f6fd9fbebcf7ce5087de67b2f90007b9334a8e578faa02030046bc0d10a2298b638de3c46197a5392c2539cf499278e2e7d7b269a5a37b80642d9643be41bbc5e0f7c987abdccc1850533ba9a3202d90b0a7df391a484243c34b7621090b4a6fc38e134b6f72f00a5f43e4f0a678bd3e2647d943d60f51d86c60a91b857d88bd4b63e6281f0b84512e1c071ce8bb74b739fdcfbdee02cff4cd6dd8a0a3249408b7ae276c99e05c8d1e2a67e4826e7829270669f06d4764f0f2a72798cc59461627e68f954619bf4d924d7dbb18659ffef80a2712e0d65b2e844aa0b29b285aed8910065b1a70109d14f8c6d4cd643a85c963c0548f2222ed7e831a98bd13691b974f2f19de2f6c331b020ce7d7195d16cb2335d20e306c8ac26ec6f375c73f17335de32b79d0bd305d41abc53b29ce7e8218fda4173914c1dc5356abd21a2634241b6711cb4c4de6ff2e0a922608056687dbf03484298b02d1b731be7d36c072fffe93ccce8ffa5faba7f273c7444de91abc30b61106fbc7cfbeda40309317940f5a05381db4556c0254a2f0ebe8ea4ca3481ff574db8b272d6924b7447b38c179a38cea6cb473262677f36517f8b96b59b6f35e65d384f3b8c5e907eefbe55c68a44dfe668bd3848abee929df6ea568a160138e73a358ffee84b33ff983cf700299c1307295dd702e1095aca2cb3409b9a2fd971c30c003d76d7ff29320b1f6133010f2551dc3a7ab3f76946d087a19b3fe64af0bd5ae431139a994f54887f2ceb0c43097f8c24455937fc9fb5334787468d990b7f1d6c46cc08b011bc1762b9534ff66b4f77a75345a1388696f71eae6c5db23fbca692bcc43294b6466cbfc54179abd3c427a12e1496a3abe74eff3bd8e562376d082faa657a51325f0dfb1770e70a24dc64027fd098e13d2a985ff7bb1b3aadb9944c98998a86142a7aecb446cdfcbd240f3eb8a6912d7e7621bf97948ec9732af084671ac98fc7062687cf97d0262d165ddd437adb69f709c3a0b9441f813fdc8544fe523ca7e97582be0dc9798228a07f4771bf5919bfb6e3b097dd247bf43428a9aedf6b138c146c3eba7e11f977778cdee2e3f4202610b49d90c8d307e39ba1ec64ec2c832eda32ea2004393aab8bb2330908ee4c1fa85378ffce5d3a506e327469f06560af25640cd988ab3f400c88efbcd23a5486556574f9f65998e88e7d4f9085ef2d09bc28b192a15dfa943680d842dc92b0054c17d871f99e998fda8dd4c71a83ceff1ed8c2351a0a9cff43400d04c422ce03cf46f51ca74a297eb62981c7b53a5502df8ddaa1ad2d38ef7298033e7842ace79481e26a744a153f56d53c5a2bc17801ea7e51be81d15ab173cfea3ee74206040be5b73392a331379dd3dad9311ede72298304965a97a15d8532456a49814b65781a4df28ec9d1d0e153f21e040bcd617243fb4acfaccb473b678b102d15bd9317aa22da2ab4f756afc6c86a41747310e4667b28d4a7ba6fa1d3e997537fca7a1831bd00223c2074e01bb11b543ceee45ca054a19ce26563ae463456734a308c636500a608611d024d0cc56594d163879174c7a7fa057eeac4c8f70288ee36fd905ec4f079eb4eb7ef1bb1ebdd75e2048ecc44c47e3ca7191cffd22dfe17228432666008c2b4161b1cb087da0c75348a1b3100486c9db678f55e7cc769edc1ecfafe3c47fe5f6df5960454c8710df9f353544724e4201eda67f70450f1ce6c604feaba29a3e309c7baa37950b93875651106fc271b9dc70e9ca052aa71125c090a897abfb295455af1d2cbdff4cf9576e065cf93bf8b86f6df1f0b98b03289448231db8fd89920f537c0cea6dabcddc4b99f79baaa51e20eb48d0a4246aa6c7cd38520bf4756e796f5e5d23bd4fa6940fdd63e867aa565c1f4288d70756efba5c80d3732c517d6998c57f413c186d744f9a1207eb701d8948f2cefa95ab4f8743b2f058f7b01e91a8bb12de42f0c1d10307a7ec829b396da6a2224b9da29958a5706cc1221b98d164b9168c3925fc648e83e3fe8b401f423a40c6c591461fb89f08f2bf7a1058544f545ef02b796f67d14ab91dda5f8f4a3756e46315b2113460b2bc640c27daff9673bbf1fd4bfce8a39111fd4343fe34c08c7a83e72873c44ab0723a472441b7e371e6708e5c7153c96e52a27ecea85b7f2f5104421a0b62af7c2cf43ded5cadccb1b793759293373c2d3f05c61334b94c522ffb6e8e0c1e8a970d20c5ddc887fe18e663b61251c95ffd71c7a57e9b36cc93b4f1bbd1f60e15b4ac9cd4f4b754614e646927b42cf6ee8c35707de905e1201176821297f19efee1c7c4b33af58885b5796301ecdc5dcdab658d93735718aed74488063f9873641ed7ba0054a2877f61b3e78f5c80ef22baba868f4861d3b5c80e7dc0ec2ec29ade9e5484ad10442306a72012b78e88dfeb73725fd20ef4a0ded4777f1ed9487dcd89c0ac9f3b0e3be265924a73d25a2124fef447d6a97cbf83a68be36f74401f19a19e2884a5b00fd8fa2b5b3a7125876ac4f904128bc11ddb4e6d0f5a6b3103ad22c288659df1bbb46be82511b940a7e3ee6b364fdb031d4d06c6a06c589835d7cfd93406afb05373f73b8ee5d45d2efa698eea925ea24203339d74dbd2e271e7a97ce109c43a53e941a43eb539540462ade8958d64154661f7ef6c5058752a0c35330a1ff8696d2cfbd42de0643d38f67d6279c16bd0c15659addda8a4a9962fa769f301fcc676fbfb01c7bcc39840d8073f5466b0c1c9f838bb3e7f16dd7ff63dd6e7fcb20a9935194a962e606e5cbcd689d4a2266936e1f14ccb623ec24bd0346b226e63a7afc3ad176840efec4025ba1c6be5fce1a05e2e0334e3cc87da9de6111fd0a81e25d61fdfb1dfd3f2d3f3183cee47d6d000c69e9b716af3002e7a1a4f195c76db256ccb69d67ec24c7bcccb0d1217afd5489027719a365619f36457fa93113f6176d93ef412ad450c3957d5031d323b703cddf7de6402ba2f1d9124a0b32c5a32143873b1e9f63fac40c49a184b99554359a4fd83be4a27d8d03166ebc5f23b20d70df56d720f97849269020b564ec934bb9d186a6239fefec446274330324959f9a7ba0fb02f61f4a717f75cd89e38b95a2bedb6d3cdcae94ced64dc341bbb12002e61607f6b75f569a576bbcffdedd21c1fc73be287cd5f50148189b4ca2abc1eb0550329a7b00c6db15dd7ee8987028ef44ba34700b443fb27efca611e7d6c435435bd6fc5c2ff329514756971b46dd63443d0cbe0927ed162579cda0e8bf9d6a7e6b142fff3d2eb91fc6a11284127a9f9e44a78bfb7400a058d779c5d15dbb7be3271f57c90874ee2689fc13c8dfee51d65125396fd5425eaf5fd87c2f24b4936f94318d5283199e29a28c33efd681d5295831c552733597387127de98b00f7c59d22a5678acfccbeacad2b90f5486dddd4a5d9caa7cd6c6242461205ff2cb8a2c8a74046872de93dd501d59ee49b5d2d453edb9301d3ec4084d856acc89ca2abc02c7c1d21cf4bfac60a5998310174080dddb0c7d0aff19ee870cbc8574aff17e3f51c56c50645dd86fb4b10aaec02685e22abce41463c151b50d9db4ffe0e89f613600a98f51c0267342121d037648c0f742c769342e5707c0c721b8c4da2ff7eda0f2c5eff3ba7ec2c3f0067c2ebd7e4b21371c23fa3200d2ed884cff0eb47115c8b68ac0765b411f96d993eb639d5b17755b1f47b1535037870795ab3c4f4fd16e"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "abe1bd556bba421b3854a1a22d4d8cc6bf1ee91a2f0148"}}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "737690b818e3414a93fce5af27c219cd1e7531ed"}}]}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA={0xf0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa9c}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7c}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa8d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x75b01dc4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe80}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x10000}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xd9}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x1334}, 0x1, 0x0, 0x0, 0x20044040}, 0x20000000) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r6, 0x10f, 0x82, &(0x7f00000000c0)=0x2, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) getsockname$packet(r8, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r8, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r8, 0x800455d1, &(0x7f0000000300)) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NL80211_CMD_DEL_MPATH(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_MAC={0xa, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @NL80211_ATTR_MAC={0xa, 0x6, @multicast}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r9}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x20004000}, 0x10) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)={0x2c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x100}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}}, 0x0) [ 209.149273] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 209.164536] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 209.180605] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 209.193403] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 209.211909] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 209.229020] ubi0: background thread "ubi_bgt0d" started, PID 11622 [ 209.235962] ubi0: detaching mtd0 [ 209.245395] ubi0: mtd0 is detached [ 209.255620] ubi0: attaching mtd0 05:02:56 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:56 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000000080)=""/17, 0x11}, {&(0x7f0000000240)=""/182, 0xb6}, {&(0x7f0000000300)=""/201, 0xc9}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000000400)}, {&(0x7f0000000440)=""/16, 0x10}, {&(0x7f0000000480)=""/198, 0xc6}], 0x7, &(0x7f0000001780)=[@fadd={0x58, 0x114, 0x6, {{0x6, 0x7fff}, &(0x7f0000000580)=0x5, &(0x7f00000016c0)=0x8, 0x1f, 0x0, 0x9, 0x9, 0x4, 0x7}}, @mask_fadd={0x58, 0x114, 0x8, {{0x700000, 0x495}, &(0x7f0000001700)=0x9, &(0x7f0000001740)=0x1, 0x0, 0x6, 0x4, 0x7ff, 0x40, 0x9}}], 0xb0, 0x20040000}, 0x0) r5 = dup(r4) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000400)='/dev/hwrng\x00', 0x200, 0x0) ioctl$NBD_SET_FLAGS(r6, 0xab0a, 0x0) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) ioctl$BLKPBSZGET(r5, 0x127b, &(0x7f0000000000)) [ 209.331759] ubi0: scanning is finished 05:02:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0b009100", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) 05:02:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) r4 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x9, 0x345480) ioctl$VHOST_SET_VRING_NUM(r4, 0x4008af10, &(0x7f0000000080)={0x0, 0x5698}) [ 209.482025] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 209.495483] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 209.507794] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 209.515548] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 209.528457] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 209.544912] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 209.552989] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 209.564427] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 209.575359] ubi0: background thread "ubi_bgt0d" started, PID 11660 05:02:56 executing program 5: setitimer(0x1, &(0x7f0000000000)={{}, {0x0, 0x2710}}, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x280, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lchown(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=ANY=[@ANYBLOB="3c00000010001fff0000268f1c872d2b01000000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e0000000400028008000a0036459cdb26cd03ccb7e638a66c866a951362d3fa08f9985503f8f45bfb4e9240b9f2a30d1bde27881f17233d3ad01f2177b1a53e51397d581d1549a05c1955f5d2a27a54f154df", @ANYRES32, @ANYBLOB="534fce983e5c2d7673b4958005e750e907d4fdc7bf13d088ad203bd736a916945b0f66f933a31733392547e20febfc8d209cbf74cde243bf2406fae4ddbe02d390fffad64b012deb14b92f020709e51b3e84a45b53c64c5a4c9a8ddb7d983a19eb11f0803dced96346ee580ea4a890f90a69b44067df0949c216f3b291122bcd89a0777619426cacf7375a9e293541d7f70f4c738e9580acb79cc9465802b2a647ecf12edffdca4a00493580b7c2c846f1a8bd3609d25a90e6f566609a73002762a2293a435c82a31624f5ecd4951aa455faade3a054552be833f7e8d36990ce33215c37fb9a705dd25c047668a5c3722f4c5bc28c4ee8898d88e31249734df2ffb3a84b62cf45d556dddcd15a1fca6d51c5b71e1320bc9815efb27ac53455798face54073de5ee1b88d9772949b45431b2e"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000003c0)) r1 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4040, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_config_ext={0x8, 0x8000}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 05:02:56 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:56 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) [ 209.583321] ubi: mtd0 is already attached to ubi0 [ 209.591660] ubi: mtd0 is already attached to ubi0 [ 209.596959] ubi0: detaching mtd0 [ 209.608747] ubi0: mtd0 is detached [ 209.627880] ubi0: attaching mtd0 05:02:57 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) 05:02:57 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 209.684341] ubi0: scanning is finished [ 209.783682] device vxlan0 entered promiscuous mode [ 209.851803] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 209.869573] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 209.877953] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 209.884972] ubi0: VID header offset: 64 (aligned 64), data offset: 128 05:02:57 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 209.897590] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 209.904071] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 209.914181] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 209.924724] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 209.936218] ubi0: background thread "ubi_bgt0d" started, PID 11691 [ 209.946279] ubi0: detaching mtd0 [ 209.976252] ubi0: mtd0 is detached [ 209.983133] device vxlan0 entered promiscuous mode [ 209.986266] ubi0: attaching mtd0 [ 209.999842] ubi0: scanning is finished 05:02:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x8, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000080)) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3c) ptrace$cont(0x18, r5, 0x0, 0x0) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r5, 0x0, 0x0) r6 = getpgrp(r5) ioctl$sock_SIOCSPGRP(r4, 0x8902, &(0x7f0000000000)=r6) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="b72300000000000000000a00000008000300", @ANYRES32=r3, @ANYBLOB="3b967600f58f0e661386a6b6b4677319709f8a86118e17679c1eb26199dc59c82e6c561182df9d69d85c8907ecb543436e6c59c56018045df2d72dd24b2f9b76443fa0b89a1182d68f9f2f3b4ef0b8bdc477a01e662d6026ef7b6c7811301b1a8aab48cfc16b7b868ca84666eeb73d7502cf4fbba7deccae55713489270f4c82c9a5bcef25ddd557448d7ab0b09b567547d3109cf34fba02b212d4c73d330c4c"], 0x1c}}, 0x0) [ 210.021496] syz-executor.5 (11673) used greatest stack depth: 24640 bytes left [ 210.039187] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 210.052281] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 210.075755] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 210.085953] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 210.099959] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 210.109142] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 210.116583] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 05:02:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r5, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) getsockname$packet(r7, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r7, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000000), r8}}, 0x18) 05:02:57 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:02:57 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 210.126058] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 210.135756] ubi0: background thread "ubi_bgt0d" started, PID 11709 [ 210.142917] ubi: mtd0 is already attached to ubi0 [ 210.148272] ubi0: detaching mtd0 [ 210.159034] ubi0: mtd0 is detached [ 210.162827] ubi0: attaching mtd0 05:02:57 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockopt$netrom_NETROM_T2(r2, 0x103, 0x2, &(0x7f0000004580)=0x7, &(0x7f00000045c0)=0x4) getsockname$packet(r4, 0x0, 0x0) r5 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000004440)='/dev/cachefiles\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r5, &(0x7f0000004540)={&(0x7f0000004480)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000004500)={&(0x7f00000044c0)={0x30, 0x1, 0x8, 0x401, 0x0, 0x0, {0x6, 0x0, 0x1}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x21}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x20000000) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) sendmmsg(r4, &(0x7f00000043c0)=[{{&(0x7f0000000240)=@vsock={0x28, 0x0, 0xffffffff, @my=0x0}, 0x80, &(0x7f0000000000)=[{&(0x7f00000002c0)="2524af3c8c706434870fc5e6aacc0a554aee6604afce4e1b692dc138c8f6bc300954dc1e57d8b1753f718f88d0cfdb56301678fb1261b3dc4e17d58c3c39b46e0520b0c66cd6b1a0d5318120cad51def035682d65a9354edf1bf4f3b2fe1738a4a06d64e1214419855ef21d263aaf19b1105615a1fa2f74ad4a97f56cb1e65ecc81b749618ad674a60f662ae707df97a58b742692264a04086aa4feb73d52b93742a2ada1fb583cd", 0xa8}, {&(0x7f0000000380)="11b47e0327201a1688f226850b32c0f12d83477f42557719f1487aacc6c3ddb2118e3a8f64e3381d7688a714b0b87d679f8363e17ea18387a2a45348245ae32b122f04e5ad28b58107e10ae80940c09ec889701e8efb6b57ecf193c52d74a9f401c44d9da226602fe32b65211d508e4cfc3ba1dfc2b45995b0e5c282149a78a943f35acffd50b89fd64f0449bd0ddb4160ee8e51dfeed9852fbd90e994d4809a016c72e421d303ab2dc81560557760f302ba0c3d4b5b8a0d487852ef7314aa71077cb1e5ecb19344952dd5f34514e519402254c7e5ca142afd8dbc05e5f9b35271335063ae7e28981e415622a3223c4247a987f66fb39b59a729", 0xfa}, {&(0x7f0000000480)="6abec080c4990a41138d1460e4e8dacb6820be745d51964be7ec5ae7478d0a52f8df9807a4f5f432fc529f3113152439fd3b278d8532c8778f98c230782918b86190b352ce3b4cd395b8ca0631de81f130d18360f88f3e19c9cf74c4c7ccf0826776aa90e714575ba9a6cf6b5881806551e469a8b4b3a0e70fe33e695c2d716cbd7cbd603ce234c8f9321b513651f7948aa4327583ffff8e08b5014b", 0x9c}, {&(0x7f0000000640)="fe956498163d917bc41cdb533779b9cc847c70744d4af61a09468340389d2c49e8643d469dcec562883ac18ebc16c66e58a0d5e23afd39e1ee418db29c6ede4a33b7a46ee910feabf8fb43103d5e409854fdcf408eabe7bf68ce2fef05f4f2f6f8d5a35c0c1cc776f9c53672b43b7e99845bbaf9f06238235547eadb267425802fbb8af3211f4eeca75049467a893ed7dffc7735642509e2bd4d71e8b8df7b5f84305fe9970b7fac212ed201e595196a9e63b07c2728fa", 0xb7}], 0x4, &(0x7f0000000700)=[{0xc8, 0x1, 0xe3e3, "5e33e05767ea4cd7224258a42ed86757acd3c39717e60448434204f6f7e3441884202d59c61070dd2aea251c41c31e60d64b81d5c0a47f755178b5b7617968ac27438abde3561cc3f7bf342c22875b20763073c744cb3fe6412e7071399ae799416a76676b9dbe4a9976b139813fae8817e2cf71747f99db08d14a18d694cc3631a7e06402a1b79c570ef8045c7762dd9ad18072cdcd48d46cd498d0ac018f09936c7a5cb71a55476e58c8a617195a12d184d27eea06"}, {0x100, 0x84, 0xff, "8c8008fb686b9515d4cb1676e633b6bc7b46d3368f23d0934ee969b589b861e5e58f2a0e021f82c073a7931e02ee60bd877a2b9128b5d55c243141c0323be34e112177d3968015dd789e408975479e4a8ec79ff4f59fcf02db604824cd9953ff73f4ab2d0a3e457e69917b29acbba71ce35dd2f028293fba9e77ea7c10f1f68f1687069f2671a523fc15aff0b88176f7b84e85af469e2a6e6ac41436dfb7c91cffde20c64ba43826971926ed3bcfa925a8dfc4980f2b0716341175637476814afd21a8c5762e65ad03c09bd5945b3fe7a92c98bc58b631bca70f42eef327f97525b8ec8699cc50dc49"}, {0x1010, 0xff, 0x6, "e4633dacab9f6674dd7ce24c93138f95b1748392831007beaf823666639b29eee7469c223983bedb1422df2efaccb8a514cfe3219fd3dd945174f18790d5ea831c05faf4261d80c35b95fcb4972f3bb5a92bac118f56149479e48883cd2937969d53c53b9fd19abd8e751c98e7900951ddcbd59b47383f8552078ae6c4e82bd4278d8f6fa568019dfbd6cee97a1ec8f2eb5ac78df036c59fe44cd1eeb7220143bb4be32ccf0635f4aba716b5564f1f39d28769e18312989d7b8d8b8b8db417c5240e8fe63c1c8ffc6a05bff0d67e6ff0347639162c3275d594c44ac2031fbdc5273bc7a61a64653a0482bc9fc9a48c83b480507566e9ca969e0e69576d3c69832b6ddbfac04d8380033c5d03c67e1850b82efcb45de420a6226593c41c05870e2e8c7d55dd9be69b8be6b4de47c79dcaa5839daa1b3edf363ef2bcb0af6d9a85ede83bb8b9707fde245b075e01ed8c04d9647353bdcc34991d6e678087161942df9bd8dade50ccb6dc9fb971104d3233fe09e8da106ae810a4c22cd9132d6440e0019c68e930a1f40e0a686fcc54123ad6460f50e24cfc209fe9378b71f4495a1aa12f23b1227785d2202f1f00d89ad4d93b61c1a46e46be69f24560441eee142f71576bbce35bbd6a14e18bfe816045cf63530e50ce98b9a926addcd334515f195eb5f3b4a41df2e685bbd9d98a255cec98e0eba3301355f286f8b45718293cca53abbedf2bfd017655d886574b5c30cfcfa50192d97370bcd2e582aba642b05fe43512e96f5a841a99e7ddc23dad4d845cf22a589d37bc30e6259c87735f5a235bb55a522a80cd2965ec31d56759211fba3917019f8b23fabdab1e0ab4e6706717101ef22341111500bbfb9416abcab7632e5cebe50e7b3812051c0c3a3c1a799a2b225dcf46fd3283f126a6cbd3780fc3223c3bc6c5f2690091f944b6d82e3fd03a366d621057b59b9ecebaada9f385c6b2be79c6b6f16a5aa4fc49386e38289f7700933f2cd534868a2cf14d70ccdf040c9ea3fc69aec4f4fba673295687d25fd2f876516b938f771027fb9c263db9e0eca62a7a44023eb77472fcdacde0a8cfc4b0f1d824bffd083b4f047751fbc333342ed078c8788f02e0653b6f11813e5eb6e21e21d6de767bc2bc011b96772799fa62445e44ef49645beafd7f03d5884c030d8ebdd73c3eed85ee4114f614da73d11b431dc11edc93bd596e3feb858efab4f96585208f5f58c1729d22059e9e63cc6d0313c96477a9c5d7001b24da5734b80bf8d1819a62edf14ce3aa04e19e174546603d0585efee34a0944051c1614b7cdbacbba5e94e715e93e6d1bbb193b224f802a2fc2dc61d1b25e4d4f0898e5ea0910f467c929023cbb54a7c6b6d411179886b7b4fd098605f9e5a568e50cd7c6cf6ce45f177b82d64c8fa85642ccde1afb54573710a7dc702821b44f641dee9039dc8a20017236dd7744b96afa61c0990691f38978eb14268806ef28b806d1a9ff1122c35338d708ddee79bb4e0e5926c06b0b6da7f04235896f0537ab0d5dd8caf0662512b74043e347422dcef6e6937a73da213c9c236a1dd076b50c0678531b046401e3773b41a15a5cb6fba5434fc47d3d8f5dc6145db6d19dfd36482d476b5dc5e98e4fd5e878714ae69a936495e11a8308eb280878978c04304273d53719871e00a2febdb1f0908ed62717b9a627d7b38dea0a7f9906948cd4223c9a3d0161b44b4122e8118b03b909ea7ecbcba8b761ec2b5a5963fd8ef8696e5076c33d757b27882548a8705692dcf9d14efb8a8bd93385b784a27a97fd2b4a3fc08181c1755cb27a61b95bc2fc4387b0890a87d647f946a71c86a20adb9cfd745940a23a84b0ecb143c6f5acedebe6b8579b943ed7bdaf928891600083d22863fb88be3581c4a6af6154b533217903490c183b7294a648fe2e9773a0f420384be321a2980626110d1fe86a554586614f49cb402290fb9ad3954195585b64cae190a161a68a9b76c582402dd88b056fbfd7d36bb14214de149584884071883f2f63a56edcf806ccc9f0676cb8db758de9b0e6fb4b532ffe6c2a9358e49f372f16c3094c8029bc83ef8686c2d8c4d6be1879511d42ae5a82bbbf35818cc606af6dba5c8b35df8b824a396e22382f36834fc4db394155c386870882a1b46bbef30e891cb6564627d86ccd7de0d7b3a83475521001bbf14839144c2407990204ec7d9a821b7c3e011248d3d7db59d182710e8bf1d759ef81ca72c73dac9b05c2f8ce8f2708789dff392278c5211866d69f068ee6dd057ca27c731f897669829586e1e945f4c5a296188fdb95ec3d1bee8208d4e9c396117f012533a7ef498e0d9d42f948dc62e5e42471ec73301f1399632408511c7d14329bc90b0bbf23002602cd88a2c3d1d654cc1e6878dbca7e307f25b2de1948fe2492e0341e47d36dd77c064ccbeb5f5d36a739bddbeda59b8adc725687767a1f8782984d3d6850d60b2eeb5fd4aee32c2caa689437b6dc73509a03f3ab670e3ecaa39ab2d0fa266861ba5886de524751f8c234490923309a82c6acb4b0e469e430224805d4026dbbd5d4deb26381b5f7326b1125d727c0a2fc73a84943498d68595b7bacd166c3c34fd2e7d1c977428177a7131b47944f77ffa447ba09a2d1bc13a6bdd4e36d1e33b1066f8810b852522f1cde3c6b5c72bd0a460ffc611c3cbee93d35067da0b7da0962eb59872458470e3044fc3944cd3574c5e4ee8d77b4208586ad134c73c3e13c0d6eacc6969e31bad1fd1db04ed09c037f0ee5c42558782f42faa5ec29dffab68c625765761f6f0f31b2c89e738d69df26c5c18cfe8c4af81a4c7b5324490a667c6d23c83df115865d04e86b15e36635baf6cecb85e0f7fa413ffd2c882854a28ffda962785f04fb8494022f89c59bf65b6b3f7229a5774064fcc791edb267b99989a5f1411e16681fb8ded8acd74479ee4e2fcfa6201089fe2a56b753edc7425a3e04c4792908eaa394d9df09860a468fa7b30b0acd16080ebf95bcfbfffe6b0e3d54705ff9099480742bb5cb10b67826587f89cca99a8b4368f234046e779977e09217ed5a4dc132111cd1d7823a4b07feed20d113ea1171078298d45a903e33451be70605a359b80f723464ea9a80429c5579cc0330ae3de1868419c16622e55844da89c7fe90af1e90921945ce8ccf615c1afb879e7034755ab7e7f19af712200eadffd4707f69f6bfbb6237d27d8a84ce30454233a14f5810979e1619690343a9829d5c35c408b9b8c8f70668d3d832dbc2bb6683a7dbb8b24a02e7ad17fc98372ad186ec2e7a22c8b537894d443bf0111c7b50a599006cf6373972d263554e22cea2c25cbae282521d93d73e61465de96bd2a7e3ac855665d40571f7c49f168605425cc5d84c47c8c8fd8682c517c2fe48da44292bec86483e2376f69b46e8cbf14fc3ebf5ac69302a04a76aeb41b133eb9545b3a93ceee273a59ac21d22e9b85473628b81248c4f16d84c5a3485fd5ebeb8c2295a179ce2df42989b90efcaad1dcc2e225d7c6a5ce306d6dbbc22e1c9611738a13bd5b59c4149f35f216828e870734295deb520aeaf852d7650ebf0ad8652106a071c7d43337f4373efdc274b54ce76fd05ae5d085f783a198867e907ceeb158b88bebea5e2a8e1ccf5362fa841e22a75c55aa45725d76cb6d3edce1525a72c7f066ae575fcfe31efc9b15fc84f1d80d702ade8c80c2a9fb89d5a2409a8bfaabcadfadfbeda45f889be5effc051cad7a378408785ef99a168432fde88afbac99d3ac513d9b68b55402c5ebdb43f66f0ac48e4bb6ef51567e0e4e966a86221504dda1003209407cbe9c5294675ad14ae30573e16bdfc09bfd151b4e5e4b321897a8a40ca494b06d6b76861ea6dbeb7c256a9ce4352adf00900c1f96f4479b766b965c67eae61417e6043acc4f9a6bb5509e35cf29763c3843e67105549c9845d5406d637c972fa156ba9a5f7d7b39c056a22068ea1a81e09d3c68c31a117680f253af734e12220ee5d0ee0bcc39196e9b62aa75f50cf28676e8c56823a93d9809aaa3aa56c4f176263c8f3fc6c150a179bd8fd2aa0d834d0af6a4e7f800d814132165ace80661233f8bbd103a69704f56ec557a3a8a5e0aecc51f13ac28bc85e8f8f30f2d188c736c964eb66f95a36a6e8175d9dd9113fd8997c1c6fda3f801c99acb5daf29867e7cb46230c355b347e1b206c7210b47b462d302302b25855085ab5bd93eac36df17460683afb371fe761b6d2098336d199abdf2b502347f2e0ee333016717624f69457aab560943da35c55df0698a318bc69b204d0a09efc6efe46c23f663cfe85916140c8a9bd2c1fee7883255ea1cf4449e1a6f4b69075b55f81bee96de430a9aab381394f7d359a6ca1955417e7f8fcaa8fe0aa1deaca48158bd033909ab28788d6a53f02bdd66f5f5fdae944e16c8dc34fc99182ce25642ea856405e102bb8c08b9189d45e748e56e073532e08903bcc60a4e8d291ac807e2d840d864187ad940271997ca4a63e23da238818a8e58e1aa723008ca076a5ad530cc38ad7531f924adbe4aef7c0571f37957dd72d282085256a2cb4f4f5e12c05f01b5c56bcf5048c3fe3548d2ff8709b4d33738464d644a43ee0eab5f0bd2236dabbc00e8c11b5fa8cdf8f9a389f29d2fe9f0b86ee15db8dce432791f47b7d7c590f9aa07f027182f88a7db53d2cb63c6d802b7ffcdfd75647258bdb46a6aa2f32dc60658886acabcc04a37e52dc6f2dc501976dfd416ba422d5a306d3ef00231043b5695669404744ea40c94fd42b627e67a7541ee0eea92bfef8870b3a763597945c4ef6c837694791451ec39f96253707e87c29ff7f4cbd32a13c6da9b94e2554854ef6ed4aad1d787a697b52ab157cd4ccbea8f639fa94bc3d462540e86e8f8fd7301b49470ea39f1586c8028eaa7dadabbfa80289d0ca5be23038f27d6a0625d3f96110ec563910b3b9ea64b683b9a8c13d05894705b6f26f2cdbbf77a19e1ecc4acb2e3b300b384b115ce8c47fc4a3ccffd7259dd25a571f0fa6c24bdfadf127737ea95bfe99f39e5c000fabe9ee79c405e69c429485bad2d2bd97e263c04843997161403f91425cabb2a86d7c38c60331ff2455d80bff5c965f411f9f343677cc6491a916698369d0aa3044df29b8f6de15b02b5517f5793d384e2aeda1e4a4a5d9b0422f71d5bc2496e9a2f95ae6462b9330b9de6e0e31cad42311451ea4fc2915d4b2f075fcafd6d6ca4b5ea24d4c8e4b917d3b473b5344a190ee8b590d6f7f3631ccef29976a13b58490b347d46133cdde991090265d3afae6bae4eadbbdd768788e1b6a9eba66be9fe2e0cd243e74352d81813f0bb2603a68924a814fea58daa98bb8af33a7155aff89ab39b6b7a1c8d5d56e3097d8c1c70a4bc1434f7b200f697079b7095edf66c609d15d751e4f93f3dec62b4ef8944d3c15abf53ad0710aeb287287ea3802cb3e232fa733ccb86fb6158f208bf85d58d4df3827f8d49f53a51ed2b78b89853589141e3e3fcd55d2301f675981155e4c27acadeec45965e0974323df95aab669ee7a886ddd549175b1169954fda102db4118e5d5cb4bcea24fec75e3117c94973350d656a612e97a8178d5c628f373c5d6ed5ba267a692f78be8b22598049318cd036cf2f0618e6024dae8de222e654e2bba2857a413680bf547d0a1e53520da810bf1ecd347e7c6d7c54b4e0bdb180077de0845527325518fca9ef9b9653dc2e57e0f1f4e0e834f14941064dc79dc56436e192b00e6c2fb1fd488fd4"}, {0x1010, 0x101, 0x8001, "94a3ad5993987d1d4200007317e7f60705a07e6def8d2f903bfdf44b677d5fa41f0df74e71703b242dfc14e638e97e6aaf620b77b9d45462d54a3ebf4f8abc4f1876939c69b30577168b20f65a34c0f3e3ea96af7ed256df8019b17a2da4002232bd8deb268684e5c523ad0a176c602b5e0a7dbb1a953bb38bd51bbd8fd3ae30817e8653fb7cbd5b6d2851cde62777b2397d2693ff9ada40ab607149935cc5312e0f0b79ec53cd143aab54197963b4eb2444cbe9a56b55ef125151eadcfa698b5d3b5eee3b00953ebd61aa6d8fc6dbc79d84b37ede2b1d24bd6805581d0beb6decb11da5cfe06dea160d71c8ecd44b50bf3cdb7cee03f50f706a5ed9c44b4a1842064af5a8119879f2a9f852cc6779bb0a4a4d9800ff827b4c4fd3435a5b3ace2019913994f233b8b4e311f2f0f527f75fa90032c0c62034bee19780605476dbc0926b8903d644f81ee97f357150815356b3e72989601f65152b6372da5473fedf459e8539c3a51739406d5e813d53b2aa5a3b306b53396718bf97ead59d68c18351133c41ef2389a70d54a807850eff1eacf73fec4ed44f9c500c4ea2444b78a8af1638e8e45c550b894db7dff16639636b09662553f2b4bcc1892a6391bfc554ba94a5f9d220667e6fad05a6c71f6753bc6c75b78574ca4c22cc0c9b276ef255fae643b61a888cfa778e80c14c84aaf90e0a9def016d3d20e63c77e1d3d699ff4c1efd6343e5b1b2f5e5a00f440a9f964d259e48b5baa83810762dd048d5f60fbe2b0b4a8007005cd0a4fa75b07337780fb4278c70218b99a5d8f2db25e6703966f7c8d0862b56155191a6ed900573234f67cd72101a9f44b5d86f28a47916f7040d7bc1067e6166159f7b5ad15b799f5db28e136953e1152d8bd4dce1e172bfa2a9ada1a77767632ca5cfd3530717248ec8cd119552f9d3e5cda332c3d52676b24861f2f1c6ebdbbd46678263372e633f5f950b3fc3dc6ebd047a5be01498f6f05730eca938b7d86acba096c3bc1ed0d275ae3b3486ab3b992d3dd955f7a0e6da0f67f275e0e1f39eefb33312d9a8707c8de5de915b33ed6bc021dc877db2ba0488f7f1bc15a8e974ffb6db95befbddcb36c469b832f80203e0c29a79d068daf53b609edef4770ae37e06f3ab10727ac33c093767a4c4686128c206611d5fe895b58308f95a38980b6ec5c62775a5ac14e3e6cbc6959bc1742b55f137a9487a6e4510df0a890d483d07a5d7a25f8360459c0d7b4481cab13958f9d694a07b9230974781472208c4261f7cc904d9411bc0d46973c2dc3549fbac0624492fc8aa8f17cba3568e70e3521b3ef3b4162cda5edbd1c11156dc163f2f21bbf662167301c59959b156fc1cdb1c86b8ae92bef33221c383261150776f54a13eff85406fe30eb69e5fbd2eb9904134c2e754154cdd19fcb6c7c47c31ffec92f77e8b825887b476c93ae666bd3a23a01343c1e11ec36aad4be371d169729f62479b5a13b572702f97891fb067af08868ab9e12324466af3e512a84199d6ef192d629e666c6007f323bff49f3cf6e1ea0e8a0b166df333a48475377a1ed5834f989dc075f2cb114629b1774790a6143a9afcd740959f0c8dc699b3c21ebe6ad8edac986f418c51e68e8244de9b5634ceaa4acb188b465723b7a2d3bcae9c19fba1af7513a81288a4ef9e19f286daa19a962abc5317115d8adcbef5d226bcc244e36cca0e30e7d99cd73f73bdf2b6ba89f3166f01742690d802ad926b2aa8b0f8679a2052609cdfc26afa8e757d1d3f27f54617a9ce38b0204cf0589013863474f7980ecbc7953f0bed7db29f3978666ff52eadefc1b81dc0b58d175523c1b57e8127dbb8d175f35757839b4a3b3513352604b92ae52b20ac641d345b4a94ede1db815ac7fd34ae5d68c5f39cdf8889232c070b0fe2fa46e5847ef3e10bfd18be728c3dc51af5ea24619a1e21ef1d8b5fe456989e4028907aff5ca97a4a7169afb46b64b135d100ab6bba10bda69dc45d83fe1e12327e95884e3247ac3fc4183a2fc8aab4ae41ca601d11da6cc71c61df22175522278bf9546a853ada66b13093d2407236c25d213c9566cc3d0f2d6199e642f02b53ccf554e1590a24f74bb0911e939201310b6d112024b556924a2579fc40db3c12350653844730d7702a236371250ec139e6035476da613be32fc528290ec4e829a266001d4459c9df699a2265584520f1865176710c8934313f476d2d13e6ceeaf238777e68d413ba90d65135ac44280ef4e1bf0c214ceeeb8bc8afc93097a6a5173064242d42259ccc1a80a2b88a649697710f206ae4b11c2e9e2b01336d5b8985a33508d36c87948e80d3fa3f6a4e10b05827041e0c112952f7f368958e89f89fc5e5bd14fbaa9395b6f2bf22648b733a71b94842d283a221ae27c53bde18a7e1e54ed6548cf9414b6cfa7ce38c48ed39d12206e2ccca817aeccb8fa98008d6ceebe8d64828eafb79064e457eb231b7a5b383d72537a57b2b195adceaab1e48892f24b3f3e063f3ab45c7297154834f9bdaf6f29d39b7b211c4ba8d2d7926d39671e0126bac87f7a573a894f31cf4d0033f3e4090014b7f99f28d38d559b946815f54240478b3dde138af074d65466bcab5a3720cdd5130f9b8cc984c551360bf142db064b25f742000c048d8fc5f3be4231de2d6cd7b9e023b10af4fa74b1cb457269d38c00873d1ac1f53ddeb3fd17ddcfab9a41da8bca7c4a7d7b3694f79315dbc45387a57a51634d375c35c8cbda6fd2dabb1b0db321cb9e3faca314786b920f5373b23dd80bae021b30200f90e920647e8f4757c16cdaa50511581cc717db4d07eb05c163cea29a136f45ab5d9d67957a2e706ce87c0d6894d6491e5b04d2d01b61fd1776993654922869e5a5f12e94c368e5fa880558b67df7e937b0f48f0457b2c789f69e3a596fa00643b83f5d30746dea8bbb5583f59eb841f70c1c55820974ab5f8962f2b1120cbd78ac5b4928079d95b0bfd035b34f0e38a787c711e3aeaa2e44d7b545c29f2a60e8ffa64138b0712a0968f3a4829cf0cc02502a2e540623b9face43824a168f46f98d26e2bc933266df147ba3fda3239acd6320af45b638db7d73893f9fa531cdc78445bf169de912666e36ec6fe040c6901a4ee0b215aedd74da74d9d5b9c842ec7def7c940601ced3f0c1ee6e154215e8a7fb1c80e1a547b090b97a0a48fbb63927dc9a5b8ef8bc1866933de9236c57d52559fbb376b9e9199643eb295abb1f0041f2106754488a2739918ba2b84019e463b4561bfa0c387a1f3ec50074a6bc781b5e06bf62747f7fa1a55ae34407a083a096eddaa506ec9a435bba785d89db6d61574492f45cff03023b08907fbcce91f13f4d845735a3d4eb743ca84a64467da14566811d82459975f3f0eea566bcce1266b4525f6b49a983b03e3dd1deb01912942e025d163871f45d7c65d76c2aeb61932c34fcdabda4ad37f6a4627988017a1e8ad666841dee8d1f05f9146a82f3d375889a1ce90f19b86e32f0ed6006ca5e6c70cedf828697650e35e4cab43cf4b7c361e667920256011b93e39bf3f6130075cac81b338fc38b1d03e7858f90bddc3db86eaf169e2679d9e07535692513bf952cc67e91c7ac4b61e22ac60dcf877bd3f173eb16866232e79396e2e85faacd8418c4ab416409e6e9e3da11dcc3838ff6ab1e9a6845e33e544f7e5289a30e21083c58091563d51640b45f4e96a8266244376ff4e174759c389f9ac8d99274932fc400fd4d302bda442aaaa0339c07622049be33e50c4c27a05d609eabba64fd7f9728b049f704ff07b5dce613c5cc25781637870865c1e4e71e8e7294e4c736aacb23c2928b7d84e2eb45a2ab210fc89bf2298094d8f593c2e195137553829a14ae491b36e2680d5ce0dfe1b97266e48cb076e2997d44eaf7484c7401adca2baa7ff518ce6116d1b509370736b16943afbb70f0f6b0f35cbaaca929434724f38b445647b17cfc5d6639c0b60c094f62904742755c16922125479be318ea4d76e8680775b9fa77242145b8d908c0f7a5ea150a69f2f1f4c360f42cd5c805eb601a422a174680ac867c3d72daaa6ed8681ccba311e23f0a29017a1f1a6da6ea2882ab9ba87f18ae0727eb57dad2ce0628e93bce1d35b74f6aaf44af516cabb75578dfbc32b354ade1829391684f3f5b0beb4a4c2facd43a50b9800356c18137237a0b1a94760b77fced878e4b4126d606843f2269666776e1b19b25a9e918c2552f2d1fabd62e4ee994a1870bd03365e95e670da454d066284b9ab2aea1c284fb128f0d9d1b1b7192675d2fb89efd1f6d57df6ccfd6731e4ed8597bb09f483b77ce8621f50ed53e1252b3c113bc471a9a8c25613f56db356a90572720bcc657abd36f26c4fbe37b90570a0240201d9210d8dedf99880ffb92b804e1acdf1bc17d60a2303df9b67d11c75879bc7675e2292888f140b57cfa7676e162dc0fce1e7d84e33a44e99e7a7c0b2c401ce9f512ce19f686b22ee15b95aabede302a8d9b9a41add70f713fae394e79567c24e02bae00977a2478a6930230f0e62b1b4d5063384343519381ea7b0518dea9fef7f37b6ae9f00c08eba7b09c885067ddb5ba05da953c6fa99241bb0c6c3b6945e07af29eed50f4b81255ff36f54032b63530d5807727479b59df7dee1880d6647df7fd014a0605f2dcf058b0f5cfb49d6633ba288ba1ff4b43f7f13a1dfc16d1af00d779e816b6cdf47900f3f7d736673ed13f48c530a821cee8924b6038e09323bad45c5a41b04230de62e8938e13fdfa393c80cdf79dfa9ed1a09bef1c285e486f6138d1a326fefd1337be6071ccf39b697d7d7ed0b2cdb1da50b037a76ed55f20beb4c768865b8bbf9fb3a71f5907377c0b36117c40aca6057cdb5397d6f1222375af5c17ca0175f30f2d7b5f2e82005045f03aaec0a5153d1f3fa3db8089e3a56d2eeb6535809daaebf524333c50e9107626f6927f14b6f2cf9be4532335e3ee933198a26226f90cf10fbbcd9804fd45f3d25b1014596603e892d85d8f6211312c2fcca6c42bc5aa990df16f4257ab9172082bde8c116ad9ede03f3110eb736cb7f95af51866b225b98c5fc7e52f93f43ff48993ece51cee0db27af3a779dd182fa64669958897f7242cfe0eeaa3281ecd6369e76ccbb3d335c0185c2d110d57911bfd9dce1108eda9fa079fab6099b02df75ad6b1fc2d0f65eb8f742e141e25f592debe278df31c6aa7d76864353cfaf41ddb8c5479c72c06a9c5f73f66a94844da05aaf4409848cd81cd0076f2c29f9427df9a01808e87ca57a727c594643978cee17b643d9f9ba400a28fdb4e98613a5069205ec40b09b61835311d3163b73a7cbda8b150704cad7e6a248db0c17e304118a823a1c5225b7a6627e27830ab468b4c7f98cafc6844e978f368ccb274796f632e3a461640bfb1dc9b6e4a4b16fc5bf827e767b91b766630a71ec69579375d25ba9eaab87d3215b7b91dc5aa96932d558e4c0f4b0c2502f2adb9ecbab298a6cd8e04ff6815d53cadd47358ab152007797fea49cc0c842b9fdce98344c7801cbdece91218fa17c7e61e714a61612a160e1194b6752df36dc2c5eb5ce54d7ebad386dff6669557cae0c7fb87e011574e6f9bce95483a14aa37e9f539afd5d912c1a3a5931238d4bc9de56ebf5233c865daf688fe93b6462ac9741b510dd1a6f79f94391607f04bdba801552a6f4715f1b8ff7bda73aacd5d278e3844ad7eed4be8fe556765ed27f1164115bfe4471d8c58e2a9a9a4c45fc6c984b9f2d8769"}, {0xa0, 0xff, 0x2, "5097d5c722fa354c4a8aed7f0f235d3e518ec575ac14df2ee774c9e6a88b76ac963dcf2b538badfff87d197b7a97cede34fce1b1bae68ee4d69d7a203239f0d60721fcb1dd6d2555d91b9daa9f113c6abf02c1eea1d1d4be5f5814523a9ecc35ca0b86ce00cb0db01c6539b47c276778fcb4e153ea155b3b9eaf6a19482e06e516a3fb86514f3b524690f7"}, {0x80, 0x1, 0x6, "d74c135cc5772787dfa3cf654faf28130f1c6b09fc4ae80cc32ec5c3945f86f802b233c8cf2b5fe09a1d5aee7883986f37485a5c7123c22729823341c4692256364f18e1d7943068a54835466f4d19cf258f2f6ed3eeda0237ee4f18d33e84f787efd165a6338316f2bf"}], 0x2308}}, {{&(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @rand_addr=0x64010100}, 0x4, 0x1, 0x4, 0x3}}, 0x80, &(0x7f0000002fc0)=[{&(0x7f0000002a40)="714ae60e579c3882339a6ca0313e315c5c7feb66229a56dd634c41a581d17f0d94ed24f9746458387e7c02b59a2e0621a3a7735e6791563cd6d4a609a101d7a6b775de62759d695a0710c1879e83e30ad90f8abc1ceab31f5ea31bdc985d31c1b56fa7b0dcbc1432958678dd2c7602a4d241638c6b4ee311016238f0c998a09efd83fca115dafb399a1dda8a884290acd73b75999a62934d13377e3e167649b9a347d86f5be480c75cd78c18a3d88eb3f9426a38cb1c49d5ca2b17d2b248c7d499094b766151aa6ac80512684d00cda603c962c17ee49f3af5906ee7799e56b19e036ffc348e50125b452b48577b45bddbac75cd3a", 0xf5}, {&(0x7f0000002b40)="0fde054af0431f94d46f7defbd126e9f1173daa03091d62a50708f58e61d2a631ccee7b19d9dd67cfb8a07541e363b282842cdfb240c2217e25b101e2ec1aee226fd8c2513d97f95e61953873e9578ca05bc7d32804e971575e2c969107596e773828a59567cb7dfeb8bc9704a00c1519a7fd655cc6e6453bd664d14d631952fd03f26891996360566c1e235602aae3c26539dd7bcff62ac25cc83c7afc5f660734e9a02f1013f448d2b258bf5d50143b82d7fac45fc8dedb52a9927aaad2a", 0xbf}, {&(0x7f0000002c00)="b0373e0075456533ad4284de780e4df2b3f67582ae1684c21c5a93cc5ba6b4b012d59712c4610589c26474b2ac6e6555710904d48dcf343673a6448eebc2351e6c55ca8bbc0926fe03ac1d53c468534046ab93258a8fe2ee3ea27fed81428eec75118f80a9aa68d5681647b883d1969fe4d9700c86c90edd4f1caced0020d46bdc8ebfcb9527983e36d81ff613e5aec418fdccc429a43be702a766f8507546d36dfda59843095f5cf0210648f7c981df23bc9787d9145ed6f1eb0aa1dd249edb2457264c7bf940e160c1792e6a14abd2f5c1b720b7daacd92049c7", 0xdb}, {&(0x7f0000002d00)="10cc5d3ed993a51922032ff9651820fd7134d63885d50b185317e74176a9f560e7d309180977bd425c5cda75e3bfe0bf9836b8dcae40a54786c9bf199168ef7a7185e27d8e1621ab9a806331358e05f6c38f3a9a1727bf9b9c7b235cc70800c0a6e494887f4e8e30160ca6ce8ac556479ac137102d593fb64c9136cec866288f936a12f9", 0x84}, {&(0x7f0000002dc0)="23982e659ff329574947a054c3125c26ac74ca97e7fae6f3796205875e77c7bd25cc7dda83aafcff5c65ffb43409048971d40e0c71bbb0b623c3b40f0841ec59fe13b8d7bfbad59861e820749e8e7bc29479efb4d73e31ab14976891c05a6d04d49e662b102246c905676bd6496448635e5450008e822811901137f7099a37b69ef400615edf40816c408effdd8d71a81bfceb6d3f6efbff9480fb8d2cb53cb4f6a41c87324237fa8fe0be28d6876ecb7ba9a971b1a679eeb0ffbfc0d273e4450b0968ff1f433fa415cd0e5c9f7cf1c246781d4812f72cef78455d912c9c566c4cc7c2061831c94bb8ed2590da840d3b435baf33517cb4d715", 0xf9}, {&(0x7f0000002ec0)="7511a39ea5e9f9d4bbac417576814761877ba2717de5b589f86b4fd00cf95976ebd6d6be2c36362f0b99a75559ced30e8c330496f15b40231f1295bf357bd2557ec0c60db070d7ba2ac47f180a630a5fa32dcb7b3cec515a56ad3b17264d5e32041e38262b6ae205fc8fc20342b47c4201cce03712b2ed82d7fd23669e7144f99615fa70fc9d8b282085950dbf542935c4cdc4dbf185f6a8c8572fb5c740ae8ba475d17a0877ec0c748865c58174a3b724b48e5113cd960892d31f5c986b05164f2203670b5d096beadf108d9a82f58078f22abff2e529b2c6d6aac3b5e22a4c3633220be44aa716ad2b172960ac1b961601a86fbf64af037c", 0xf9}, {&(0x7f0000000080)="338bf63e9a514250989f362417105c746f4cda27a7b5b6eb246ea81365239cbbe6fb64c5f09e9c4d0bfe", 0x2a}], 0x7, &(0x7f0000003040)=[{0x1010, 0x10e, 0x8, "725ba75a93f7139a67fb3d625b8edac135adfd020eaee469dd59f7b2e283d7007c5942a7a58391ed0fac74760353fd27ee146a51f04e8005845fc7a121446045e59af601c900e3823b65473bdbb9c98a06038f8d712dd4fd7fcc9e2579039a9e6c450aaafde4d03bb9d173643276b127c2eeaa5cb6629def909ee8b54c1a203865f4f82cc34ba534795dea05641292b862ef7af8a62bd99d25c404424e7a988662bc5c5d98ed12f0a09fd17afe1bafa9c9b3f34687920658160443e207daa7db3d07d0b7e684a92bacaa5b3a484b53b69f14dcece146b4bcb60af1b4cdc5091dbef94110e7cb91ff0c742e0cad9a8cfbc1f48d6dc857a4c7b288f4580341e160e3c629465cdeea75e98af12c6091e57fe2391dad73c5c05f525421ce3ce09b1604915c31538a63bb7e00a3f027f32676a56553166252c4076391f4d6fe7ff56fa5d4c9f44a5c9e50117eb93d8df81a1f711cd1250d62a839dc093855c80ebe607b6144b3ac83c29333fb9ef3a43ac9a84edc1cc5d5c164e9451cdcd30760412d64af4004b3639db516defc1ab96b524663cfd6fd29530da9762dda2c0731f2c9cb15dcfccfa44e403b9609fed863750882ff48857d1e831fb0f5c9073fcbe08b9a4ea99b0edec1bc1f57b3ce867cab21e4b5f4dc2b6eea6fac204e135efdd9a4ca6caae57fb5651155220f0703efc871281b03acfbc7dc1f998f69af85a0c44beea61d3f339e01687d95b3418e3664ec452d6d3ff487f614d596a688436239553f47e8212a35ecea92de4b5f698e23ebaea4c8814963e7d82bcadbca98ddaa119a130e677b86ef80ee5ff5b9c69c1c437aa31db1b2d0cde3e4adb2adcca18e8c7a1976641d20fc0f34196b94e3a3d0f40d7964526291eda0ec2aad80767c3a46029184c24866af7396ba92e02705873041cf01315333682215dd801e5f19b137e159d19ffe0cd6480ebd69b5e6d0bbf9cd5ba24d29a3a1ce0cd9bc83017201e14d8daa45694e593cf12459fb7df0f3a27a45ab5ffdacce525a080c00e8a7b41116dce2b727d1a264cd9625b226f1b63c934464501059538bd659645e829b762b2e85799c9a0db77dbe6b0967cb34498effe1eda5d23af6186dc077ba1c3612a2f415e453c49eb2a2bf31d0efd39619d8691c33ca67dff1a3f58492182572abe1e5f0b4af4dda63f34c5ad7886524d96c062781d6be204ea209e2b8f8fba8fcff09a3ea7a8f9d46b66ed6da133fb12071c698c7e929dd804f6456e7a7747fb9d4856aabb7ddc54d6ba0901ad5749cf2dfab55a7e7150d6e13048a91905f1d742d050bc34b8df1847aa0ce1a0d167a392354b27fde02a645b252471332c4a431365a110f4fd1ec37d4c9aacc61bdcb1a50be6a527f07cd379f59cdf7605bbf1e5751ba4a5ec39a61e4305623c56b3bee18e1ecda0c0b357a1992a7c32ce319ba8152704033f45e998e22df573cc1f7a4f82b770af6ba1d2d677288724933abc0e4dca87cfb8493f6166f208ffe37c757f758e8f210c2af0d5fc30d452fecad3be3441301b380cdf046c5058c9508eee4d4fde99caf762af9fc83b60a5c282a70c7132467b575bf89cb37bc24472e5f95422c77e3de0186b21c4d155e1d76780660b8afbaf11f15c8122db0b65136986b68784decf41bc49d78367b5bb3b31eae8df3babd226d048e5c73f944572c7b61eed123bc761b5ad56827527ce6afa407b43cca179cffffb67accbddbf7d594993fb0bf6471e0be8c23fe772b43def7111ce1432c9be6b741ce5aecad1f66e3f0602652eb9d922cbd76c1b07482df1d73cf71b28cd919e17e89d7fc5da9fd9e1287dcf5bd6ad7962da568de6258afc3d9f286d5bc7345145a1e8bcc83f039264e3b29880879a752e6501f7b2077a5ecd86ed43aa01ae26513dbf6e8bf6b20a2eace27a864120cd358c69f29630e307f191359768537bd2ea7b8688d1dd59171b86fa800c939ef6cd7f68baf77407d4001895711caa87db429714e1d0432b48f516f7cec7921d010b8be97bfc9dbc4e17951582dfd3acf7eb8ead20d03c0d88c8ab5b574917b43bba6973f2cf23fff297b6b92bb9d4c136211443e0165bb98cf15cd4c03b4407a7f4e1bd1b46550778f691fa95b7641362d2a2db3194ca0e0d1d7bd72892a41a954ca4559eb7c0d3cda11f56be99d798e16a65d44dcbe8bfd1840c782f1908f805f94d0d1ea2e214e2ed56d99eb448f560e6bf65035402024c914985cd855c4417cb3b3ec832ddfaf587ea0f573e6cc14093616a742408cb39304b95aaf47ab4f5d7ea682b914a384da233d3e68dc5871a5617aa6f7662406d577448a646d4055ea961a40dad651815156941824fb4dcde68247161aadae08d53759714a218d578a14ec7e944df0e0ef7295837d9ff9efc1577dc32355d1c9a8b5773af5dd7464c97b3ba0dc692cea48539dd91c2a063bcc86de546373209e946ca7e2759a9fd3c67e5e599c1fdc339e2fce7c06f5d45542927ccb87059ce8e2f7e26c96509105d4a660a80fccffbe8e5ecb7830ab974637b13e3f9d42a9899ec9e2182860b9d3647eceafc1c36d3004cc7c92998d8f8f37d9608eace204b6e76d862cfd5d254ee332696d7b781e1836e6f6dc89743c7b824b0d9f9aa293c39fb8a5f2e11179f8d180f8c71cc51fa92663766ce788608dcee655a2df62124297620032fcd2b4ef9e4aca59085015e8e0c7fd1946d8b254af0922e7c4ca0f78cf8c7f1c219ea3a0b337a2c23792539ae1430b94126403f26b650ad53e006e92cabe9a3ee78fabcc4787f6a727318651e3bb0feec02c9ba30b82e3c8beb2fb9ea2b8fc9ea256197213c2128dcba4f161a01ec4b8ad1e1754fd37cd7c5dcfd36b840eacbaf628c6e40e01293c9463c97d6233500f6ad11f10bebf796daccfa58c4943133f09abef53edcff06a31dc42d304095b9db575731ce5a8bdd0157c5b3d46d1198047da070fde52ab14f4fd59941f0617e2a23e93537810e583ba1b58efeff3597f06cb1e9146c8a4f91ca7df6ed494248f905ba08f9f2ec5d586a8c338eaeee667fd7709bf219eb740d001b0401804fceb778c28c25a949aff9a2974dffc7923d66f0b192f0863f6a514a47a68f66f82f303edb2add6cadee503c446e79e9b9ebbdcbdb3607111e8c3eae28549b608fd031b4000512ec22ded0d4b385bc82745735c0081863926c2be9e10344cf437d1209aef2300f55ad92c3a79adc799fa900eda3a75a268eab661ca4eafc3de1a912959ef17873b8cc44c92662d7233da6e45eddf35e98bf96056d7d9baeddfe71c306a0fe7bbd9cb2354de527bd740abebd1375448399b440159eff1affa6d144e20751b304aa15a1e321990e63c8b0173ae32344468fad8b9f550badae74eba6b892a9e1155428408413cc6307d37b7ad4def4a2f040e6dde8698f3d8c705678080f48d064099812d6422d5b797ae9e30f9489dda0cf4c4021678b841aac6f255ad4bac869c7b16039048a86719209c6264047ce6832dcf91fbab226e6c4b150786433c4a8147c7b3c825fc241cabb63afad5cf2f9f9cf81c363d23331823c6418c4b0f5531905b0d8788ae8804d97354f2be3d8fd737971c11bf8d138e0aa58fa272dd2de10872bff56138e07a82795978b905bc5f0f3233eb7e18b7102e42c82e718882416b6ec21e08d2775ca6db86bf868482fb7eeb58eef9cfb31bf5046498ef4ea8467168c05f29c35d340819cf44483b003e4bca97b295e30e486fdb11dd7f52440227734666c4f546242b61fa743519f1fe2532ee3a1e7e9a3486925462c2626614accb3df402f4311f981ee7c85afc9ce493449522627c69d79dc681d238dcf1531cda47bd32d1a8319e1f715b78693dcc651f0f203828163cae452bf3c0a40c85b2f2a417a36e5b585b317c04fd4dfc6c20ff0784c9d63d3c20a7a2b287fe91893336f8b65fb2023091479db197653f5d958601212b03167f745c6758df71eb66a1157c1fd50575b22aa9606b5f263e9ff2f036a9d7e68196827f7c74b8ba56ea223c204137b674803874b6242ff30ebc672e2c602e3c1f6b9478fc20afaa84775558189367a6974d1685123ed365f1113027c98aadd8863b4f9943283360c33bca10172919c3554123de21ffbdb53bcffc87c91e3f7ee3260c489164841dd5cbca4886cd8c9955dae072648cb70b9c0258ae252ce6b2ee9e34e63e5de38a463d3fb177afb348b8f5d81175b4077c45eb2cd6cf98770db8f6eb0aa99cfa8abf7f516e604be669a54df35c921a3eefa81af391793d0b7b3560bfdbb17092038e95ed4e642a59816decdb50a1eb4f620a864d364d716fa15dc822e7f4e95d1e02ba73991749c9931c371bd6c16bd5c6f51836331027424372c0c7312fa4a7aaa78666a6b85ca6fb022d4cbc7a5144e759f2e33f735e656bce97477901023485259f1774b5b50fb741f9dfe86abb5e3e81bb0e7269d8217b35a1f2a527851c0146f983ef1c2ac38e5209b4a812fc2eefc0d26efefc9541d0d38484eb0c92873ff6a63ebea6d2f0b6db8a02920718e8061854b72236809d40b54adf450b53db60510e6a190d4ef043e6f7b8032b8798e3c99208d6640d92c19128d0eaeff4064b7f6c5f733c948ebd31e358e67fdeb6eb89e4b240a87fc9819e2ce048be547da40455e530857b323d9bcd7fa7a40c6c2ee821da8370c6a7c2580bb35c23d9c741b5276095f37f4217d2fbe893436d539aeb67d982b94f71e0d0cb7c46ca810fe14ba70bdb4ab3959e9ccdf144362cf1a317c8856e2b8232e43822d5ef6f0150d5708d29dbf5d310689b60dee52a996773e2bb251896e1b82536b55546404a2c49a523d18a923fdd962e5f4a531087ab5ba039e9b999f3114425d489311ccab684dae30f8e40344bb6510bf83b103c8696fb5dd56a1fd50f10226f02feb2b6c26d7d6eaccfb59e26348dcbd0f283deb9cc71813534a4bb26767f3591fb2b5fe85c1f94a21fff7dd0e803b406f2e9aca9421b7cf428917c1371e43e2be94b03fc8bb6532d390d34181f5b7e9f44d476601aa75d030b5d6b2d20dccfb4be048797b36c28d35132230f60b7301d28102a560d2ce2fd302d6a8cfa0ebe0591303df7121a3cd63acea0b8172dc3270f610871b8fc3e388419562fcafe5ca9a3b5c93080390516ea988503a0d0137376dabf635b5cbec3764d65746d30be48d2ce88b76a2d56543c626075d55d518b17b116102162dc56e2b2d5834f56f6917af7b83253e106e0a21640ef13717191038361b11077bd2283eca59f1a4d9885f93d44c1ac3513d18a1f2e8c500902586cb910f544288ce116a8d61a5cd58071f777a0dfffc5f571525f6749798034dea3f75a4fa92e8d929fb4414ea36c88a0138470eca0e9593a9afb8133eefbe6d03302340a14e06e7664b9aa75ce6a3ac3aa98afd6b128117611594dae141894d2e0469d6b604575fe385ec5e5a088881a0c1d1776d67a8b553ac4bb28bede66a58470e62881f7cd7c7eb9982156440e0ce664dead750de26fbd004b93ca987e044db021f719a1138887b03f485bab83709650a2001982bd53b7f68f7d476919528b3f2123a2d206d90e8cd44045a1da985699c1f75cc86eb7a1964773201d483ac8a7e85b491b67740b244824273646600105d336229da0991856fd0d3b7b2c7db092a5b8a4675b2c676cd854c2055f4899b7e55a9a67fa177356856c49bb20d3817f22fb8039afaf0b4670ab6e4d0965fb6daede298d3e1cd3d300f89faf64c3b1500b07e7fdbec459700b91555efee583e9"}, {0xf0, 0x118, 0x8, "029a3a2d4788527c48335e451bcd80c42e4aa98ffe3f2ff98bf4e894feb52eade8558f7a03b8c75a91526eb4e6b6d72d0cfc0a50f0886c72dfd425078ab3d2b77dd5e353e05dc4f854d211edcd292d6c6f9a4d3c08d547d564417564bbaac09f008cc9ac80c0a6af2dfb80ed8122838a8b056eab82c837343edfa841a7af44eb6e09c8e9f95e0a7af39a01f3d0f8c511727cc6ecef91d768944e32510d9128e8f43ba9bd3bc0682e93e16117e67dcb6b3ef9c3ff4c384a0fe5fabc978ec7e1adb1149176faafc807bc77bedcc949d9d5c33f4d9aca39b175dd861951c54c"}, {0xd0, 0x107, 0x0, "56e7b0c10878731a4538345e00f511b83dfbcf49e387fc5b9a57b66b9e94de09ca1463a3e6021d3cb4830b31a4e86851413da5b0a48217f94462284c87588ed828198787493f04d11a71f5a3ff74a46743eb8c09b067eac629f3cd3d52259281524d4b89c13428a021b8998dec90347621654923461ad84284046c2d82a641a71bd940adc28190602889a7d5c998367c29b850bab23d4a4268f2aaf31b68f1b82b0b5b26fa3fd09a307c15af4dd80b7f87d60abff31b8b90aaf081139c1189"}, {0xc0, 0x103, 0x2f, "3f0dddc082b15035180e76fa12d4584c4f3f6d5bece1ecd3ca246308264e8cace70fbca624cf2b2e5f7210bdfaf20b7a1542b395fa9145fb25760d705dba6441e011bc93425cf681c9170686af9672b6e4f1a5aeb61f992737b5bcdcbf61faa04f2284ee7971c42bd7fa6b6f66f8d4568db1c7e4e88bf0ecb1f7152e85474dc723ba3637b86666355a5b4a37a3817e34a6f30b7c8c6502afe679bbf9402427d8502717c71a03df8b778ca1"}, {0x78, 0x117, 0xfee6, "f0c7df068c2d946a6cb1a0cc9c036e3e63f02e79b5b703ab8e91f2c8ce976d36718a6b573f73429b7b87dad18d5012e5d9cdf64e7013d0f60c12d0605299c3d7e82187fb2bf72c89e9e3e6ed32800c9264c2edd9105d242c00b38ced7d323db73a920086"}, {0x78, 0x0, 0xb6e7, "4f762f1775a64619369abfd01eff5738223077b8f869a61a1c2a49c39609b69ef5659964217ca17aea2624bd0e6746e371c5a95971021d3bb493b0dc31b6fe96698dd3f3709bfeea8babf030a0f421d44133a5456f20c7623dc16fa542b1fd2d994c66275aaf7fd9"}], 0x1380}}], 0x2, 0x2c000840) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) [ 210.254706] ubi0: scanning is finished [ 210.414934] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 210.427818] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 210.434477] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 210.457070] ubi0: VID header offset: 64 (aligned 64), data offset: 128 05:02:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$packet(r4, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[0x7ff, 0x0, 0xea]}) r5 = socket$inet6(0xa, 0x3, 0x6) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r4, 0xc0945662, &(0x7f0000000300)={0x8, 0x0, [], {0x0, @reserved}}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000000)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x0, 0x0, 0x3, 0x1, 0xfffb, 0xfffc, 0x400000000}, 0x20) r6 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/ip6_flowlabel\x00') sendfile(r5, r6, &(0x7f00000001c0)=0x202, 0x4000000000dc) r7 = dup2(r5, 0xffffffffffffffff) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000003740)='SMC_PNETID\x00') sendmsg$SMC_PNETID_FLUSH(r7, &(0x7f0000003800)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000037c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="28eda90900678d62f18b7e82983f03004b3da93676fb16f2369f2b83fe331531e1862d2592e1b4d7ad623565d51edd0a099425e8397b25441921ae8427d57e6c7a9fa68c0812abc4b32b2532263e058bb74196950db1af836d77f63627b34fa68fdbda93e993e3b1295f521100cf0000000000000000000000853c5ff4b326c3d5b5a90762de84323c2d51b266304f01b26fbbfb24800000008a7240cac5c59d10eee45a26bab5d34c9bab9c2b7a3423586fd80412637beb2e139ac7cc4382775490bbe49d9bc9594bfaa6a437ed06877d98966856613253c77962e8958884f3f4c1a07504bacb2096a40e801f0ccba4e8ba27c4c7c557ebaa4f65f6546da685cb92aac4bd934663866422a5013a2380", @ANYRES16=r8, @ANYBLOB="2a4848e5dbdf25d60400000014f9390e72610002e80000000000"], 0x28}}, 0x4004800) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000008", @ANYRES16=r8, @ANYBLOB="000228bd7000fcdbdf25030000000500040002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x0) [ 210.468082] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 210.474204] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 210.529748] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 210.548546] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 210.569575] ubi0: background thread "ubi_bgt0d" started, PID 11736 [ 210.569644] ubi: mtd0 is already attached to ubi0 05:02:57 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 210.604068] ubi: mtd0 is already attached to ubi0 05:02:57 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 210.624560] ubi0: detaching mtd0 [ 210.629932] ubi0: mtd0 is detached [ 210.633671] ubi0: attaching mtd0 05:02:58 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:02:58 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:58 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) [ 210.714116] ubi0: scanning is finished 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) getsockname$packet(r0, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) getsockname$packet(r0, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 210.973660] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 211.000573] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 211.024428] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 211.052999] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 211.081363] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 211.101117] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 211.121304] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 211.146526] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 211.171474] ubi0: background thread "ubi_bgt0d" started, PID 11775 [ 211.182282] ubi: mtd0 is already attached to ubi0 [ 211.188794] ubi: mtd0 is already attached to ubi0 [ 211.193906] ubi: mtd0 is already attached to ubi0 [ 211.200816] ubi: mtd0 is already attached to ubi0 05:02:58 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:58 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) getsockname$packet(r0, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:02:58 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:58 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:02:58 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 211.323690] ubi: mtd0 is already attached to ubi0 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 211.350458] ubi: mtd0 is already attached to ubi0 [ 211.367900] ubi: mtd0 is already attached to ubi0 [ 211.373264] ubi: mtd0 is already attached to ubi0 [ 211.394170] ubi: mtd0 is already attached to ubi0 05:02:58 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:02:58 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:58 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:02:58 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:02:58 executing program 5: setitimer(0x1, &(0x7f0000000000)={{}, {0x0, 0x2710}}, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x280, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lchown(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=ANY=[@ANYBLOB="3c00000010001fff0000268f1c872d2b01000000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e0000000400028008000a0036459cdb26cd03ccb7e638a66c866a951362d3fa08f9985503f8f45bfb4e9240b9f2a30d1bde27881f17233d3ad01f2177b1a53e51397d581d1549a05c1955f5d2a27a54f154df", @ANYRES32, @ANYBLOB="534fce983e5c2d7673b4958005e750e907d4fdc7bf13d088ad203bd736a916945b0f66f933a31733392547e20febfc8d209cbf74cde243bf2406fae4ddbe02d390fffad64b012deb14b92f020709e51b3e84a45b53c64c5a4c9a8ddb7d983a19eb11f0803dced96346ee580ea4a890f90a69b44067df0949c216f3b291122bcd89a0777619426cacf7375a9e293541d7f70f4c738e9580acb79cc9465802b2a647ecf12edffdca4a00493580b7c2c846f1a8bd3609d25a90e6f566609a73002762a2293a435c82a31624f5ecd4951aa455faade3a054552be833f7e8d36990ce33215c37fb9a705dd25c047668a5c3722f4c5bc28c4ee8898d88e31249734df2ffb3a84b62cf45d556dddcd15a1fca6d51c5b71e1320bc9815efb27ac53455798face54073de5ee1b88d9772949b45431b2e"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000003c0)) r1 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4040, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_config_ext={0x8, 0x8000}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) [ 211.483006] ubi0: detaching mtd0 05:02:58 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 211.513152] ubi0: mtd0 is detached [ 211.531012] ubi0: attaching mtd0 [ 211.547096] ubi0: scanning is finished [ 211.681914] device vxlan0 entered promiscuous mode [ 211.689591] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 211.709753] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 211.732083] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 211.753992] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 211.771852] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 211.786124] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 211.796215] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 211.807592] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 211.822064] ubi0: background thread "ubi_bgt0d" started, PID 11830 [ 211.822125] ubi0: detaching mtd0 05:02:59 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 211.849225] ubi0: mtd0 is detached [ 211.855791] ubi0: attaching mtd0 05:02:59 executing program 5: setitimer(0x1, &(0x7f0000000000)={{}, {0x0, 0x2710}}, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x280, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lchown(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=ANY=[@ANYBLOB="3c00000010001fff0000268f1c872d2b01000000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e0000000400028008000a0036459cdb26cd03ccb7e638a66c866a951362d3fa08f9985503f8f45bfb4e9240b9f2a30d1bde27881f17233d3ad01f2177b1a53e51397d581d1549a05c1955f5d2a27a54f154df", @ANYRES32, @ANYBLOB="534fce983e5c2d7673b4958005e750e907d4fdc7bf13d088ad203bd736a916945b0f66f933a31733392547e20febfc8d209cbf74cde243bf2406fae4ddbe02d390fffad64b012deb14b92f020709e51b3e84a45b53c64c5a4c9a8ddb7d983a19eb11f0803dced96346ee580ea4a890f90a69b44067df0949c216f3b291122bcd89a0777619426cacf7375a9e293541d7f70f4c738e9580acb79cc9465802b2a647ecf12edffdca4a00493580b7c2c846f1a8bd3609d25a90e6f566609a73002762a2293a435c82a31624f5ecd4951aa455faade3a054552be833f7e8d36990ce33215c37fb9a705dd25c047668a5c3722f4c5bc28c4ee8898d88e31249734df2ffb3a84b62cf45d556dddcd15a1fca6d51c5b71e1320bc9815efb27ac53455798face54073de5ee1b88d9772949b45431b2e"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000003c0)) r1 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4040, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_config_ext={0x8, 0x8000}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) [ 211.898396] ubi0: scanning is finished [ 212.032985] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 212.041050] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 212.049102] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 212.055849] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 212.063336] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 212.070805] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:02:59 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 212.078621] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 212.089861] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 212.091792] device vxlan0 entered promiscuous mode [ 212.104366] ubi0: background thread "ubi_bgt0d" started, PID 11844 [ 212.112547] ubi: mtd0 is already attached to ubi0 [ 212.121456] ubi: mtd0 is already attached to ubi0 [ 212.126816] ubi0: detaching mtd0 05:02:59 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 212.155605] ubi0: mtd0 is detached 05:02:59 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:02:59 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 212.183730] ubi0: attaching mtd0 [ 212.194852] ubi0: scanning is finished 05:02:59 executing program 5: setitimer(0x1, &(0x7f0000000000)={{}, {0x0, 0x2710}}, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x280, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lchown(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=ANY=[@ANYBLOB="3c00000010001fff0000268f1c872d2b01000000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e0000000400028008000a0036459cdb26cd03ccb7e638a66c866a951362d3fa08f9985503f8f45bfb4e9240b9f2a30d1bde27881f17233d3ad01f2177b1a53e51397d581d1549a05c1955f5d2a27a54f154df", @ANYRES32, @ANYBLOB="534fce983e5c2d7673b4958005e750e907d4fdc7bf13d088ad203bd736a916945b0f66f933a31733392547e20febfc8d209cbf74cde243bf2406fae4ddbe02d390fffad64b012deb14b92f020709e51b3e84a45b53c64c5a4c9a8ddb7d983a19eb11f0803dced96346ee580ea4a890f90a69b44067df0949c216f3b291122bcd89a0777619426cacf7375a9e293541d7f70f4c738e9580acb79cc9465802b2a647ecf12edffdca4a00493580b7c2c846f1a8bd3609d25a90e6f566609a73002762a2293a435c82a31624f5ecd4951aa455faade3a054552be833f7e8d36990ce33215c37fb9a705dd25c047668a5c3722f4c5bc28c4ee8898d88e31249734df2ffb3a84b62cf45d556dddcd15a1fca6d51c5b71e1320bc9815efb27ac53455798face54073de5ee1b88d9772949b45431b2e"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000003c0)) r1 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4040, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_config_ext={0x8, 0x8000}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) [ 212.332615] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 212.346463] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 212.376700] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 212.413096] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 212.430982] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 212.445106] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 212.456696] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 212.497050] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 212.525116] device vxlan0 entered promiscuous mode [ 212.539623] ubi0: background thread "ubi_bgt0d" started, PID 11861 [ 212.546224] ubi0: detaching mtd0 [ 212.554911] ubi0: mtd0 is detached [ 212.568591] ubi0: attaching mtd0 05:02:59 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 212.609581] ubi0: scanning is finished 05:03:00 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 212.745519] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 212.753262] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 212.761264] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 212.771856] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 212.780306] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 212.786585] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 212.795489] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 212.805562] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 212.815255] ubi0: background thread "ubi_bgt0d" started, PID 11887 [ 212.815315] ubi: mtd0 is already attached to ubi0 [ 212.828245] ubi0: detaching mtd0 [ 212.837063] ubi0: mtd0 is detached 05:03:00 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:03:00 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) 05:03:00 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 212.843624] ubi0: attaching mtd0 [ 212.905058] ubi0: scanning is finished [ 213.051200] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 213.063109] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 213.074021] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 213.082002] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 213.090066] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 213.096200] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 213.104799] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 213.115432] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 213.126169] ubi0: background thread "ubi_bgt0d" started, PID 11912 [ 213.132728] ubi: mtd0 is already attached to ubi0 [ 213.138412] ubi: mtd0 is already attached to ubi0 05:03:00 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:00 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 213.149733] ubi: mtd0 is already attached to ubi0 05:03:00 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:00 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(r1, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 213.173827] ubi0: detaching mtd0 [ 213.181822] ubi0: mtd0 is detached [ 213.193013] ubi0: attaching mtd0 05:03:00 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 213.234087] ubi0: scanning is finished [ 213.369509] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 213.376670] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 213.384868] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 213.392741] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 213.401297] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 213.411683] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:00 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 213.420206] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 213.432344] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 213.446523] ubi0: background thread "ubi_bgt0d" started, PID 11935 [ 213.454878] ubi0: detaching mtd0 [ 213.479572] ubi0: mtd0 is detached [ 213.486409] ubi0: attaching mtd0 [ 213.524862] ubi0: scanning is finished [ 213.614097] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 213.623685] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 213.630599] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 213.637077] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 213.644799] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 213.651204] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 213.661029] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 213.670573] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 213.680124] ubi0: background thread "ubi_bgt0d" started, PID 11950 [ 213.680361] ubi: mtd0 is already attached to ubi0 [ 213.692829] ubi0: detaching mtd0 [ 213.704681] ubi0: mtd0 is detached [ 213.708930] ubi0: attaching mtd0 05:03:01 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:01 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 213.714083] ubi0: scanning is finished 05:03:01 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 213.822270] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 213.833907] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 213.843254] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 213.851649] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 213.859753] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 213.866005] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 213.874181] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 213.884184] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 213.894123] ubi0: background thread "ubi_bgt0d" started, PID 11965 [ 213.894131] ubi0: detaching mtd0 [ 213.906302] ubi0: mtd0 is detached [ 213.911613] ubi0: attaching mtd0 05:03:01 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 213.921543] ubi0: scanning is finished [ 214.031850] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 214.041712] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 214.051065] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 214.058149] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 214.065349] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 214.073453] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:01 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 214.082167] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 214.092192] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 214.102219] ubi0: background thread "ubi_bgt0d" started, PID 11978 [ 214.102235] ubi0: detaching mtd0 [ 214.121785] ubi0: mtd0 is detached [ 214.128137] ubi0: attaching mtd0 [ 214.162345] ubi0: scanning is finished [ 214.254123] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 214.261774] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 214.269928] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 214.276449] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 214.284479] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 214.292489] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:01 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:03:01 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 214.300135] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 214.310421] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 214.320321] ubi: mtd0 is already attached to ubi0 [ 214.320354] ubi0: background thread "ubi_bgt0d" started, PID 11988 [ 214.331744] ubi0: detaching mtd0 05:03:01 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 214.368336] ubi0: mtd0 is detached [ 214.372396] ubi0: attaching mtd0 [ 214.406622] ubi0: scanning is finished [ 214.541583] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 214.548671] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 214.555240] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 214.564492] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 214.572088] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 214.580553] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:01 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 214.588397] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 214.598422] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 214.608809] ubi0: background thread "ubi_bgt0d" started, PID 12008 [ 214.615179] ubi: mtd0 is already attached to ubi0 05:03:01 executing program 3: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 214.642618] ubi0: detaching mtd0 [ 214.648190] ubi0: mtd0 is detached [ 214.655874] ubi0: attaching mtd0 [ 214.683187] ubi0: scanning is finished [ 214.777672] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 214.784749] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 214.795637] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 214.802983] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 214.811039] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 214.818078] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 214.825545] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 214.835986] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 214.858400] ubi0: background thread "ubi_bgt0d" started, PID 12024 [ 214.864885] ubi0: detaching mtd0 [ 214.871792] ubi0: mtd0 is detached 05:03:02 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 214.877636] ubi0: attaching mtd0 05:03:02 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 214.915720] ubi0: scanning is finished [ 215.029400] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 215.036465] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 215.044069] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 215.051525] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 215.059149] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 215.065388] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:02 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 215.074359] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 215.084756] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 215.095313] ubi0: background thread "ubi_bgt0d" started, PID 12038 [ 215.103180] ubi: mtd0 is already attached to ubi0 [ 215.115527] ubi0: detaching mtd0 [ 215.125645] ubi0: mtd0 is detached 05:03:02 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 215.147537] ubi0: attaching mtd0 [ 215.151960] ubi0: scanning is finished [ 215.215698] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 215.225760] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 215.234367] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 215.241276] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 215.248466] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 215.254928] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:02 executing program 3: pipe(&(0x7f0000000180)) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 215.263336] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 215.272892] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 215.282209] ubi0: background thread "ubi_bgt0d" started, PID 12050 [ 215.288881] ubi: mtd0 is already attached to ubi0 [ 215.295527] ubi0: detaching mtd0 [ 215.309772] ubi0: mtd0 is detached 05:03:02 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 215.325336] ubi0: attaching mtd0 05:03:02 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 215.386013] ubi0: scanning is finished [ 215.515124] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 215.522981] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 215.530457] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 215.539389] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 215.546356] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 215.553013] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:02 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 215.561504] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 215.571361] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 215.581134] ubi0: background thread "ubi_bgt0d" started, PID 12073 [ 215.587910] ubi0: detaching mtd0 [ 215.593088] ubi0: mtd0 is detached [ 215.597361] ubi0: attaching mtd0 [ 215.633699] ubi0: scanning is finished [ 215.716555] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 215.725240] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 215.732265] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 215.739561] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 215.746418] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 215.752859] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:03 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 215.760894] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 215.770498] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 215.780242] ubi0: background thread "ubi_bgt0d" started, PID 12084 [ 215.780293] ubi: mtd0 is already attached to ubi0 [ 215.791998] ubi: mtd0 is already attached to ubi0 [ 215.807020] ubi0: detaching mtd0 05:03:03 executing program 3: pipe(&(0x7f0000000180)) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:03 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 215.815143] ubi0: mtd0 is detached [ 215.827262] ubi0: attaching mtd0 05:03:03 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 215.877479] ubi0: scanning is finished [ 216.017645] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 216.024570] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 216.031681] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 216.039730] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 216.051878] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 216.065933] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 216.080719] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 216.092224] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 216.103357] ubi0: background thread "ubi_bgt0d" started, PID 12106 [ 216.103681] ubi0: detaching mtd0 05:03:03 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 216.119683] ubi0: mtd0 is detached [ 216.123629] ubi0: attaching mtd0 [ 216.180071] ubi0: scanning is finished [ 216.246181] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 216.253157] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 216.260107] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 216.266489] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 216.273622] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 216.282296] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:03 executing program 3: pipe(&(0x7f0000000180)) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:03 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 216.290334] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 216.300637] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 216.310343] ubi0: background thread "ubi_bgt0d" started, PID 12119 [ 216.317868] ubi: mtd0 is already attached to ubi0 [ 216.322780] ubi0: detaching mtd0 05:03:03 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 216.355003] ubi0: mtd0 is detached [ 216.361751] ubi0: attaching mtd0 [ 216.400262] ubi0: scanning is finished [ 216.515801] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 216.523189] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 216.533892] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 216.542827] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 216.551325] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 216.558264] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 216.565705] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 216.576428] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 216.586383] ubi0: background thread "ubi_bgt0d" started, PID 12140 [ 216.586578] ubi: mtd0 is already attached to ubi0 [ 216.602488] ubi0: detaching mtd0 05:03:03 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:03:03 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 216.614779] ubi0: mtd0 is detached [ 216.619638] ubi0: attaching mtd0 [ 216.688963] ubi0: scanning is finished [ 216.813376] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 216.820738] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 216.829089] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 216.835580] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 216.843497] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 216.851240] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:04 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 216.859324] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 216.869663] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 216.880183] ubi0: background thread "ubi_bgt0d" started, PID 12156 [ 216.880456] ubi: mtd0 is already attached to ubi0 [ 216.901795] ubi0: detaching mtd0 05:03:04 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:03:04 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 216.921320] ubi0: mtd0 is detached [ 216.931412] ubi0: attaching mtd0 [ 216.944781] ubi0: scanning is finished [ 217.083141] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 217.090301] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 217.101633] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 217.110303] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 217.117503] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 217.123678] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 217.132055] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 217.145324] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 217.155126] ubi0: background thread "ubi_bgt0d" started, PID 12174 [ 217.155157] ubi0: detaching mtd0 [ 217.171529] ubi0: mtd0 is detached 05:03:04 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 217.182692] ubi0: attaching mtd0 [ 217.209435] ubi0: scanning is finished [ 217.300198] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 217.307735] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 217.314522] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 217.323036] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 217.330811] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 217.338491] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 217.345973] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 217.356976] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 217.366597] ubi0: background thread "ubi_bgt0d" started, PID 12185 [ 217.374250] ubi: mtd0 is already attached to ubi0 [ 217.383267] ubi0: detaching mtd0 [ 217.389685] ubi0: mtd0 is detached 05:03:04 executing program 2: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 217.400227] ubi0: attaching mtd0 05:03:04 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 217.461235] ubi0: scanning is finished [ 217.564443] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 217.571724] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 217.578531] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 217.584841] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 217.592100] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 217.599611] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:04 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 217.607326] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 217.616735] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 217.626383] ubi0: background thread "ubi_bgt0d" started, PID 12202 [ 217.633035] ubi: mtd0 is already attached to ubi0 [ 217.638156] ubi0: detaching mtd0 [ 217.646296] ubi0: mtd0 is detached [ 217.666702] ubi0: attaching mtd0 05:03:05 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:05 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, 0x0) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 217.728862] ubi0: scanning is finished [ 217.827021] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 217.834184] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 217.844796] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 217.851647] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 217.862246] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 217.868605] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 217.875933] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 217.889254] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 217.898915] ubi0: background thread "ubi_bgt0d" started, PID 12221 [ 217.899006] ubi0: detaching mtd0 [ 217.914957] ubi0: mtd0 is detached [ 217.919466] ubi0: attaching mtd0 05:03:05 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 217.925840] ubi0: scanning is finished [ 218.017677] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 218.024527] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 218.033993] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 218.061560] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 218.068656] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 218.074772] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 218.082268] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 218.092563] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 218.102144] ubi0: background thread "ubi_bgt0d" started, PID 12232 05:03:05 executing program 2: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 218.107204] ubi: mtd0 is already attached to ubi0 [ 218.113478] ubi: mtd0 is already attached to ubi0 [ 218.127182] ubi0: detaching mtd0 [ 218.133355] ubi0: mtd0 is detached [ 218.149372] ubi0: attaching mtd0 05:03:05 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:05 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, 0x0) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:03:05 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 218.220627] ubi0: scanning is finished [ 218.329050] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 218.336031] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 218.344328] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 218.352034] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 218.362721] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 218.370259] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 218.378980] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 218.389730] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 218.399808] ubi0: background thread "ubi_bgt0d" started, PID 12256 [ 218.399944] ubi0: detaching mtd0 [ 218.417202] ubi0: mtd0 is detached 05:03:05 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 218.427442] ubi0: attaching mtd0 [ 218.474836] ubi0: scanning is finished [ 218.537056] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 218.543986] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 218.550727] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 218.557412] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 218.564218] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 218.571540] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:05 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 218.579346] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 218.589006] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 218.598718] ubi0: background thread "ubi_bgt0d" started, PID 12268 [ 218.598900] ubi0: detaching mtd0 [ 218.618397] ubi0: mtd0 is detached [ 218.626548] ubi0: attaching mtd0 05:03:05 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, 0x0) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 218.638315] ubi0: scanning is finished [ 218.713490] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 218.720564] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 218.732939] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 218.740026] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 218.750459] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 218.756515] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:06 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 218.764683] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 218.774623] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 218.784442] ubi0: background thread "ubi_bgt0d" started, PID 12280 [ 218.790883] ubi0: detaching mtd0 [ 218.800456] ubi0: mtd0 is detached [ 218.804282] ubi0: attaching mtd0 [ 218.822870] ubi0: scanning is finished [ 218.918823] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 218.925945] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 218.935807] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 218.942527] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 218.952943] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 218.960822] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 218.970925] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 218.980560] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 218.993352] ubi0: background thread "ubi_bgt0d" started, PID 12293 [ 218.993483] ubi: mtd0 is already attached to ubi0 [ 219.010022] ubi0: detaching mtd0 05:03:06 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 05:03:06 executing program 2: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 219.022648] ubi0: mtd0 is detached [ 219.026511] ubi0: attaching mtd0 [ 219.038007] ubi0: scanning is finished [ 219.155546] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 219.163847] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 219.172317] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 219.181218] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 219.190476] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 219.196736] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:06 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x0, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 219.205174] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 219.215449] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 219.226356] ubi0: background thread "ubi_bgt0d" started, PID 12307 [ 219.226468] ubi0: detaching mtd0 [ 219.239568] ubi0: mtd0 is detached [ 219.246066] ubi0: attaching mtd0 05:03:06 executing program 1: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 219.304680] ubi0: scanning is finished [ 219.411120] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 219.418260] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 219.425054] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 219.433459] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 219.441572] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 219.448342] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:06 executing program 0: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 219.455789] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 219.465649] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 219.475294] ubi0: background thread "ubi_bgt0d" started, PID 12324 [ 219.481767] ubi: mtd0 is already attached to ubi0 [ 219.486642] ubi0: detaching mtd0 [ 219.501034] ubi0: mtd0 is detached 05:03:06 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 219.510079] ubi0: attaching mtd0 [ 219.550288] ubi0: scanning is finished [ 219.643748] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 219.650902] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 219.661833] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 219.669085] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 219.675791] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 219.685723] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 219.694024] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 219.706609] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 219.716612] ubi0: background thread "ubi_bgt0d" started, PID 12339 [ 219.717344] ubi: mtd0 is already attached to ubi0 [ 219.731816] ubi0: detaching mtd0 05:03:07 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 219.745426] ubi0: mtd0 is detached 05:03:07 executing program 2: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 219.771446] ubi0: attaching mtd0 05:03:07 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x0, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) [ 219.825681] ubi0: scanning is finished [ 219.940069] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 219.947577] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 219.954119] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 219.965351] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 219.972842] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 219.980562] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:07 executing program 1: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 219.988863] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 219.999303] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 220.010225] ubi0: background thread "ubi_bgt0d" started, PID 12360 [ 220.019320] ubi0: detaching mtd0 [ 220.028451] ubi0: mtd0 is detached [ 220.032221] ubi0: attaching mtd0 [ 220.046855] ubi0: scanning is finished [ 220.094093] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 220.101477] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 220.113692] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 220.121043] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 220.128040] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 220.134176] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:07 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x0, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:03:07 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, 0x0, 0x0, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) 05:03:07 executing program 0: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 220.141780] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 220.151158] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 220.160841] ubi0: background thread "ubi_bgt0d" started, PID 12368 [ 220.167791] ubi: mtd0 is already attached to ubi0 [ 220.172899] ubi0: detaching mtd0 [ 220.179480] ubi0: mtd0 is detached [ 220.183751] ubi0: attaching mtd0 [ 220.255589] ubi0: scanning is finished [ 220.352094] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 220.364663] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 220.372794] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 220.379915] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 220.386612] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 220.393810] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 220.401759] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 220.412568] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 220.422547] ubi0: background thread "ubi_bgt0d" started, PID 12391 [ 220.423105] ubi: mtd0 is already attached to ubi0 [ 220.441057] ubi0: detaching mtd0 05:03:07 executing program 2: accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) 05:03:07 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 220.449520] ubi0: mtd0 is detached [ 220.461111] ubi0: attaching mtd0 [ 220.502647] ubi0: scanning is finished [ 220.607574] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 220.614437] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 220.621286] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 220.628113] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 220.635068] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 220.645419] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:08 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, 0x0, 0x0, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 220.652933] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 220.665081] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 220.674793] ubi0: background thread "ubi_bgt0d" started, PID 12406 [ 220.684723] ubi: mtd0 is already attached to ubi0 [ 220.691702] ubi0: detaching mtd0 [ 220.709206] ubi0: mtd0 is detached [ 220.723259] ubi0: attaching mtd0 05:03:08 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x0, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:03:08 executing program 1: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 220.752999] ubi0: scanning is finished [ 220.881805] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 220.889474] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 220.896358] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 220.909697] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 220.916713] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 220.927444] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 220.934949] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 220.948381] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 220.959716] ubi0: background thread "ubi_bgt0d" started, PID 12426 [ 220.959981] ubi0: detaching mtd0 05:03:08 executing program 0: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) [ 220.980922] ubi0: mtd0 is detached [ 220.990716] ubi0: attaching mtd0 [ 221.025096] ubi0: scanning is finished [ 221.097367] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 221.104321] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 221.111989] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 221.119002] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 221.126476] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 221.133668] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:08 executing program 2: accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r3, 0xffffffffffffffff) [ 221.141600] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 221.152327] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 221.162400] ubi0: background thread "ubi_bgt0d" started, PID 12437 [ 221.162942] ubi: mtd0 is already attached to ubi0 [ 221.175128] ubi: mtd0 is already attached to ubi0 [ 221.184770] ubi0: detaching mtd0 05:03:08 executing program 5: pipe(&(0x7f0000000180)) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000100)=0x10, 0x1000) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) dup2(r3, 0xffffffffffffffff) 05:03:08 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup(0xffffffffffffffff) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f00000001c0)={0x0, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) 05:03:08 executing program 3: accept4$phonet_pipe(0xffffffffffffffff, 0x0, 0x0, 0x1000) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) [ 221.208169] ubi0: mtd0 is detached [ 221.212637] ubi0: attaching mtd0 [ 221.277636] ubi0: scanning is finished [ 221.393409] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 221.402938] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 221.410833] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 221.419316] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 221.426300] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 221.434137] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 05:03:08 executing program 1: pipe(&(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000cab000)=0xc) dup(0xffffffffffffffff) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = dup(0xffffffffffffffff) getsockname$packet(r2, 0x0, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000001c0)={0x7, &(0x7f0000000000)=[0x7ff, 0x0, 0xea, 0x2, 0x5, 0x681, 0xfff]}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000001c0)={0x3, [0x8000, 0x2, 0x5, 0x8, 0xb54c, 0x0, 0x101, 0x49a2, 0x8, 0xd7c, 0x7, 0x5, 0x6, 0x2, 0x8, 0x7ff, 0x0, 0x2, 0x1, 0x9, 0x17, 0x1e9, 0x0, 0x8, 0x7, 0x1f, 0x69f7, 0x8, 0x20, 0x5, 0x5, 0x1, 0x3, 0x3ff, 0x0, 0xff, 0x3, 0x4, 0x8001, 0x1000, 0x3, 0x9, 0x1, 0xff80, 0x6e, 0x0, 0x8927, 0x400]}) socket(0xa, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x200100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 221.442226] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3638624677 [ 221.453137] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 221.463522] ubi0: background thread "ubi_bgt0d" started, PID 12460 [ 221.463757] ubi0: detaching mtd0 [ 297.398167] NOHZ: local_softirq_pending 08 [ 299.317696] NOHZ: local_softirq_pending 08 [ 338.997837] NOHZ: local_softirq_pending 08 [ 399.798118] NOHZ: local_softirq_pending 08 [ 401.717721] NOHZ: local_softirq_pending 08 [ 402.361145] NOHZ: local_softirq_pending 08 [ 422.197710] NOHZ: local_softirq_pending 08 [ 427.958623] INFO: task syz-executor.0:12433 blocked for more than 140 seconds. [ 427.958633] Not tainted 4.14.184-syzkaller #0 [ 427.958637] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 427.958642] syz-executor.0 D29888 12433 6356 0x00000004 [ 427.958661] Call Trace: [ 427.958682] __schedule+0x8a6/0x1d70 [ 427.958696] ? firmware_map_remove+0x18f/0x18f [ 427.958705] ? trace_hardirqs_on+0x10/0x10 [ 427.958714] schedule+0x8d/0x1b0 [ 428.003518] schedule_timeout+0x86c/0xe50 [ 428.007738] ? vprintk_emit+0x3db/0x600 [ 428.011711] ? usleep_range+0x130/0x130 [ 428.015684] ? wait_for_common+0x26a/0x430 [ 428.019954] ? mark_held_locks+0xa6/0xf0 [ 428.024032] ? _raw_spin_unlock_irq+0x24/0x90 [ 428.028594] wait_for_common+0x272/0x430 [ 428.032649] ? try_to_wake_up+0x7ee/0x1110 [ 428.036879] ? out_of_line_wait_on_atomic_t+0x1a0/0x1a0 [ 428.042383] ? wake_up_q+0xe0/0xe0 [ 428.045924] kthread_stop+0xce/0x640 [ 428.049701] ubi_detach_mtd_dev+0x1e3/0x3cc [ 428.054018] ctrl_cdev_ioctl+0x14b/0x220 [ 428.058132] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.062726] ? selinux_file_ioctl+0x3f7/0x560 [ 428.067277] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.071864] do_vfs_ioctl+0x75a/0xfe0 [ 428.075652] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 428.081319] ? ioctl_preallocate+0x1a0/0x1a0 [ 428.085749] ? security_file_ioctl+0x76/0xb0 [ 428.090220] ? security_file_ioctl+0x83/0xb0 [ 428.094622] SyS_ioctl+0x7f/0xb0 [ 428.098018] ? do_vfs_ioctl+0xfe0/0xfe0 [ 428.102089] do_syscall_64+0x1d5/0x640 [ 428.105971] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 428.111190] RIP: 0033:0x45cb29 [ 428.114370] RSP: 002b:00007f280b2ccc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.122138] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 428.129467] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005 [ 428.136728] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 428.144044] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 428.151359] R13: 0000000000000214 R14: 00000000004c469e R15: 00007f280b2cd6d4 [ 428.158696] INFO: task syz-executor.0:12436 blocked for more than 140 seconds. [ 428.166047] Not tainted 4.14.184-syzkaller #0 [ 428.171117] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 428.179119] syz-executor.0 D29264 12436 6356 0x00000004 [ 428.184746] Call Trace: [ 428.187386] __schedule+0x8a6/0x1d70 [ 428.191104] ? firmware_map_remove+0x18f/0x18f [ 428.195671] ? lock_downgrade+0x6e0/0x6e0 [ 428.199853] schedule+0x8d/0x1b0 [ 428.203213] schedule_preempt_disabled+0xf/0x20 [ 428.207934] __mutex_lock+0x5f0/0x1430 [ 428.211827] ? lock_downgrade+0x6e0/0x6e0 [ 428.215960] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.221459] ? ctrl_cdev_ioctl+0x190/0x220 [ 428.225691] ? __mutex_unlock_slowpath+0x75/0x780 [ 428.230575] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.236020] ? __get_mtd_device+0x130/0x130 [ 428.240377] ? __might_fault+0x177/0x1b0 [ 428.244434] ? ctrl_cdev_ioctl+0x190/0x220 [ 428.248717] ctrl_cdev_ioctl+0x190/0x220 [ 428.252788] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.257405] ? do_vfs_ioctl+0x6fb/0xfe0 [ 428.261387] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.265947] do_vfs_ioctl+0x75a/0xfe0 [ 428.269825] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 428.274764] ? ioctl_preallocate+0x1a0/0x1a0 [ 428.279452] ? check_preemption_disabled+0x35/0x240 [ 428.284467] ? retint_kernel+0x2d/0x2d [ 428.288402] ? do_vfs_ioctl+0xfe0/0xfe0 [ 428.292391] ? security_file_ioctl+0x83/0xb0 [ 428.296777] SyS_ioctl+0x7f/0xb0 [ 428.300195] ? do_vfs_ioctl+0xfe0/0xfe0 [ 428.304178] do_syscall_64+0x1d5/0x640 [ 428.308126] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 428.313339] RIP: 0033:0x45cb29 [ 428.316524] RSP: 002b:00007f280b2abc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.324287] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 428.331602] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007 [ 428.338906] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 428.346180] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 428.353480] R13: 0000000000000214 R14: 00000000004c469e R15: 00007f280b2ac6d4 [ 428.360844] INFO: task syz-executor.4:12445 blocked for more than 140 seconds. [ 428.368438] Not tainted 4.14.184-syzkaller #0 [ 428.373458] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 428.381449] syz-executor.4 D30080 12445 6357 0x00000004 [ 428.387140] Call Trace: [ 428.389731] __schedule+0x8a6/0x1d70 [ 428.393442] ? firmware_map_remove+0x18f/0x18f [ 428.398067] ? lock_downgrade+0x6e0/0x6e0 [ 428.402213] schedule+0x8d/0x1b0 [ 428.405556] schedule_preempt_disabled+0xf/0x20 [ 428.410287] __mutex_lock+0x5f0/0x1430 [ 428.414166] ? ctrl_cdev_ioctl+0x142/0x220 [ 428.418432] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.423962] ? __might_fault+0x104/0x1b0 [ 428.428093] ? lock_acquire+0x170/0x3f0 [ 428.432066] ? ctrl_cdev_ioctl+0x142/0x220 [ 428.436311] ctrl_cdev_ioctl+0x142/0x220 [ 428.440460] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.445040] ? selinux_file_ioctl+0x3f7/0x560 [ 428.449580] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.454171] do_vfs_ioctl+0x75a/0xfe0 [ 428.458020] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 428.463656] ? ioctl_preallocate+0x1a0/0x1a0 [ 428.468128] ? security_file_ioctl+0x76/0xb0 [ 428.472527] ? security_file_ioctl+0x83/0xb0 [ 428.476921] SyS_ioctl+0x7f/0xb0 [ 428.480317] ? do_vfs_ioctl+0xfe0/0xfe0 [ 428.484285] do_syscall_64+0x1d5/0x640 [ 428.488217] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 428.493397] RIP: 0033:0x45cb29 [ 428.496561] RSP: 002b:00007f2679e50c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.504307] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 428.511624] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003 [ 428.518926] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 428.526190] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 428.534206] R13: 0000000000000214 R14: 00000000004c469e R15: 00007f2679e516d4 [ 428.541550] INFO: task syz-executor.3:12448 blocked for more than 140 seconds. [ 428.549088] Not tainted 4.14.184-syzkaller #0 [ 428.554107] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 428.562107] syz-executor.3 D30080 12448 6360 0x00000004 [ 428.567797] Call Trace: [ 428.570388] __schedule+0x8a6/0x1d70 [ 428.574091] ? firmware_map_remove+0x18f/0x18f [ 428.578719] ? lock_downgrade+0x6e0/0x6e0 [ 428.582875] schedule+0x8d/0x1b0 [ 428.586232] schedule_preempt_disabled+0xf/0x20 [ 428.590967] __mutex_lock+0x5f0/0x1430 [ 428.594870] ? lock_downgrade+0x6e0/0x6e0 [ 428.599101] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.604550] ? ctrl_cdev_ioctl+0x190/0x220 [ 428.608849] ? __mutex_unlock_slowpath+0x75/0x780 [ 428.613697] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.619183] ? __get_mtd_device+0x130/0x130 [ 428.623501] ? __might_fault+0x177/0x1b0 [ 428.627618] ? ctrl_cdev_ioctl+0x190/0x220 [ 428.631852] ctrl_cdev_ioctl+0x190/0x220 [ 428.635898] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.640510] ? selinux_file_ioctl+0x3f7/0x560 [ 428.645172] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.649828] do_vfs_ioctl+0x75a/0xfe0 [ 428.653651] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 428.659331] ? ioctl_preallocate+0x1a0/0x1a0 [ 428.663736] ? security_file_ioctl+0x76/0xb0 [ 428.668182] ? security_file_ioctl+0x83/0xb0 [ 428.672580] SyS_ioctl+0x7f/0xb0 [ 428.676054] ? do_vfs_ioctl+0xfe0/0xfe0 [ 428.680126] do_syscall_64+0x1d5/0x640 [ 428.684014] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 428.689251] RIP: 0033:0x45cb29 [ 428.692431] RSP: 002b:00007fdfa1658c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.701155] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 428.708481] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000003 [ 428.715755] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 428.723074] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 428.730432] R13: 0000000000000214 R14: 00000000004c469e R15: 00007fdfa16596d4 [ 428.737782] INFO: task syz-executor.2:12450 blocked for more than 140 seconds. [ 428.745133] Not tainted 4.14.184-syzkaller #0 [ 428.750205] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 428.758377] syz-executor.2 D30080 12450 6361 0x00000004 [ 428.763994] Call Trace: [ 428.766576] __schedule+0x8a6/0x1d70 [ 428.770353] ? firmware_map_remove+0x18f/0x18f [ 428.774932] ? lock_downgrade+0x6e0/0x6e0 [ 428.779122] schedule+0x8d/0x1b0 [ 428.782498] schedule_preempt_disabled+0xf/0x20 [ 428.787231] __mutex_lock+0x5f0/0x1430 [ 428.791118] ? ctrl_cdev_ioctl+0x142/0x220 [ 428.795343] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.800842] ? __might_fault+0x104/0x1b0 [ 428.804916] ? lock_acquire+0x170/0x3f0 [ 428.808940] ? ctrl_cdev_ioctl+0x142/0x220 [ 428.813181] ctrl_cdev_ioctl+0x142/0x220 [ 428.817290] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.821887] ? selinux_file_ioctl+0x3f7/0x560 [ 428.826360] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 428.830989] do_vfs_ioctl+0x75a/0xfe0 [ 428.834799] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 428.840493] ? ioctl_preallocate+0x1a0/0x1a0 [ 428.844925] ? security_file_ioctl+0x76/0xb0 [ 428.849390] ? security_file_ioctl+0x83/0xb0 [ 428.853790] SyS_ioctl+0x7f/0xb0 [ 428.857205] ? do_vfs_ioctl+0xfe0/0xfe0 [ 428.861177] do_syscall_64+0x1d5/0x640 [ 428.865059] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 428.870294] RIP: 0033:0x45cb29 [ 428.873474] RSP: 002b:00007fbf0b361c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.881222] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 428.888545] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003 [ 428.895803] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 428.903108] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 428.910428] R13: 0000000000000214 R14: 00000000004c469e R15: 00007fbf0b3626d4 [ 428.917808] INFO: task syz-executor.2:12457 blocked for more than 140 seconds. [ 428.925158] Not tainted 4.14.184-syzkaller #0 [ 428.930214] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 428.938214] syz-executor.2 D28528 12457 6361 0x00000004 [ 428.943858] Call Trace: [ 428.946446] __schedule+0x8a6/0x1d70 [ 428.950216] ? firmware_map_remove+0x18f/0x18f [ 428.954792] ? lock_downgrade+0x6e0/0x6e0 [ 428.958973] schedule+0x8d/0x1b0 [ 428.962334] schedule_preempt_disabled+0xf/0x20 [ 428.966983] __mutex_lock+0x5f0/0x1430 [ 428.970922] ? lock_downgrade+0x6e0/0x6e0 [ 428.975064] ? ctrl_cdev_ioctl+0x190/0x220 [ 428.979330] ? __mutex_unlock_slowpath+0x75/0x780 [ 428.984180] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 428.989697] ? __get_mtd_device+0x130/0x130 [ 428.994031] ? __might_fault+0x177/0x1b0 [ 428.998164] ? ctrl_cdev_ioctl+0x190/0x220 [ 429.002392] ctrl_cdev_ioctl+0x190/0x220 [ 429.006429] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.011074] ? selinux_file_ioctl+0x3f7/0x560 [ 429.015562] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.020189] do_vfs_ioctl+0x75a/0xfe0 [ 429.023997] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 429.029683] ? ioctl_preallocate+0x1a0/0x1a0 [ 429.034099] ? security_file_ioctl+0x76/0xb0 [ 429.038573] ? security_file_ioctl+0x83/0xb0 [ 429.042992] SyS_ioctl+0x7f/0xb0 [ 429.046348] ? do_vfs_ioctl+0xfe0/0xfe0 [ 429.050389] do_syscall_64+0x1d5/0x640 [ 429.054277] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 429.059533] RIP: 0033:0x45cb29 [ 429.062733] RSP: 002b:00007fbf0b340c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.070498] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 429.078245] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000005 [ 429.085515] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 429.092835] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 429.100153] R13: 0000000000000214 R14: 00000000004c469e R15: 00007fbf0b3416d4 [ 429.107524] INFO: task syz-executor.5:12449 blocked for more than 140 seconds. [ 429.114887] Not tainted 4.14.184-syzkaller #0 [ 429.119940] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 429.127998] syz-executor.5 D29888 12449 6359 0x00000004 [ 429.133652] Call Trace: [ 429.136226] __schedule+0x8a6/0x1d70 [ 429.139987] ? firmware_map_remove+0x18f/0x18f [ 429.144580] ? lock_downgrade+0x6e0/0x6e0 [ 429.148798] schedule+0x8d/0x1b0 [ 429.152158] schedule_preempt_disabled+0xf/0x20 [ 429.156822] __mutex_lock+0x5f0/0x1430 [ 429.160793] ? ctrl_cdev_ioctl+0x142/0x220 [ 429.165024] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 429.170533] ? __might_fault+0x104/0x1b0 [ 429.174586] ? lock_acquire+0x170/0x3f0 [ 429.178623] ? ctrl_cdev_ioctl+0x142/0x220 [ 429.182850] ctrl_cdev_ioctl+0x142/0x220 [ 429.186891] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.191539] ? selinux_file_ioctl+0x3f7/0x560 [ 429.196030] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.200664] do_vfs_ioctl+0x75a/0xfe0 [ 429.204476] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 429.210157] ? ioctl_preallocate+0x1a0/0x1a0 [ 429.214560] ? security_file_ioctl+0x76/0xb0 [ 429.219032] ? security_file_ioctl+0x83/0xb0 [ 429.223436] SyS_ioctl+0x7f/0xb0 [ 429.226800] ? do_vfs_ioctl+0xfe0/0xfe0 [ 429.230831] do_syscall_64+0x1d5/0x640 [ 429.235676] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 429.240925] RIP: 0033:0x45cb29 [ 429.244109] RSP: 002b:00007fca3e5bbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.251960] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 429.259334] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005 [ 429.266591] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 429.273920] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 429.281269] R13: 0000000000000214 R14: 00000000004c469e R15: 00007fca3e5bc6d4 [ 429.288642] INFO: task syz-executor.5:12456 blocked for more than 140 seconds. [ 429.295999] Not tainted 4.14.184-syzkaller #0 [ 429.301055] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 429.309088] syz-executor.5 D29248 12456 6359 0x00000004 [ 429.314722] Call Trace: [ 429.317431] __schedule+0x8a6/0x1d70 [ 429.321145] ? firmware_map_remove+0x18f/0x18f [ 429.325706] ? lock_downgrade+0x6e0/0x6e0 [ 429.329929] schedule+0x8d/0x1b0 [ 429.333288] schedule_preempt_disabled+0xf/0x20 [ 429.337999] __mutex_lock+0x5f0/0x1430 [ 429.341903] ? lock_downgrade+0x6e0/0x6e0 [ 429.346044] ? ctrl_cdev_ioctl+0x190/0x220 [ 429.350353] ? __mutex_unlock_slowpath+0x75/0x780 [ 429.355202] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 429.360710] ? __get_mtd_device+0x130/0x130 [ 429.365031] ? __might_fault+0x177/0x1b0 [ 429.369158] ? ctrl_cdev_ioctl+0x190/0x220 [ 429.373385] ctrl_cdev_ioctl+0x190/0x220 [ 429.377480] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.382076] ? do_vfs_ioctl+0x6fb/0xfe0 [ 429.386030] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.390709] do_vfs_ioctl+0x75a/0xfe0 [ 429.394518] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 429.400193] ? ioctl_preallocate+0x1a0/0x1a0 [ 429.404603] ? security_file_ioctl+0x76/0xb0 [ 429.409075] ? security_file_ioctl+0x83/0xb0 [ 429.413476] SyS_ioctl+0x7f/0xb0 [ 429.416820] ? do_vfs_ioctl+0xfe0/0xfe0 [ 429.420845] do_syscall_64+0x1d5/0x640 [ 429.424767] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 429.430047] RIP: 0033:0x45cb29 [ 429.433230] RSP: 002b:00007fca3e59ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.441045] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 429.448393] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007 [ 429.455669] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 429.462979] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 429.470314] R13: 0000000000000214 R14: 00000000004c469e R15: 00007fca3e59b6d4 [ 429.477735] INFO: task syz-executor.1:12464 blocked for more than 140 seconds. [ 429.485101] Not tainted 4.14.184-syzkaller #0 [ 429.490174] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 429.498183] syz-executor.1 D29504 12464 6358 0x00000004 [ 429.503811] Call Trace: [ 429.506396] __schedule+0x8a6/0x1d70 [ 429.510179] ? firmware_map_remove+0x18f/0x18f [ 429.514756] ? lock_downgrade+0x6e0/0x6e0 [ 429.518975] schedule+0x8d/0x1b0 [ 429.522336] schedule_preempt_disabled+0xf/0x20 [ 429.526999] __mutex_lock+0x5f0/0x1430 [ 429.530952] ? ctrl_cdev_ioctl+0x142/0x220 [ 429.535182] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 429.540670] ? __might_fault+0x104/0x1b0 [ 429.544728] ? lock_acquire+0x170/0x3f0 [ 429.548785] ? ctrl_cdev_ioctl+0x142/0x220 [ 429.553008] ctrl_cdev_ioctl+0x142/0x220 [ 429.557139] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.561736] ? selinux_file_ioctl+0x3f7/0x560 [ 429.566211] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.570881] do_vfs_ioctl+0x75a/0xfe0 [ 429.574677] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 429.580366] ? ioctl_preallocate+0x1a0/0x1a0 [ 429.584778] ? security_file_ioctl+0x76/0xb0 [ 429.589238] ? security_file_ioctl+0x83/0xb0 [ 429.593652] SyS_ioctl+0x7f/0xb0 [ 429.597010] ? do_vfs_ioctl+0xfe0/0xfe0 [ 429.601043] do_syscall_64+0x1d5/0x640 [ 429.604930] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 429.610185] RIP: 0033:0x45cb29 [ 429.613362] RSP: 002b:00007f79fe6c8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.621119] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 429.628459] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005 [ 429.635721] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 429.643030] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 429.650373] R13: 0000000000000214 R14: 00000000004c469e R15: 00007f79fe6c96d4 [ 429.657732] INFO: task syz-executor.1:12467 blocked for more than 140 seconds. [ 429.665084] Not tainted 4.14.184-syzkaller #0 [ 429.670156] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 429.678174] syz-executor.1 D29296 12467 6358 0x00000004 [ 429.683795] Call Trace: [ 429.686366] __schedule+0x8a6/0x1d70 [ 429.690136] ? firmware_map_remove+0x18f/0x18f [ 429.694712] ? lock_downgrade+0x6e0/0x6e0 [ 429.698907] schedule+0x8d/0x1b0 [ 429.702289] schedule_preempt_disabled+0xf/0x20 [ 429.706948] __mutex_lock+0x5f0/0x1430 [ 429.710909] ? lock_downgrade+0x6e0/0x6e0 [ 429.715054] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 429.720606] ? ctrl_cdev_ioctl+0x190/0x220 [ 429.724839] ? __mutex_unlock_slowpath+0x75/0x780 [ 429.729764] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 429.735233] ? __get_mtd_device+0x130/0x130 [ 429.739599] ? __might_fault+0x177/0x1b0 [ 429.743663] ? ctrl_cdev_ioctl+0x190/0x220 [ 429.747964] ctrl_cdev_ioctl+0x190/0x220 [ 429.752028] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.756595] ? selinux_file_ioctl+0x3f7/0x560 [ 429.761142] ? ubi_cdev_compat_ioctl+0x30/0x30 [ 429.765721] do_vfs_ioctl+0x75a/0xfe0 [ 429.769594] ? selinux_parse_skb.constprop.0+0x16c0/0x16c0 [ 429.775211] ? ioctl_preallocate+0x1a0/0x1a0 [ 429.779689] ? security_file_ioctl+0x76/0xb0 [ 429.784092] ? security_file_ioctl+0x83/0xb0 [ 429.788556] SyS_ioctl+0x7f/0xb0 [ 429.791936] ? do_vfs_ioctl+0xfe0/0xfe0 [ 429.795900] do_syscall_64+0x1d5/0x640 [ 429.799837] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 429.805024] RIP: 0033:0x45cb29 [ 429.808275] RSP: 002b:00007f79fe6a7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.815985] RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29 [ 429.823300] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007 [ 429.830637] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 429.837965] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 429.845240] R13: 0000000000000214 R14: 00000000004c469e R15: 00007f79fe6a86d4 [ 429.852604] [ 429.852604] Showing all locks held in the system: [ 429.858998] 1 lock held by khungtaskd/1057: [ 429.863378] #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a [ 429.872490] 1 lock held by syz-executor.0/12433: [ 429.877457] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 429.886494] 1 lock held by syz-executor.0/12436: [ 429.891313] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 429.900445] 1 lock held by syz-executor.4/12445: [ 429.905183] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 429.914305] 1 lock held by syz-executor.3/12448: [ 429.919099] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 429.928231] 1 lock held by syz-executor.2/12450: [ 429.932974] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 429.942073] 1 lock held by syz-executor.2/12457: [ 429.946821] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 429.955924] 1 lock held by syz-executor.5/12449: [ 429.960728] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 429.969844] 1 lock held by syz-executor.5/12456: [ 429.974585] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 429.984636] 1 lock held by syz-executor.1/12464: [ 429.989450] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 429.998531] 1 lock held by syz-executor.1/12467: [ 430.003274] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 430.012374] [ 430.013995] ============================================= [ 430.013995] [ 430.021058] NMI backtrace for cpu 0 [ 430.024696] CPU: 0 PID: 1057 Comm: khungtaskd Not tainted 4.14.184-syzkaller #0 [ 430.032118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 430.041452] Call Trace: [ 430.044032] dump_stack+0x1b2/0x283 [ 430.047655] nmi_cpu_backtrace.cold+0x57/0x93 [ 430.052140] ? irq_force_complete_move.cold+0x7b/0x7b [ 430.057321] nmi_trigger_cpumask_backtrace+0x13a/0x17f [ 430.062581] watchdog+0x5e2/0xb80 [ 430.066017] ? hungtask_pm_notify+0x50/0x50 [ 430.070332] kthread+0x30d/0x420 [ 430.073690] ? kthread_create_on_node+0xd0/0xd0 [ 430.078357] ret_from_fork+0x24/0x30 [ 430.082241] Sending NMI from CPU 0 to CPUs 1: [ 430.087127] NMI backtrace for cpu 1 [ 430.087132] CPU: 1 PID: 3629 Comm: systemd-journal Not tainted 4.14.184-syzkaller #0 [ 430.087136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 430.087139] task: ffff888094660480 task.stack: ffff888094668000 [ 430.087141] RIP: 0010:unwind_next_frame+0x299/0x1700 [ 430.087144] RSP: 0018:ffff88809466f9f8 EFLAGS: 00000246 [ 430.087149] RAX: 0000000000000015 RBX: 1ffff110128cdf46 RCX: ffffffff88c91a94 [ 430.087153] RDX: 0000000000000000 RSI: ffffffff88c91a94 RDI: ffffffff887d0d18 [ 430.087157] RBP: 0000000000000001 R08: ffffffff88c91a98 R09: ffffffff88c91a94 [ 430.087160] R10: 000000000000a5c2 R11: 0000000000056071 R12: ffff88809466fb75 [ 430.087163] R13: ffff88809466fb78 R14: ffff88809466fb90 R15: ffff88809466fb40 [ 430.087167] FS: 00007fc93cb958c0(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000 [ 430.087170] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 430.087173] CR2: 00007fc939fea000 CR3: 00000000945e4000 CR4: 00000000001406e0 [ 430.087176] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 430.087180] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 430.087182] Call Trace: [ 430.087184] ? kernel_poison_pages+0x1b/0x250 [ 430.087187] ? deref_stack_reg+0xc0/0xc0 [ 430.087189] ? get_page_from_freelist+0xbce/0x24f0 [ 430.087192] __unwind_start+0x532/0x8c0 [ 430.087194] ? unwind_next_frame+0x1700/0x1700 [ 430.087197] __save_stack_trace+0x4a/0xd0 [ 430.087199] ? __unwind_start+0x5af/0x8c0 [ 430.087202] kasan_kmalloc.part.0+0x4f/0xd0 [ 430.087204] ? seccomp_run_filters+0x151/0x540 [ 430.087206] ? __put_cred+0x1a1/0x210 [ 430.087209] ? SyS_faccessat+0x52a/0x680 [ 430.087211] ? do_syscall_64+0x1d5/0x640 [ 430.087214] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 430.087217] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 430.087219] ? trace_hardirqs_on+0x10/0x10 [ 430.087222] ? cache_alloc_refill+0x310/0x360 [ 430.087224] ? lock_downgrade+0x6e0/0x6e0 [ 430.087227] ? do_raw_spin_unlock+0x164/0x250 [ 430.087229] ? kasan_unpoison_shadow+0x30/0x40 [ 430.087231] ? kasan_kmalloc+0x76/0xc0 [ 430.087234] kmem_cache_alloc+0x111/0x3c0 [ 430.087236] getname_flags+0xc8/0x550 [ 430.087238] SyS_mkdirat+0x83/0x220 [ 430.087241] ? SyS_mknod+0x30/0x30 [ 430.087243] ? do_syscall_64+0x4c/0x640 [ 430.087245] ? SyS_mkdirat+0x220/0x220 [ 430.087248] do_syscall_64+0x1d5/0x640 [ 430.087251] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 430.087253] RIP: 0033:0x7fc93be51687 [ 430.087255] RSP: 002b:00007ffc4e9303e8 EFLAGS: 00000293 ORIG_RAX: 0000000000000053 [ 430.087261] RAX: ffffffffffffffda RBX: 00007ffc4e933450 RCX: 00007fc93be51687 [ 430.087265] RDX: 0000000000000000 RSI: 00000000000001ed RDI: 000056127c5268c0 [ 430.087268] RBP: 00007ffc4e930420 R08: 000056127c4ed3e5 R09: 0000000000000018 [ 430.087271] R10: 0000000000000069 R11: 0000000000000293 R12: 0000000000000000 [ 430.087275] R13: 0000000000000001 R14: 000056127c5268c0 R15: 00007ffc4e930a60 [ 430.087276] Code: 48 b8 00 00 00 00 00 fc ff df 4c 89 c2 48 c1 ea 03 0f b6 04 02 4c 89 c2 83 e2 07 38 d0 7f 08 84 c0 0f 85 44 0e 00 00 0f b6 41 04 0f 0f 84 f2 01 00 00 49 8b 77 48 4c 89 c2 48 c1 ea 03 48 89 [ 430.087806] Kernel panic - not syncing: hung_task: blocked tasks [ 430.390529] CPU: 0 PID: 1057 Comm: khungtaskd Not tainted 4.14.184-syzkaller #0 [ 430.397958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 430.407321] Call Trace: [ 430.409913] dump_stack+0x1b2/0x283 [ 430.413528] panic+0x1f9/0x42d [ 430.416709] ? add_taint.cold+0x16/0x16 [ 430.420660] ? irq_force_complete_move.cold+0x7b/0x7b [ 430.425850] watchdog+0x5f3/0xb80 [ 430.429292] ? hungtask_pm_notify+0x50/0x50 [ 430.433626] kthread+0x30d/0x420 [ 430.436967] ? kthread_create_on_node+0xd0/0xd0 [ 430.441616] ret_from_fork+0x24/0x30 [ 430.446608] Kernel Offset: disabled [ 430.450251] Rebooting in 86400 seconds..