, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$BLKSECDISCARD(r4, 0x127d, &(0x7f00000001c0)=0xffffffff) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:54 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[], 0x0) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:08:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000180)=@llc, &(0x7f0000000080)=0x80, 0x80800) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r2, 0x50, &(0x7f0000000200)}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000002c0)={0xffffffffffffffff}, 0x0, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r3, 0x3, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e20, @local}}}, 0x118) accept4$bt_l2cap(r1, 0x0, &(0x7f0000000040)=0xa8, 0x80800) 19:08:54 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:08:55 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x3f000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:08:57 executing program 4: syz_emit_ethernet(0x0, &(0x7f00000001c0)=ANY=[], 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x2040, 0x0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000100)='veth0_to_bridge\x00') setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000440)=0x8, 0x4) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0x1f) ptrace(0x8, r2) syz_open_dev$media(&(0x7f0000000180)='/dev/media#\x00', 0x7, 0x210000) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000380)=[&(0x7f00000001c0)='\x00', &(0x7f0000000200)='/dev/btrfs-control\x00', &(0x7f0000000240)='wlan0:%ppp0:\'security\x00', &(0x7f0000000280)='\x00', &(0x7f00000002c0)='/dev/btrfs-control\x00', &(0x7f0000000300)='...@\x00', &(0x7f0000000340)='veth0_to_bridge\x00'], &(0x7f0000000400)=[&(0x7f00000003c0)='/dev/btrfs-control\x00']) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000480)={{0x3, 0x1, 0x80, 0x2, 0x8001}, 0x7fffffff, 0x7f, 0x7}) wait4(0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r3, 0x80046402, &(0x7f0000000140)=0x5ea81429) 19:08:57 executing program 0: openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000880)=""/220) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xfffffffffffffeff}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000140)={r4, 0x48, 0x30, 0x20, 0x81}, &(0x7f00000001c0)=0x18) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:57 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") r1 = syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x5, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585605, &(0x7f0000000200)) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00'], 0x2) close(r2) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:08:57 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r4, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r3, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r5, 0x0, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r6, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r5, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r7, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r8 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:08:57 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x64000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:08:57 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x100, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, 0x0}, &(0x7f00000005c0)=0x14) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000600)={@remote, @multicast1, r2}, 0xc) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r3, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) ioctl$KVM_DEASSIGN_PCI_DEVICE(r1, 0x4040ae72, &(0x7f0000000100)={0x400, 0x2ea73433, 0xbd12}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000040)={0x100, 0x3, 0x6e88a1c2, 0x4, 0x101}) fcntl$setstatus(r4, 0x4, 0x4000) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1200e) 19:08:57 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:57 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x298101, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x4, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x5c}, @dev}}}}}}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket$netlink(0x10, 0x3, 0x1f) ptrace(0x10, r1) setrlimit(0xf, &(0x7f0000000080)={0x8, 0xc5c}) wait4(0x0, 0x0, 0x0, 0x0) 19:08:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="27ca80bf026aa6e7f78067370000000014d81a3d7a70f351c19d7dba5d8aa15cb45c934e82868a10a1388162074366b9e2002f3346d86478aa69552fc3e7f6345cdb6aa3ff9b06aab94ee7c6226a7683979fbb23906b539c4b6f767df358a2cabb2082467b7d816e6eb1c41c51ba308143f4ade643aa6c6110e69dc991a7cb54ee3d7227e0c3350220a592448daa1e"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) sched_yield() r1 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) r2 = dup(r1) ioctl$KVM_GET_FPU(r2, 0x81a0ae8c, &(0x7f0000000180)) 19:08:57 executing program 4: syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x4, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x5c}, @dev}}}}}}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = socket$netlink(0x10, 0x3, 0x1f) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x4000, 0x0) bind$bt_l2cap(r2, &(0x7f0000000200)={0x1f, 0x100000000, {0x1, 0x0, 0x2c9, 0x1, 0x22f, 0x4}, 0x0, 0x3ff}, 0xe) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000240), &(0x7f0000000280)=0xc) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000080)={0xb, 'syz1\x00', 'syz1\x00', 'syz1\x00', 0x1, 0x9, 0x819, 0xfff, 0x10001, 0x5, 'T'}, 0x119) ptrace(0x10, r0) ptrace$peekuser(0x3, r0, 0x0) wait4(r0, 0x0, 0x7ffffffd, 0x0) 19:08:57 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r7, @ANYRESHEX=r0, @ANYRES32=r4], 0x1c) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:08:58 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1200e) 19:08:58 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0xce020000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:08:58 executing program 5: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:58 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) exit_group(0x410a0681) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:08:58 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000040)=0x6) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x0, 0x2) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:58 executing program 5: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:08:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="68d996fc17ff7066e974289d6851c8d47f18e4080ca804506a6a576f71097d4003e1f9b38760cebb3d7e901c902e5879d0362eae3feabc68657b426dc75a1b0c9e8474b2dedf04b5685882f8388ca689cc0b18772c967d60dd1fa2"], 0x5b) close(r0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000080)=0x54) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000200)='ip6_vti0\x00', 0x10) setsockopt$inet_mtu(r3, 0x0, 0xa, 0x0, 0x0) sendto$inet(r3, &(0x7f0000d7cfcb), 0xfffffffffffffd8b, 0x0, 0x0, 0x0) shutdown(r3, 0x1) sched_setscheduler(0x0, 0x0, 0x0) accept$unix(r2, 0x0, &(0x7f00000000c0)) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000280)=0x0) ptrace$setregset(0x4205, r4, 0x202, &(0x7f00000002c0)={&(0x7f0000000380)="0d23568b49de7424d5cf3731ed99ebd124a97940c9fcd38068b94a18277e1c0e60227c6076a0b2ef591aca95838a834232122a1edcecb551dc4477090d6cac1e504c5301387ba68b983401dd79db6118f9c946df0a0790b26de8fda6530ea498f616eea38885cbc91993db82e48a2233fb033ff73e4c43f14d2c6f7a2c03aaa7c574a5f7240769bfde4190a49efadf8724260275", 0x94}) socket$can_raw(0x1d, 0x3, 0x1) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100)=0xfffffffffffffdba, 0x80800) 19:08:58 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r7, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT], 0xfec0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:08:59 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x2c0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x40000, 0x0) connect$l2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x1, 0x1, 0x4, {0xa, 0x4e20, 0x5, @empty, 0x8}}}, 0x32) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000300)={0x0, 0x20000000000}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f0000000400), &(0x7f0000000580)=0x4) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f00000003c0)={r4, 0x2}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) r5 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$RTC_WIE_ON(r3, 0x700f) ioctl$sock_inet_SIOCDELRT(r5, 0x890c, &(0x7f0000000100)={0x0, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e24, @empty}, 0x70, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='irlan0\x00', 0x8, 0xc16b, 0x9}) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:00 executing program 4: syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800440000300000000000009078ac1414bbac1414000306907800000000450000000000000000000000ac5c14aaac141400f231d765c2b29e8521b4f06bc67ff2078b281f6b5ce68e174a7b561eeec7e17f2bf8e7e4f1b579b1695ca50f6e65b8b5e46d895dff08e002b60fbb1ac6c52077e6bc0076055bb0ea604ee2c7b12ece9444d98016fd0deef2c3a83f3581d262f9bd88a3542482d1ba1dbf0b37aeba772670978b62b64b320bd7f0ddc97d65582a6a950550adca0a3750c10916e3b187b56673ad5131123a40cd9ed6114dfa576e01a12fd0df70457b8fa4752631822c069c7036c8cf86cd053ae59b68afa14a6e648b4b12d9243b130a"], 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket$netlink(0x10, 0x3, 0x1f) ptrace(0x10, r0) wait4(0x0, 0x0, 0x0, 0x0) 19:09:00 executing program 0: openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@rc, &(0x7f0000000100)=0x80, 0x80000) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000140)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:00 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x800000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:00 executing program 5: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x5, 0x440000) connect$bt_sco(r1, &(0x7f0000000180)={0x1f, {0x0, 0x0, 0x2, 0x2a5, 0x9, 0x1fa}}, 0x8) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x8041, 0x0) ioctl$KDADDIO(r2, 0x4b34, 0x1) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:00 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r5, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r7, @ANYRESHEX=r0, @ANYRESOCT=r6], 0x2f) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:01 executing program 4: r0 = syz_open_pts(0xffffffffffffffff, 0x0) fcntl$lock(r0, 0x400000009, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x100fffffe}) read(r0, &(0x7f0000000380)=""/67, 0x5c78f728127772f2) flock(r0, 0x2) mknod(&(0x7f0000000000)='./file0\x00', 0x8007, 0x16eb) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r1, 0x0) flock(r0, 0x2) flock(r0, 0x2) msgrcv(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="7cfe030000000000000000000000000000594a0500ad005d82286686c17c2b5062c3f3563d553347e15490de88b02609ec7019fc"], 0x1, 0x0, 0x0) 19:09:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x40, 0x80) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000640)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000007c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800400}, 0xc, &(0x7f0000000780)={&(0x7f0000000680)={0xd4, r1, 0x8, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1ff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x35}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x1c}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7d}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x6c}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000001}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x41}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xff}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3f}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x2}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x400c000}, 0x8000) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r2, &(0x7f0000000540)=ANY=[@ANYBLOB="ffff00000ddf022aee93bcf2ff633f08ffa5b749ac9c840394e44aba215d33da0000a76ab939bae28769f13f5b01dd526d403c5ce6b005d6205197812729807dc4db2a96422ad8512be4945c9a59853628f661189838079b88f2fb485cc4b8fc25431690ebb93b147a9627b6b88602928543ed3f5471edefb789723272fcc845d330028e8a312f9e0ed47e850d6d8eb1fcdc6b"], 0x2) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r2, 0x50, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)=r3, 0x4) close(0xffffffffffffffff) r4 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r5 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r4, 0x6) connect$inet(r5, &(0x7f0000000180)={0x2, 0x8000000000004e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = accept(r4, 0x0, 0x0) close(r6) recvfrom(r5, 0x0, 0x0, 0x40000042, 0x0, 0x0) r7 = getpid() migrate_pages(r7, 0xffffffffffffffff, &(0x7f00000004c0)=0x9, &(0x7f0000000500)=0x9) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000840)='/dev/vga_arbiter\x00', 0x80800, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r8, 0x40bc5311, &(0x7f0000000180)={0x7, 0x2, 'client1\x00', 0x1, "c0af23f917e399a3", "b0c7393f9fcb7618ace6172fe2b1bc9551a40dcabdaf94988d8eb1d2a39674f8", 0x97}) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) getsockopt$inet6_IPV6_IPSEC_POLICY(r8, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@ipv4={[], [], @multicast2}, @in=@local}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f00000000c0)=0xe8) 19:09:01 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4, 0x9) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000040)=r2) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r3, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$notify(r4, 0x402, 0x80000008) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r5, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:01 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:01 executing program 4: unshare(0x10000) mknod$loop(0x0, 0x0, 0xffffffffffffffff) r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) r2 = socket(0x10, 0x0, 0xc) futex(&(0x7f00000001c0)=0x2, 0x8b, 0x0, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f0000000280)=0x2, 0x1) r3 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) write(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) eventfd(0x800000d317) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000080)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r0, 0x0, 0x2, &(0x7f00000000c0)='&\x00', 0xffffffffffffffff}, 0x30) kcmp$KCMP_EPOLL_TFD(r4, r5, 0x7, r3, &(0x7f0000000140)={r1, r2, 0x4}) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000180)={0x8000, 0x100, 0x9, 0x9, 0x1f, 0x1f, 0x400, 0xffff, 0x7, 0x6, 0x4, 0x1000}) getitimer(0x0, 0x0) fanotify_init(0x0, 0x40000) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 19:09:01 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000780)='./cgroup\x00\f\xff\x88\x7f\'Y#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xeaG\'r\xf2\xb7\x84\xbc\xa2\xcda\xd5\xee\x91\xfa\xc6\xdeyjH\x01~\x98\xdf\xa5S\xbf|T\"\xab\xefT\x1d\xd7\xe0D\xbca\x8b\xcd\x92\xcfMU\xaa>\xea\xfc\xf3\xf9\xc4\x90Fw0f\xcc\x82\x8f\xdb\x1f&E.Z\xf6\xee\x85\xa1\xdfMDA\xee`P\xfc\xc4\t\x1e\x18\x90d\x02n\x05h\x1d\xebB\xcaV\xdb\x050q\xfc\xec=\xe0]\xe0\xc5M?qt\x93\'5\xc8\xdf!\xe1\xc4\x14>\xb5\x9b\xc6\xb7\x94\xe8\xf9np\xf0s\xe1\xc0\xcb\xb4\x80\xa1\xf6 p\xe6v\xc5gu\xa9\x91\xfd\x13\xaa\xf4\xcdgRg\xc6|\f\xf6+i4\x81,\x84\x13%V\xff}\x0e\xab:\x1f\xbc\xae\xd4u\xca\x8c\xebd\xfa\xffO\xe7\xbd\xb5\x01\x00\xf0\xfbA\xed\x0fH\xca[\xb1\xb9\x9f\x96\b\xa9\x7f\t\x19\xc0\xeb\xec\xac\x13\x7fG R9JrT\xb3\xd8\xdc\x93\x82\xe7\xdb\x87\xaa<\xd3E\xc9\xdb/6jW\xc4\x1e\x0f\xf2\v\xff.\xedS\xb5\xa6\xf3I\xbc_\x8b\xa4/|\'\x13\xda\xc6\xe6\x06\x9bw\xf9\xbbo+~/D\xact\t\n\x825A\xa2zw\xc3\x8a}\xd1\xab\xf4\\\xc701\xd3\xfa^\xd6\xcc\r\xf3T\x05#\xe2\xf1\x1e\xa0`X\xcd\xe9<\xfc4\xc1jU\xa4\xe0/\xd0\f.n7H\xc3\xd4\x00f\xe1\xa4A\xf2\xa6\xb1h?\x88qz\x0e\x06v\x99\xa4o\x8d\xd1\xd1S6\xfa\"\xc4O|\xdc\xd2\x9b\xe1\x04\'\x96\x8c\x84\xeeL\xba\xa2\xb9\xd8V\x83\xdf\v\xbc\x13\x00A\x18EB\xbe1\x8f\xdc#\x96\xfe\x15\x8d\xd2C\xc4]\xcf1nb\xe46\xcd\x8dM\x17/\xb8\xb2\xd1\x89\xc7h,\xa8\xdcHHNz#\xc9[\x00\x00\x00\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x5ffc) io_setup(0x2, &(0x7f0000000000)=0x0) mremap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x7000, 0x3, &(0x7f0000ff7000/0x7000)=nil) io_submit(r2, 0x1, &(0x7f0000000340)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200), 0xfffffd07}]) 19:09:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x8000, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x8, 0x8000, 0x81, 0x4, 0x410, 0x4, 0x100000000}, 0xc) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000001c0)={'veth0_to_hsr\x00', {0x2, 0x4e22, @local}}) sched_setscheduler(0x0, 0x0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000180)={0x9, 0x0, 0x0, 0x3, 0xff, 0x100000000}) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:01 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r5, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r7, @ANYRESHEX=r0, @ANYRES32, @ANYRESOCT=r6], 0xfec0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:02 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:02 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x16706e8d) 19:09:02 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:02 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$PPPIOCDISCONN(r2, 0x7439) 19:09:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff88"], 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.stat\x00', 0x0, 0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SIOCX25SSUBSCRIP(r1, 0x89e1, &(0x7f0000000380)={'bcsh0\x00', 0x10001, 0x2}) ioctl$SIOCAX25GETUID(r1, 0x89e0, &(0x7f00000002c0)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r2}) close(0xffffffffffffffff) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x100) setsockopt$inet_int(r3, 0x0, 0x15, &(0x7f0000000080)=0xb71f, 0x4) openat$audio(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio\x00', 0x80000, 0x0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r3, 0x80045400, &(0x7f0000000180)) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:02 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc1205531, &(0x7f0000000040)=""/162) 19:09:02 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VIDIOC_OVERLAY(r2, 0x4004560e, &(0x7f0000000040)=0x100000000) ioctl$void(0xffffffffffffffff, 0xc0045878) connect$nfc_llcp(r2, &(0x7f0000000100)={0x27, 0x0, 0x1, 0x5, 0x3, 0x40, "2093f2cef8fdd6df57b12b89d33a4098197fb00bbbcd42fe323a0787074acace5c586b7f9488df97825d80d6c3bffe46bda9d4f559ef42166fcf4f607274c7", 0x1a}, 0x60) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:02 executing program 4: r0 = memfd_create(&(0x7f0000000400)='/dev/snH/seq\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) write$sndseq(r1, 0x0, 0x0) dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, 0x0) ppoll(&(0x7f0000000380)=[{r0, 0x4146}], 0x1, 0x0, 0x0, 0x0) 19:09:02 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x8000, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x8, 0x8000, 0x81, 0x4, 0x410, 0x4, 0x100000000}, 0xc) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000001c0)={'veth0_to_hsr\x00', {0x2, 0x4e22, @local}}) sched_setscheduler(0x0, 0x0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000180)={0x9, 0x0, 0x0, 0x3, 0xff, 0x100000000}) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:02 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRES32=r4, @ANYRESOCT=r7], 0x21) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:02 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) socket(0xa, 0x0, 0x20) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x81, 0x20040) ioctl$KDSETMODE(r2, 0x4b3a, 0x8) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(r3, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:03 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x6400000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:03 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000180)="53f82b06981d40e2cb691643cced431e07b62e372993bbaa0ddc6dab0da2805c416b2943565683d5d44908107ef1ed29d080657b1f0648a03f44acd19394dc408870d139bc3248f61bed1302cc01fe4fda9cf5584e04d784a71df77a15fedd9a977fb4676b19bbbceaef8e058fb9c9b2488d1992396e4150fab212de5070c9275f4a6e78dbea54a18ebf8b91a353be9c6407c22d8abafe14661658432921682e840fa8d9bb5c01a609f651c8421ce7b1fe516772c6ec845043e326d5a017db7211977b91a6dbb0e337422bd4e400e4ae1ff1967760198f5861812981dcce4d076cfe3805872d88683b32309c034ac7f3417a29fbf467dfdb15e336b65da13eb7") ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:03 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:03 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x100, 0x0) getpeername$ax25(r3, &(0x7f0000000100)={{}, [@null, @default, @bcast, @default, @bcast, @default, @bcast, @netrom]}, &(0x7f0000000040)=0x48) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$VIDIOC_G_AUDOUT(r3, 0x80345631, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="4c2297a2da14"], 0x1200e) 19:09:03 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:03 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:03 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:04 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, 0x0, 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x8000, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x8, 0x8000, 0x81, 0x4, 0x410, 0x4, 0x100000000}, 0xc) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000001c0)={'veth0_to_hsr\x00', {0x2, 0x4e22, @local}}) sched_setscheduler(0x0, 0x0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000180)={0x9, 0x0, 0x0, 0x3, 0xff, 0x100000000}) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:04 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r1}) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000140)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x176, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000040)={0x549, 0x20, 0x5, 0x800, 0x7e000000000}) get_thread_area(&(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x400, 0x9, 0x100000000, 0xfffffffffffff7fe, 0x80000000, 0x1000, 0x0, 0x49cf}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:04 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0x2f) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:04 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0xce02000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="f780"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:05 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, 0x0, 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:05 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="85797a310fbfc70742a2746711783a0f91972c96e929e704fdfed166b0f88946adee2aa93247231c5a65123870a9a294e03b73fc87de86b1d426029db5e9a43b51dc98f5783f784ea5dd13682caaa553b1aa5dc4a20f673de1cba16d88141403b4344ea37a29397f25cec0f634167b71d2dc543336c2655d2eb76226f9f953077f76f8c2fa6482c0cfac873a36ab2d084f802c519d98a975c9504042c512e9d300fbe120227e580959f083952d9e2c63faa20a0df910c5f2be7912a80f94bbcdb00a82de1bd368c781877a15e8580afed953805f27ef60221b4bec0601e5dcd43fc79a"], 0x1200e) 19:09:05 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x7f, 0x40000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4b0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) clock_settime(0x0, &(0x7f0000000240)) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, [0x3ff, 0x8, 0x3, 0x5]}) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:05 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x8000, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x8, 0x8000, 0x81, 0x4, 0x410, 0x4, 0x100000000}, 0xc) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000001c0)={'veth0_to_hsr\x00', {0x2, 0x4e22, @local}}) sched_setscheduler(0x0, 0x0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000180)={0x9, 0x0, 0x0, 0x3, 0xff, 0x100000000}) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:05 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000000100)={0xa4, 0x1, 0x10001}) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:05 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) clone(0x8044000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000180), &(0x7f00000001c0)="d3e14db9425f1890c7ad5a2a8f2fcb96d56f53478d5b1ee89212bc0b772cd7c7e278498cb86ef1ede2564ce414f9f8") mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:05 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r1}) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000140)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x176, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000040)={0x549, 0x20, 0x5, 0x800, 0x7e000000000}) get_thread_area(&(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x400, 0x9, 0x100000000, 0xfffffffffffff7fe, 0x80000000, 0x1000, 0x0, 0x49cf}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:06 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:06 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:06 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="040000002424a722760b95b9deabc9865aa33181b54bcbd797df962fdc033a765b4b07f75c3090567ca386d5c3e0c61b2b4f2fd1c55b74fa62d7a4c2"], 0x1200e) 19:09:06 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r1}) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000140)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x176, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000040)={0x549, 0x20, 0x5, 0x800, 0x7e000000000}) get_thread_area(&(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x400, 0x9, 0x100000000, 0xfffffffffffff7fe, 0x80000000, 0x1000, 0x0, 0x49cf}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:06 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r1}) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000140)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x176, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000040)={0x549, 0x20, 0x5, 0x800, 0x7e000000000}) get_thread_area(&(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x400, 0x9, 0x100000000, 0xfffffffffffff7fe, 0x80000000, 0x1000, 0x0, 0x49cf}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:06 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000180)={{0x1f002, 0x0, 0x4, 0x6, 0x9, 0x20, 0x7f, 0x5, 0x7ff, 0x81, 0x200, 0xd2ac}, {0x100000, 0x5001, 0xf, 0x1, 0xffffffff, 0x1, 0x96a, 0x6, 0x4000000000006, 0x3, 0x4, 0x8}, {0x1f000, 0x3001, 0x9, 0x7f, 0x100, 0x6, 0x8, 0x5, 0x9, 0x9, 0x6, 0x3}, {0x6000, 0x10000, 0xf, 0xfffffffffffffff8, 0x0, 0x7, 0xff, 0xb52, 0x7f, 0x1, 0x1, 0x80000000}, {0x10f000, 0x0, 0x0, 0x9, 0x80000000, 0x2, 0x8000, 0x7, 0x5, 0x6, 0xab, 0x81}, {0xd000, 0xf000, 0x8, 0xff, 0x6, 0x40, 0x4bed, 0x3aca, 0x8, 0x9, 0x7, 0x100000001}, {0x2, 0x5001, 0xf, 0x3, 0xca2c, 0x3f, 0xf2, 0x9, 0x3, 0x3f, 0x5499e812, 0x7}, {0x4, 0x2000, 0x8, 0x4040000000000, 0xfffffffffffffffc, 0xe31, 0xa5f, 0x2, 0x138, 0x18c80000}, {0xf000, 0x10000}, {0x3000, 0x1}, 0x40001, 0x0, 0x1, 0x0, 0x5, 0x2100, 0x0, [0x3, 0x100, 0x7ff, 0x10000]}) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r2 = semget(0x3, 0x3, 0x40) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000380)={0x8, 0x6, 0x4, 0x5, 0x6, 0x1, 0x3f}, 0xc) semop(r2, &(0x7f0000000080)=[{0x7, 0x5, 0x1800}, {0x0, 0x7f, 0x1800}, {0x3, 0x9, 0x1000}, {0x1, 0x6, 0x1800}, {0x2, 0x8, 0x1000}, {0x4, 0xa104, 0x1800}, {0x1, 0xba, 0x1000}, {0x4, 0xffffffffffffffe0, 0x1800}], 0x8) sched_setscheduler(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000002c0), &(0x7f0000000300)=0x4) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:06 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r5, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES32=r7, @ANYRESHEX=r0, @ANYRES32=r3, @ANYRESOCT=r6], 0x31) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:06 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10242, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000140)={0x7}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000040)='rxrpc\x00', &(0x7f0000000100)={'\x00', 0x2}, &(0x7f0000000000), 0x76, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r2, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)=ANY=[@ANYBLOB='s\t9M'], 0x1200e) 19:09:07 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000180)="53f82b06981d40e2cb691643cced431e07b62e372993bbaa0ddc6dab0da2805c416b2943565683d5d44908107ef1ed29d080657b1f0648a03f44acd19394dc408870d139bc3248f61bed1302cc01fe4fda9cf5584e04d784a71df77a15fedd9a977fb4676b19bbbceaef8e058fb9c9b2488d1992396e4150fab212de5070c9275f4a6e78dbea54a18ebf8b91a353be9c6407c22d8abafe14661658432921682e840fa8d9bb5c01a609f651c8421ce7b1fe516772c6ec845043e326d5a017db7211977b91a6dbb0e337422bd4e400e4ae1ff1967760198f5861812981dcce4d076cfe3805872d88683b32309c034ac7f3417a29fbf467dfdb15e336b65da13eb7") ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:07 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="dbfba70d4d570311b47e04202609647ec722550ce7ba56c43bab2b6ba4529cac61e5dcc548e480a007c6ec323c4d5060c7461f52bee9bfbed98d4eaa982ff0a64609f45f649c163d9d68b050b4fa0f4cfcdc8df34474344ce1574ba7fe9820598d89fca308d12c40b63c2b6c2f81e0ffc639f40dd7381e3ee966c17c457685736c8fa2f9ae316dd9620f345f2702b3e3cf45bb164b35bd0000"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000040)='./file0\x00', 0x1043, 0xfffffffe) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:07 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:07 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x8000, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x8, 0x8000, 0x81, 0x4, 0x410, 0x4, 0x100000000}, 0xc) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000001c0)={'veth0_to_hsr\x00', {0x2, 0x4e22, @local}}) sched_setscheduler(0x0, 0x0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000180)={0x9, 0x0, 0x0, 0x3, 0xff, 0x100000000}) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:08 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:08 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r5, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES16, @ANYRES32=r7, @ANYRESHEX=r0, @ANYRES32=r3, @ANYRESOCT=r6], 0xfec0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:08 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000040)={0x4}) 19:09:08 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0xff, 0x4000) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r3, 0x700, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x14, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e21, 0x101, @empty, 0x6}}, 0x1, 0x10001}, &(0x7f0000000040)=0x90) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={r4, 0x6, 0x30}, &(0x7f0000000240)=0xc) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000004c0)={0x5, 0x8a66, 0x4, 0x9}, 0x8) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) r5 = socket(0x0, 0x4, 0x7) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x1d, &(0x7f0000000280)={0xf7f6, 0x100000000, 0x7, 0x1, 0x1}, 0x14) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:08 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:08 executing program 4: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:08 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:08 executing program 4: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:08 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff80d9c8b4e3850749775592314bef975a93576b0df698a815020dc9a7b1082c35070424695c661f7ea30ba7176c3363617339fe82159b383247a6d1ef7949deb3673f6434cc05b590ed2486480000000000000000000000"], 0x2) setxattr(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000180)=@random={'security.', '\x00'}, &(0x7f0000000200)='/dev/vhci\x00', 0xa, 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:09 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:09 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) fgetxattr(r2, &(0x7f0000000000)=@random={'osx.', 'rxrpc\x00'}, &(0x7f0000000100)=""/102, 0x66) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)=ANY=[@ANYBLOB='syN1'], 0x1200e) 19:09:09 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:09 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2ce}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) write$FUSE_IOCTL(r0, &(0x7f0000000080)={0x20, 0xfffffffffffffff5, 0x2, {0x4, 0x0, 0x1ff, 0x8}}, 0x20) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x200}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:09 executing program 4: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:09 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x1200e) 19:09:10 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:10 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:10 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000040)={0x2, 0x3, 0x0, 0x0, 0x0, 0x10000}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0xa4102, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f0000000140)={@mcast1, 0x0}, &(0x7f0000000180)=0x14) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x1, r2, 0x12}, 0x10) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:10 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80080, 0x0) getsockopt$inet_udp_int(r2, 0x11, 0x65, &(0x7f0000000040), &(0x7f0000000100)=0x4) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r3, 0xc0045c79) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:10 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f00}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:11 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(0xffffffffffffffff, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:11 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:11 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r4 = dup(r2) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r4, 0xc0945662, &(0x7f0000000380)={0x80000001, 0x0, [], {0x0, @bt={0x8001, 0x6, 0x1, 0x2, 0x60, 0x20, 0x71fc8e9d, 0xffffffffffffff00, 0x5ce2, 0xd21a, 0x10bc000, 0xfff, 0x4, 0x6, 0x1, 0x26}}}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000001600)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000300)=0xe8) syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffb0, 0x3, &(0x7f0000001580)=[{&(0x7f0000000580)="25cc9d7d58fd5b3b362201ef18ed0b08e0b1fdc061ea32e58b41446b8630113a3069fa9914d08bfb917c69d7077a04e8706d3678ce75fcaf560bc0428524c0a9b4235ccd98c0f68e342bcdc4b4fab550aa3e77f156c237d585b48233cd69bcaecbc7631824a9ca711b40794aaff14750be41f6ac5450738ba5d0493f9959b9f32246af551910170966b9ab3321b50bb3eaa747f4dfdef31c46754e1c79be12f27454feb814fbfabd898be1267d5d1142505b818e8c36114db7589687beedc35c6ab5ba84cf46ec10b033ec55416d6dc5e363bc5836a63c3e7a0d3986ca7a1ea5100de30b968e5e3949d5e8e9a3ac4a408a0289793239dcbb944be3a09094595b6118e967720e8ebd80fc5a9a57ec2e432f60de532ac6d344b360430c5672891b1531eaa1dec9b01a27f5f19e9ff864103b07698f515eeb596c473dd7b5f6a942ec5c825ccac1e2a7a6f219d5db5e9cea5c33746229eae57afcd8153686cc684f0ac9be5cbc87fcb8c3ead797e08b467b52bcf26a96e38e7d94080120e8d6fb69ef6a46201be3037a26c3ad4c89387822714516e9f10413c121e0a1ce5193c91a4ed8c393d06a5cb04349b2615c84030492abb28c5836e8697278c6d90bf5778fb103893072b6cd952cd8eaba011af237d0f54a78ea4a796b87f08dc09a7d8653260df18d39cf7e56b5ca793a86a368e93c2c9da87f436501ff23d0a3bbef991ef147cd57b2472154d8ff726dfee1b15c2422da84e921831c0bdea62a4bf5242afc68f4e08d6d61485a8f840621c9c435f113409c57a5400abd370fac7ab1866c79035ef19e1e905f32dad852c7f20cc9e11363e26f24b7362f71cdf086bd5ec1b7fab0cd6084261c9dfec82d2492d54900088a2047ef6d88f908555dc7f1c577e54c56063b22df1ff9fee0089becbe6cd725e2159518935a85e60532714ae22d45cd12afaae79348edeea455c806e47458c5c91a560740e264c67d7fca1932ceccf6c4d73623a703aaebc375ca534536d0a7afde80e541726576188414bb0d147e7f4a63880153e0243223af75a53170fa6d01d16b2cebc5cb04e7f2f89995dc3d3be5b1a37900ef8ce1494d00cc32ea7973d6598dc495d8ad6e87315ac23e1b12dea6aacbd632344ff833e897b9ba078eb8c12b86caacdb5594154e80406fd542d41ed72bb6de8ae0a520b359c4f2116f037d902a7ada25ab157a68e7214e6de2cb7ad6f1fee237328a0b25dcb4008e22954ddb9334c9da7ce00a1e9faeaeea7aeaa968e9f709957eeba6f5562c02007e4edca764277c4b6736d595ff452fabc85a82add678c03a4d9fbce0910d353f61ba303c9a9062902102252b213156ee3d172286a152bf03cc3c5d5d0a1195858bbe615abbc4a03c0cac0cab4cc6bd34a117c7cbc2835f683613c3a2bc8cde7f5a95683c689cc274c0c60175423ec07f48bd01d13bc8dc2f0e7e654377fb9d2888f0c83de78ce3736853ba5542785be3ed03a3480f5b5ac1b19728894b4df90e105c5690f44441ba24dcb8cd661d0ce0147f45fafa052162a6cece9bf1e829ab02e07c9e1a90b8deadb049dba2f3e2e3593c5a30d74ccfb2251d83794a987d728fbc5064f7741aed15d9b4571a01dffdf71775db49f57c236900e62ce864e39ffdbb87010d2902c7cc8e9820a7dc987c03dd407ac5f586ae253f899d880b0e11be2c3cf2d18eaef0ab1b8f439eefcfec39118891c1c1acff8eea2f4abdf67a56f6c83769750fdbb90c2299254fcf887ad1e1c49c7d9ae4993aedb4a7980b33955a832c5ce355dde44e3c4534ed9fba244c6c441323fbe5af63651bc97c26b2184412d757d97cab41f58cfd305da9ca6a1e4cc7fe608f8f8e5e2bc985a987af2c8a9de1242e51cdbf38ca1b3c445961788e5bbfdf92482566ec488c2d73978e074e1651b127e6caed668dc1c73587c567e7e79120181b7f44bff7fd4aa8d4dd5c562f95e8f46c257c20ac4fde3b88b48f5136671b3a2aa96ae649c14c10d5086db6b843fca6f5d1d2b77f4f676c573a26731c92b3b8ecb4e26dec41f1e599ed077f806d6af59f1b32c3a0a770bed679f0dd39022ef1b3c5e17ab6406cf89f7ef18286ed1cc68a9c28df9808cff86be0f441a03120617ea459a4b317f05152d007c9ad8929c3f9e54bd01083b3ecc8b6fcefdd3103d5a38f2b830b1cd64222de1bde7da8dea3868b06b289903dfad215f02f669879aa987f777d53ea0741f22e56287fa782c301cb9c3a6bd7154b67bc50435268a4a78db903d2fc6cd8c923d8bb0df697287c54bde62cedbece6c3317d7c550e88c7a0315d96bcbd138c3d3af4d57af2579acfc8ee798794d3fc203b7cb60fa78a5434f2ed61349369b2b3597c5eca7c75b607ce4ce469f1727691db61dedfbb33d01c75777a1861b415095033c06f0bbad4370ca6292b6c8e3e4c87d4643d9b045b6c4514050461af1093b4909ad2d9dfaa30ca1daba2f0e5b6dd79c7509f862361143ad0529c6c5f134db0adeb0c9a23e4a634570e83cd4bfcce9ced3e409284f1e4aa70b8b5aad0bbffbda74282cd0039183943a46134ebbc6110f172d670f699f4f851af0e1d34d3474290cb867d00d8885528c9a177939d7ca6d0038ec1c241da79b0589ef1370217efc17d46faf4bf98572083f18305977844725285209bb236104204c47b73af51e4c5ce99da7c10925450b6568fc2ee28e3dce991fad86083c8aed1361fef7c772304268411ea6f6110e67a12f857af48dae2620ac8759a486e2d116d3cc8abff82505333eadda24cbb4bd04624e50c815fcea249711d3c9c3b58a5a900071b7c224d376d9c2a5b2db4072ed9f24567abecb9a401449d8244c7688247c7b1f307644522e4cf4082be2156585782d31496f027efa427c5a2bfe45b25d292eb958baf14d5452741dee397d6bab33cb6be238ebb7ad2a5bc1b756650ef18780465a4503919e1a83d5f43b7864b3f9b1cbb914696aace987318c2cdff73fb207cb8ba7d236aec115e01e02f36b150ca3ff38d77becf4067384ef89b0f6135cef737c55a026a3d130ad41af68b6aadc85b10d0a0e7cc28216515a889dc25e4f703e2110e4654d41a27187d3d9c559ea774a5e84c37395d0e6c634b015e0630d074f9ecd49bb1cb7d404ae616c0ebfd5a138bed6cfea551ccb28de39a52089d69b12237862549a4a11bdcf57ab4d03a7d0c3756f8d84cdee7f05f5e1b254bb233a4f8b1283b7420770aa54081bbd273ba3e53de693324ee289f6d0825ab6eca0b97dc74cac086fb6efbfcaf660d868250c1381d501342705972ae2407acdb1c524d4a72b4299e54b25fecd58311f3e00e2ee1ef7bb0c8901509419a241a12b78ebe6a7c3f31a334e28d295d19dc7331371d3b5597bb640d610342bc60d7fc6c31862fb124ca319c509040883c4f60a6218b5858c6dcd8db33bd0fcc6c959987d2ab9263616c7e3938f9fd7ac1538d9d88947098f111d526a66bf1922d962b46c5a98c95b9b98e3441cdf4ba7b854f994677ed3e5f3710d2672f766b282b856760f97570b32b887fcddd44d23450a8885047ea06146fc7348d119fa5a45beae029f9836a5b2f5c6ec94761603485383419e2edc3938a363c960143037da3290f3c663dd62ebc770fcbcaec285405f193bf18193c337d0a08089b8838080ba696996c4d5a6a9770ee9ab4a0623b3676cd61b9f9372c682ad2e23494b43e0559bb91f1365634ae9597e097c772e07c71958a93455a942ee5cafa954d0db84faf062cdc98ea6a7d008b4f4ff6da831b9b2912efa9be6caface7487c05b6d92b67d8ba973fb881d0ce81088300c752b7c534a49e3cd90a0c3b06bc51bccb7a354eae0a314efdbc6bfde684a84c10d8eef6f586c937044488f9e56c90c69fc9dcbb1e807e4d4730c96433ed4b4a7ce692c95db281ca16587f53a9e4e375debe5a35af9c4268f85c6943e15b959edd31f9fa8254cfe1cf91847c5acb2c9262be4ac618a903cfc26f5555b37cd0e759d469907322c8539ac4d41e33b249be767a5c935b54d14faf618d21bb13d59102ecd8462392d0c34622b77668defa02bb9776e8aa626a7b2162a08891ed87852660108913f9e5cfaf89599cce374dafed2e5f467d2d6718101b1b1a44c6f744a31b3ec20fd754e9f8fdbced6a0dfd740e875e27ed766d626de7faf45f37254198c8dd0b6607ac76ab695a70d39a5a2d24e1656f43e31f0a7c1aad412d93e5aed697fd7685bb4586e6b910696ef9c754acf8c54b287ba67a5bce76155a85bd2902df3a82eca9e8d70414199497f0fd07b702802aabf944e52b82d6b89ca3e26e47223bf7ce340cdb6a0a219fea4d5d27bc636d30c03be155ab791fb8ce28cfe70de80dd41c9096422ef98037cce2f33c1f8559c1016c983906c65d53ec01072be2c722e4f3a33ee7641f38b1aecca38b356ed7b8602d163b1e657f163fb0306a4740cfbb028d502e1ebba8ed1ea3209af2c9891fb57a27bbfe6c005958891375f3f31ff2f58546a34b9d252312e04f2f4cbec1d56b7c24af54907e9b882ebe5faf34fe1b89a77f948ec602dde693dbe98fae2298ad674df2ab5a0ef2617b51dd0da1530af9e738699e9af0784bb2d0e3571636f3a352542fe153b9abb8aef0a1d7b883fe6e182564e70b6b6d5dc68b63f23e37134d73d99158d4d29aad2af1c46a6ed7c4cf3a362dff37cddd74ee60add88c70da01ff730a87c5f8181482996df0ab6a52b78962e59a247305256eef5fa0eaa32c549adddd72e86db425082d7022b24eb7838336be91862a0748df86d5ea4d0cc271361c2733cd531a1d345b80bd2f596a1d300ed5cc92e1d9e15c4293288216e864065d229d74115c69ff9a8a6f6c6a0c328dcdc280c27a341b923799e040866b57c6d4f604c8bee036f871521c1504f5683c3f6ad20c06d77a822169e7262da88de42291073f4ea4bb7e28f249902736828336ed8bf4e6cd29bf1b4efb6ce7d02860ff4884b9b5453f3307840e95e836daf84c4d2dae4113b9a6130f2935e07164cb7a834ce1ffba948318243cdf39ad2ae9ea850ab355b625074816a5cfde2ba7de34a248ac88fb615a8d3735c5f2f695478669b3a82f6711ebe73666c5f692de6e03cea41039cd8ad287f23eeb6d8fd63d61d1f19c8d05b5121fd482b2dceab0d8786231683eb6bb2b3dce081644caf67e017631656d4d576a6c17f41a501995fe85ba5eec5ba002b143408b366623790a487c1c1dbbde3f6d3baa0fc93d6b78cac6c498de16564512ce2a5103258a1e86ae39053d8a5dacea83a6b0e3dd65128e774dd041224687aaec78bab6d12025ee12415ca01c6d47dc092bcbd2bfeca0ba4f25498c4e3f563d250f321b5fdd657f044ad5b9dcd8258e624432d06b43a30fa790dd9c39d9426805c23427417a28d45009595fbfe65e706c97c25f67d70468dc85df09a5b72186d455c808cac812e047d34d3914c4be424dd44d7cc99648e97777cd6d43d806129dcefeeab454aaf3d2eaca0f8d878416368a20760ebb03afdecab6d4373a20b6d67a435a77ac14e70667aa0f45b3951bc9164a78f046ca7988893c397d71dfe0c85cc35e7d17a2f8d42fdec1f1710ee200f43b3e52babe46d7cb5489c1d0e66cdd6e5c4e70b0eeaf79685ab2e55f35cbf8a8776dd596b02abde20658479782086b30d61a4deaa5216443d0b22b13a2ca4e04fac19f45368300afb56e0c866cd266688825dee26a7e8cdff7c3b069d19dc7155fc876a7a44a650913849a13c096d07e5937c5d38fe26a79ace463a", 0x1000, 0x3}, {&(0x7f0000000140)="fdf6e4b75574897f47b547762b637e995fa6a3b46587ab5d6df763cc", 0x1c, 0xfffffffffffffffb}, {&(0x7f00000001c0)="8dc8cf28e4407b5c64c6a25a3a49e952695160e80fd7e2911c6f4df5c292025872fd", 0x22, 0xff}], 0x0, &(0x7f0000001700)={[{@mblk_io_submit='mblk_io_submit'}, {@grpid='grpid'}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@barrier_val={'barrier', 0x3d, 0xfffffffffffffff7}}, {@errors_continue='errors=continue'}, {@nomblk_io_submit='nomblk_io_submit'}], [{@subj_type={'subj_type', 0x3d, 'cgroup.type\x00'}}, {@obj_type={'obj_type', 0x3d, '/dev/nullb0\x00'}}, {@fowner_eq={'fowner', 0x3d, r5}}, {@fsuuid={'fsuuid', 0x3d, {[0x3e, 0x30, 0x33, 0x77, 0x39, 0x76, 0x33, 0x67], 0x2d, [0x65, 0x32, 0x76], 0x2d, [0x31, 0x35, 0x66, 0x34], 0x2d, [0x38, 0x0, 0x37, 0x62], 0x2d, [0x7a, 0x38, 0x0, 0x0, 0x64, 0x35, 0x36]}}}, {@pcr={'pcr', 0x3d, 0x18}}, {@dont_hash='dont_hash'}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x30, 0x34, 0x33, 0x66, 0x77, 0x30, 0x7d], 0x2d, [0x35, 0x36, 0x63], 0x2d, [0x35, 0x0, 0x64, 0x35], 0x2d, [0x65, 0x7f, 0x7f, 0x77], 0x2d, [0x39, 0x39, 0x64, 0x38, 0x7e, 0x36, 0x39, 0x33]}}}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fscontext={'fscontext', 0x3d, 'user_u'}}]}) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="697e22cf3a9ceb03aa1879e8221e71140e84ed1c4b19badb12dc8a7dbc26023c13400a45f1a0"], 0x1200e) 19:09:11 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80080, 0x0) getsockopt$inet_udp_int(r2, 0x11, 0x65, &(0x7f0000000040), &(0x7f0000000100)=0x4) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r3, 0xc0045c79) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:11 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:11 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:11 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:11 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80080, 0x0) getsockopt$inet_udp_int(r2, 0x11, 0x65, &(0x7f0000000040), &(0x7f0000000100)=0x4) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r3, 0xc0045c79) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:11 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, 0x0, 0x0) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:12 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, 0x0) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:12 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80080, 0x0) getsockopt$inet_udp_int(r2, 0x11, 0x65, &(0x7f0000000040), &(0x7f0000000100)=0x4) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r3, 0xc0045c79) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:12 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6400}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:12 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:12 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:12 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:12 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000100)=0x3, 0x8) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={r2, &(0x7f0000000100), &(0x7f0000000380)=""/109}, 0x18) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x408002, 0x0) getsockopt$netlink(r4, 0x10e, 0x2, &(0x7f0000000580)=""/197, &(0x7f0000000040)=0xc5) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:12 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r4 = dup(r2) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r4, 0xc0945662, &(0x7f0000000380)={0x80000001, 0x0, [], {0x0, @bt={0x8001, 0x6, 0x1, 0x2, 0x60, 0x20, 0x71fc8e9d, 0xffffffffffffff00, 0x5ce2, 0xd21a, 0x10bc000, 0xfff, 0x4, 0x6, 0x1, 0x26}}}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000001600)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000300)=0xe8) syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffb0, 0x3, &(0x7f0000001580)=[{&(0x7f0000000580)="25cc9d7d58fd5b3b362201ef18ed0b08e0b1fdc061ea32e58b41446b8630113a3069fa9914d08bfb917c69d7077a04e8706d3678ce75fcaf560bc0428524c0a9b4235ccd98c0f68e342bcdc4b4fab550aa3e77f156c237d585b48233cd69bcaecbc7631824a9ca711b40794aaff14750be41f6ac5450738ba5d0493f9959b9f32246af551910170966b9ab3321b50bb3eaa747f4dfdef31c46754e1c79be12f27454feb814fbfabd898be1267d5d1142505b818e8c36114db7589687beedc35c6ab5ba84cf46ec10b033ec55416d6dc5e363bc5836a63c3e7a0d3986ca7a1ea5100de30b968e5e3949d5e8e9a3ac4a408a0289793239dcbb944be3a09094595b6118e967720e8ebd80fc5a9a57ec2e432f60de532ac6d344b360430c5672891b1531eaa1dec9b01a27f5f19e9ff864103b07698f515eeb596c473dd7b5f6a942ec5c825ccac1e2a7a6f219d5db5e9cea5c33746229eae57afcd8153686cc684f0ac9be5cbc87fcb8c3ead797e08b467b52bcf26a96e38e7d94080120e8d6fb69ef6a46201be3037a26c3ad4c89387822714516e9f10413c121e0a1ce5193c91a4ed8c393d06a5cb04349b2615c84030492abb28c5836e8697278c6d90bf5778fb103893072b6cd952cd8eaba011af237d0f54a78ea4a796b87f08dc09a7d8653260df18d39cf7e56b5ca793a86a368e93c2c9da87f436501ff23d0a3bbef991ef147cd57b2472154d8ff726dfee1b15c2422da84e921831c0bdea62a4bf5242afc68f4e08d6d61485a8f840621c9c435f113409c57a5400abd370fac7ab1866c79035ef19e1e905f32dad852c7f20cc9e11363e26f24b7362f71cdf086bd5ec1b7fab0cd6084261c9dfec82d2492d54900088a2047ef6d88f908555dc7f1c577e54c56063b22df1ff9fee0089becbe6cd725e2159518935a85e60532714ae22d45cd12afaae79348edeea455c806e47458c5c91a560740e264c67d7fca1932ceccf6c4d73623a703aaebc375ca534536d0a7afde80e541726576188414bb0d147e7f4a63880153e0243223af75a53170fa6d01d16b2cebc5cb04e7f2f89995dc3d3be5b1a37900ef8ce1494d00cc32ea7973d6598dc495d8ad6e87315ac23e1b12dea6aacbd632344ff833e897b9ba078eb8c12b86caacdb5594154e80406fd542d41ed72bb6de8ae0a520b359c4f2116f037d902a7ada25ab157a68e7214e6de2cb7ad6f1fee237328a0b25dcb4008e22954ddb9334c9da7ce00a1e9faeaeea7aeaa968e9f709957eeba6f5562c02007e4edca764277c4b6736d595ff452fabc85a82add678c03a4d9fbce0910d353f61ba303c9a9062902102252b213156ee3d172286a152bf03cc3c5d5d0a1195858bbe615abbc4a03c0cac0cab4cc6bd34a117c7cbc2835f683613c3a2bc8cde7f5a95683c689cc274c0c60175423ec07f48bd01d13bc8dc2f0e7e654377fb9d2888f0c83de78ce3736853ba5542785be3ed03a3480f5b5ac1b19728894b4df90e105c5690f44441ba24dcb8cd661d0ce0147f45fafa052162a6cece9bf1e829ab02e07c9e1a90b8deadb049dba2f3e2e3593c5a30d74ccfb2251d83794a987d728fbc5064f7741aed15d9b4571a01dffdf71775db49f57c236900e62ce864e39ffdbb87010d2902c7cc8e9820a7dc987c03dd407ac5f586ae253f899d880b0e11be2c3cf2d18eaef0ab1b8f439eefcfec39118891c1c1acff8eea2f4abdf67a56f6c83769750fdbb90c2299254fcf887ad1e1c49c7d9ae4993aedb4a7980b33955a832c5ce355dde44e3c4534ed9fba244c6c441323fbe5af63651bc97c26b2184412d757d97cab41f58cfd305da9ca6a1e4cc7fe608f8f8e5e2bc985a987af2c8a9de1242e51cdbf38ca1b3c445961788e5bbfdf92482566ec488c2d73978e074e1651b127e6caed668dc1c73587c567e7e79120181b7f44bff7fd4aa8d4dd5c562f95e8f46c257c20ac4fde3b88b48f5136671b3a2aa96ae649c14c10d5086db6b843fca6f5d1d2b77f4f676c573a26731c92b3b8ecb4e26dec41f1e599ed077f806d6af59f1b32c3a0a770bed679f0dd39022ef1b3c5e17ab6406cf89f7ef18286ed1cc68a9c28df9808cff86be0f441a03120617ea459a4b317f05152d007c9ad8929c3f9e54bd01083b3ecc8b6fcefdd3103d5a38f2b830b1cd64222de1bde7da8dea3868b06b289903dfad215f02f669879aa987f777d53ea0741f22e56287fa782c301cb9c3a6bd7154b67bc50435268a4a78db903d2fc6cd8c923d8bb0df697287c54bde62cedbece6c3317d7c550e88c7a0315d96bcbd138c3d3af4d57af2579acfc8ee798794d3fc203b7cb60fa78a5434f2ed61349369b2b3597c5eca7c75b607ce4ce469f1727691db61dedfbb33d01c75777a1861b415095033c06f0bbad4370ca6292b6c8e3e4c87d4643d9b045b6c4514050461af1093b4909ad2d9dfaa30ca1daba2f0e5b6dd79c7509f862361143ad0529c6c5f134db0adeb0c9a23e4a634570e83cd4bfcce9ced3e409284f1e4aa70b8b5aad0bbffbda74282cd0039183943a46134ebbc6110f172d670f699f4f851af0e1d34d3474290cb867d00d8885528c9a177939d7ca6d0038ec1c241da79b0589ef1370217efc17d46faf4bf98572083f18305977844725285209bb236104204c47b73af51e4c5ce99da7c10925450b6568fc2ee28e3dce991fad86083c8aed1361fef7c772304268411ea6f6110e67a12f857af48dae2620ac8759a486e2d116d3cc8abff82505333eadda24cbb4bd04624e50c815fcea249711d3c9c3b58a5a900071b7c224d376d9c2a5b2db4072ed9f24567abecb9a401449d8244c7688247c7b1f307644522e4cf4082be2156585782d31496f027efa427c5a2bfe45b25d292eb958baf14d5452741dee397d6bab33cb6be238ebb7ad2a5bc1b756650ef18780465a4503919e1a83d5f43b7864b3f9b1cbb914696aace987318c2cdff73fb207cb8ba7d236aec115e01e02f36b150ca3ff38d77becf4067384ef89b0f6135cef737c55a026a3d130ad41af68b6aadc85b10d0a0e7cc28216515a889dc25e4f703e2110e4654d41a27187d3d9c559ea774a5e84c37395d0e6c634b015e0630d074f9ecd49bb1cb7d404ae616c0ebfd5a138bed6cfea551ccb28de39a52089d69b12237862549a4a11bdcf57ab4d03a7d0c3756f8d84cdee7f05f5e1b254bb233a4f8b1283b7420770aa54081bbd273ba3e53de693324ee289f6d0825ab6eca0b97dc74cac086fb6efbfcaf660d868250c1381d501342705972ae2407acdb1c524d4a72b4299e54b25fecd58311f3e00e2ee1ef7bb0c8901509419a241a12b78ebe6a7c3f31a334e28d295d19dc7331371d3b5597bb640d610342bc60d7fc6c31862fb124ca319c509040883c4f60a6218b5858c6dcd8db33bd0fcc6c959987d2ab9263616c7e3938f9fd7ac1538d9d88947098f111d526a66bf1922d962b46c5a98c95b9b98e3441cdf4ba7b854f994677ed3e5f3710d2672f766b282b856760f97570b32b887fcddd44d23450a8885047ea06146fc7348d119fa5a45beae029f9836a5b2f5c6ec94761603485383419e2edc3938a363c960143037da3290f3c663dd62ebc770fcbcaec285405f193bf18193c337d0a08089b8838080ba696996c4d5a6a9770ee9ab4a0623b3676cd61b9f9372c682ad2e23494b43e0559bb91f1365634ae9597e097c772e07c71958a93455a942ee5cafa954d0db84faf062cdc98ea6a7d008b4f4ff6da831b9b2912efa9be6caface7487c05b6d92b67d8ba973fb881d0ce81088300c752b7c534a49e3cd90a0c3b06bc51bccb7a354eae0a314efdbc6bfde684a84c10d8eef6f586c937044488f9e56c90c69fc9dcbb1e807e4d4730c96433ed4b4a7ce692c95db281ca16587f53a9e4e375debe5a35af9c4268f85c6943e15b959edd31f9fa8254cfe1cf91847c5acb2c9262be4ac618a903cfc26f5555b37cd0e759d469907322c8539ac4d41e33b249be767a5c935b54d14faf618d21bb13d59102ecd8462392d0c34622b77668defa02bb9776e8aa626a7b2162a08891ed87852660108913f9e5cfaf89599cce374dafed2e5f467d2d6718101b1b1a44c6f744a31b3ec20fd754e9f8fdbced6a0dfd740e875e27ed766d626de7faf45f37254198c8dd0b6607ac76ab695a70d39a5a2d24e1656f43e31f0a7c1aad412d93e5aed697fd7685bb4586e6b910696ef9c754acf8c54b287ba67a5bce76155a85bd2902df3a82eca9e8d70414199497f0fd07b702802aabf944e52b82d6b89ca3e26e47223bf7ce340cdb6a0a219fea4d5d27bc636d30c03be155ab791fb8ce28cfe70de80dd41c9096422ef98037cce2f33c1f8559c1016c983906c65d53ec01072be2c722e4f3a33ee7641f38b1aecca38b356ed7b8602d163b1e657f163fb0306a4740cfbb028d502e1ebba8ed1ea3209af2c9891fb57a27bbfe6c005958891375f3f31ff2f58546a34b9d252312e04f2f4cbec1d56b7c24af54907e9b882ebe5faf34fe1b89a77f948ec602dde693dbe98fae2298ad674df2ab5a0ef2617b51dd0da1530af9e738699e9af0784bb2d0e3571636f3a352542fe153b9abb8aef0a1d7b883fe6e182564e70b6b6d5dc68b63f23e37134d73d99158d4d29aad2af1c46a6ed7c4cf3a362dff37cddd74ee60add88c70da01ff730a87c5f8181482996df0ab6a52b78962e59a247305256eef5fa0eaa32c549adddd72e86db425082d7022b24eb7838336be91862a0748df86d5ea4d0cc271361c2733cd531a1d345b80bd2f596a1d300ed5cc92e1d9e15c4293288216e864065d229d74115c69ff9a8a6f6c6a0c328dcdc280c27a341b923799e040866b57c6d4f604c8bee036f871521c1504f5683c3f6ad20c06d77a822169e7262da88de42291073f4ea4bb7e28f249902736828336ed8bf4e6cd29bf1b4efb6ce7d02860ff4884b9b5453f3307840e95e836daf84c4d2dae4113b9a6130f2935e07164cb7a834ce1ffba948318243cdf39ad2ae9ea850ab355b625074816a5cfde2ba7de34a248ac88fb615a8d3735c5f2f695478669b3a82f6711ebe73666c5f692de6e03cea41039cd8ad287f23eeb6d8fd63d61d1f19c8d05b5121fd482b2dceab0d8786231683eb6bb2b3dce081644caf67e017631656d4d576a6c17f41a501995fe85ba5eec5ba002b143408b366623790a487c1c1dbbde3f6d3baa0fc93d6b78cac6c498de16564512ce2a5103258a1e86ae39053d8a5dacea83a6b0e3dd65128e774dd041224687aaec78bab6d12025ee12415ca01c6d47dc092bcbd2bfeca0ba4f25498c4e3f563d250f321b5fdd657f044ad5b9dcd8258e624432d06b43a30fa790dd9c39d9426805c23427417a28d45009595fbfe65e706c97c25f67d70468dc85df09a5b72186d455c808cac812e047d34d3914c4be424dd44d7cc99648e97777cd6d43d806129dcefeeab454aaf3d2eaca0f8d878416368a20760ebb03afdecab6d4373a20b6d67a435a77ac14e70667aa0f45b3951bc9164a78f046ca7988893c397d71dfe0c85cc35e7d17a2f8d42fdec1f1710ee200f43b3e52babe46d7cb5489c1d0e66cdd6e5c4e70b0eeaf79685ab2e55f35cbf8a8776dd596b02abde20658479782086b30d61a4deaa5216443d0b22b13a2ca4e04fac19f45368300afb56e0c866cd266688825dee26a7e8cdff7c3b069d19dc7155fc876a7a44a650913849a13c096d07e5937c5d38fe26a79ace463a", 0x1000, 0x3}, {&(0x7f0000000140)="fdf6e4b75574897f47b547762b637e995fa6a3b46587ab5d6df763cc", 0x1c, 0xfffffffffffffffb}, {&(0x7f00000001c0)="8dc8cf28e4407b5c64c6a25a3a49e952695160e80fd7e2911c6f4df5c292025872fd", 0x22, 0xff}], 0x0, &(0x7f0000001700)={[{@mblk_io_submit='mblk_io_submit'}, {@grpid='grpid'}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@barrier_val={'barrier', 0x3d, 0xfffffffffffffff7}}, {@errors_continue='errors=continue'}, {@nomblk_io_submit='nomblk_io_submit'}], [{@subj_type={'subj_type', 0x3d, 'cgroup.type\x00'}}, {@obj_type={'obj_type', 0x3d, '/dev/nullb0\x00'}}, {@fowner_eq={'fowner', 0x3d, r5}}, {@fsuuid={'fsuuid', 0x3d, {[0x3e, 0x30, 0x33, 0x77, 0x39, 0x76, 0x33, 0x67], 0x2d, [0x65, 0x32, 0x76], 0x2d, [0x31, 0x35, 0x66, 0x34], 0x2d, [0x38, 0x0, 0x37, 0x62], 0x2d, [0x7a, 0x38, 0x0, 0x0, 0x64, 0x35, 0x36]}}}, {@pcr={'pcr', 0x3d, 0x18}}, {@dont_hash='dont_hash'}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x30, 0x34, 0x33, 0x66, 0x77, 0x30, 0x7d], 0x2d, [0x35, 0x36, 0x63], 0x2d, [0x35, 0x0, 0x64, 0x35], 0x2d, [0x65, 0x7f, 0x7f, 0x77], 0x2d, [0x39, 0x39, 0x64, 0x38, 0x7e, 0x36, 0x39, 0x33]}}}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fscontext={'fscontext', 0x3d, 'user_u'}}]}) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="697e22cf3a9ceb03aa1879e8221e71140e84ed1c4b19badb12dc8a7dbc26023c13400a45f1a0"], 0x1200e) 19:09:12 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:13 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x0, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:13 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r3 = creat(&(0x7f0000000140)='./file0\x00', 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000380)=@nat={'nat\x00', 0x19, 0x2, 0x2b8, [0x20000580, 0x0, 0x0, 0x200005b0, 0x200005e0], 0x0, &(0x7f00000001c0), &(0x7f0000000580)=[{}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x11, 0x0, 0x8849, 'bcsf0\x00', 'hwsim0\x00', 'veth0_to_bridge\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0xff, 0xff], @dev={[], 0x26}, [0xff, 0x0, 0xff, 0xff, 0xff], 0xf0, 0xf0, 0x120, [@devgroup={'devgroup\x00', 0x18, {{0x1, 0xfffffffffffffff8, 0x6, 0x387, 0x7}}}, @time={'time\x00', 0x18, {{0x4, 0x9, 0x204e, 0x6214, 0x74, 0x6}}}]}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0xaa2}}}}, {{{0x3, 0x46, 0xfafa, 'hsr0\x00', 'bond0\x00', 'lapb0\x00', 'veth0\x00', @remote, [0x0, 0x0, 0x0, 0xff, 0x0, 0xff], @broadcast, [0x0, 0x0, 0xff, 0x0, 0xff, 0xff], 0x70, 0xd8, 0x108}, [@common=@redirect={'redirect\x00', 0x8, {{0xffffffffffffffff}}}, @snat={'snat\x00', 0x10, {{@local, 0x10}}}]}, @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffd}}}}]}]}, 0x330) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f0000000100)='+\x00', 0x2, 0x1) 19:09:13 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:13 executing program 2: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:13 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:13 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xce02}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:13 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f0000000040)) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) getsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f0000000040)=0x5, &(0x7f0000000100)=0x4) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:14 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:14 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) write$binfmt_misc(r1, &(0x7f0000000000)={'syz0', "3285d44deec8db04f523333b663bcaf6064b378aeb7aed70fe524a0b0a3c2ac7a5ff8373503a3aa3f5968c8b5362f860ec883a9cc2e870dd835cb09b0b"}, 0x41) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:14 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:14 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:14 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:14 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:15 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:15 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:15 executing program 2: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:15 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:15 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:15 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:15 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x0, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) [ 756.248616][T24050] IPVS: ftp: loaded support on port[0] = 21 19:09:17 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:17 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:17 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:17 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, 0x0, 0x0) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:17 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RLERRORu(r1, &(0x7f0000000140)={0x1d, 0x7, 0x2, {{0x10, 'posix_acl_access'}, 0x7fff}}, 0x1d) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f00000001c0)) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="000000009d02bafe09a5a1401837cbfd3de42f790eadf8fc9c831c48856fbc67dc697277fde2c15a1b3871cb983015c50065e92dd1344bc2b731c1f25cd5862f8208b1908bb9832879fdaae57ae4130d6440eb97ecbc0f74bdc9fa5c4bb706460d04b4d4fffb5eec20fee0f0df440e2cdcd0"], 0x1200e) 19:09:17 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(0xffffffffffffffff, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:17 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) [ 756.897613][T24074] IPVS: ftp: loaded support on port[0] = 21 [ 757.576923][T24050] chnl_net:caif_netlink_parms(): no params data found [ 757.773718][T24050] bridge0: port 1(bridge_slave_0) entered blocking state [ 757.782080][T24050] bridge0: port 1(bridge_slave_0) entered disabled state [ 757.793876][T24050] device bridge_slave_0 entered promiscuous mode [ 757.819180][T24050] bridge0: port 2(bridge_slave_1) entered blocking state [ 757.826574][T24050] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.838125][T24050] device bridge_slave_1 entered promiscuous mode [ 757.994643][T24074] chnl_net:caif_netlink_parms(): no params data found [ 758.008042][T24050] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 758.157007][T24050] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 758.339499][T24050] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 758.347551][T24050] team0: Port device team_slave_0 added [ 758.360412][T24074] bridge0: port 1(bridge_slave_0) entered blocking state [ 758.367591][T24074] bridge0: port 1(bridge_slave_0) entered disabled state [ 758.376470][T24074] device bridge_slave_0 entered promiscuous mode [ 758.385025][T24050] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 758.394055][T24050] team0: Port device team_slave_1 added [ 758.400860][T24050] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 758.408850][T24074] bridge0: port 2(bridge_slave_1) entered blocking state [ 758.416533][T24074] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.425006][T24074] device bridge_slave_1 entered promiscuous mode [ 758.569529][T24050] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 758.597966][T24074] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 758.607130][T22041] device bridge_slave_1 left promiscuous mode [ 758.615988][T22041] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.660831][T22041] device bridge_slave_0 left promiscuous mode [ 758.667078][T22041] bridge0: port 1(bridge_slave_0) entered disabled state [ 762.602979][T22041] device hsr_slave_1 left promiscuous mode [ 762.655923][T22041] device hsr_slave_0 left promiscuous mode [ 762.703796][T22041] team0 (unregistering): Port device team_slave_1 removed [ 762.718222][T22041] team0 (unregistering): Port device team_slave_0 removed [ 762.731092][T22041] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 762.784762][T22041] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 762.896051][T22041] bond0 (unregistering): Released all slaves [ 763.076014][T24074] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 763.162816][T24050] device hsr_slave_0 entered promiscuous mode [ 763.199848][T24050] device hsr_slave_1 entered promiscuous mode [ 763.246297][T24050] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 763.254381][T24050] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 763.262916][T24074] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 763.271093][T24074] team0: Port device team_slave_0 added [ 763.277478][T24074] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 763.286050][T24074] team0: Port device team_slave_1 added [ 763.292428][T24074] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 763.303562][T24074] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 763.338621][T24050] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 763.402543][T24074] device hsr_slave_0 entered promiscuous mode [ 763.459859][T24074] device hsr_slave_1 entered promiscuous mode [ 763.520029][T24074] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 763.529935][T24074] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 763.549831][T24074] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 763.688704][T24050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 763.706320][T24074] 8021q: adding VLAN 0 to HW filter on device bond0 [ 763.717641][T24050] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 763.728867][T24074] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 763.741071][T24050] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 763.753479][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 763.761638][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 763.773402][T24074] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 763.783952][T24050] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 763.792089][T24050] 8021q: adding VLAN 0 to HW filter on device team0 [ 763.799608][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 763.807533][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 763.819714][T24074] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 763.826517][T24074] 8021q: adding VLAN 0 to HW filter on device team0 [ 763.837527][T24050] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 763.847022][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 763.856886][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 763.865849][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.872992][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 763.884413][T24074] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 763.895723][T24050] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 763.904641][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 763.913671][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 763.923094][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 763.932439][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.939579][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 763.948348][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 763.957533][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 763.966620][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 763.973771][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 763.985603][T24074] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 764.002044][T24050] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 764.015820][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 764.025839][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 764.035233][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 764.044298][ T8049] bridge0: port 2(bridge_slave_1) entered blocking state [ 764.051433][ T8049] bridge0: port 2(bridge_slave_1) entered forwarding state [ 764.069393][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 764.081747][T24074] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 764.097511][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 764.108904][T24050] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 764.125831][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 764.142974][T24074] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 764.157108][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 764.168033][T24050] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 764.177871][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 764.187538][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 764.198959][T24050] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 764.209951][T24074] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 764.217654][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 764.226887][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 764.236784][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 764.246314][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 764.255821][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 764.265559][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 764.280048][T24050] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 764.287959][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 764.297448][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 764.308160][T24074] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 764.327567][T24050] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 764.335805][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 764.354770][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 764.367846][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 764.386175][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 764.406134][T24074] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 764.418976][T24050] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 764.434344][T24050] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 764.445451][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 764.463284][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 764.483210][T24074] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 764.504063][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 764.517479][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 764.540397][T24074] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 764.547212][T24074] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 764.570761][T24050] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 764.585041][T24074] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 764.597709][T24050] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 764.622867][T24074] 8021q: adding VLAN 0 to HW filter on device batadv0 19:09:25 executing program 2: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:25 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:25 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(0xffffffffffffffff, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:25 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xce020000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:25 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040), 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:25 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="ffaab3fc4c13b6a468084f155e097fb1257bc021ca1589f74e2c7efdefd284ea82e4ded64a1fe0bdc33fa6591d395d061127df435619678ca45714ef4e231cc0997ef28cf1d8856925122ba450fa69ec16ec6f6bb7096783f6bf2f01a875f3fa038e74b43632402cb3d7ff9bc772898c658e7a26500d07e5"], 0x1200e) 19:09:25 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000040)=0x6) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x0, 0x2) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x400000, 0x0) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000100)=&(0x7f0000000040)) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:26 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) ioctl$PPPIOCSNPMODE(r2, 0x4008744b, &(0x7f00000001c0)={0xfd, 0x1}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) recvfrom$netrom(r3, &(0x7f0000000000)=""/122, 0x7a, 0x10002, &(0x7f0000000100)={{0x3, @default, 0x7}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x800000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:26 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:26 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:27 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = add_key(&(0x7f00000001c0)='.dead\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000380)="a147feee127e94c98f561f26d380581f507a81f554ef4de6593856082f2ee19efcb5c43ead3d1bf117432b9ee007c788c99ca3f6ba758bf07653a755bbf0e73f3aa0ac106d04f53a4c65198b806c5747a0df456c94f7bdf979aadf722e24a8c830dab948d611e5fbd316f67633aaabab5eb4b56d1404ee057bb6d32587a1475118dc71991417cfaad024ad6e2948ad63202df06edf7aa6b7d12919bb8d5c485762a159cc95a1", 0xa6, 0xffffffffffffffff) r4 = syz_open_dev$media(&(0x7f0000000a80)='/dev/media#\x00', 0xfff, 0x400000) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) add_key(&(0x7f0000000440)='big_key\x00', &(0x7f00000002c0), &(0x7f0000000700)="328901b371c0de9ca6703a4b35b03590036371aee7ad761366e69907b30d7a72eeb0953c2a3392676f12727bb5492bd918db75766bd558d9166dd1f4b77983a582cacfb3f8a9c6333e14a4d09ae02b7f6c4dfb64374b1990bba8d3ac398d5f25b03340c9a5121489cbd8e52a2e8ee9cb22b53991bcd99953086082fb340564fd86b7cb4419eab4791a652abf121d6a9aa12d36511b578ad995e7a3be3fd5681f99fa6984b572b5269265822ed3fea8a86617589663f99f7191e4b0800912d75c59b339794a82eb8ebe0cbb9f2c38338ef64a7c38082e31acd5fadeaa19f9d067e1566798403f5c9556b399365ed28ba53440c723abc14a987d44b2b06024683d9d8e9f41ac68d3c5e6e1e2f2d9b81f8e3df166ff60f00c5364377ede855b3b038ae507482b0c0fb1ef1e7c2a91065b1c80c23784b756b037776355a61083f05f58d0530f57c56ac6d2207f06299c0dd773fffa7b78b1a0be25b30c2af692fb5c5904330273868b5bafcf4addef20ca44ea479fe02af896c28e45053dc37b9e2dc3f9dbd59988a7ea85d3a954f4fc97b3feb1ceb901cf9f7383ac36cd51849975a450bd7621cc968694853cd02fed04813bf38cb083ec9cbc39184bc6093d6bd790b3fd59cadc01aefb21908487dee1081012e13e45b9c9dd08f8fe650a20a9623f86c79304d3eb5813327a9c4ff7f6c8be9a451117ed", 0xffffffffffffffbf, r3) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000600)) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f0000000580)={0xa, 0x1000, {0x57, 0x1, 0x8, {0x6, 0x5}, {0x2, 0x8}, @cond=[{0x8f2, 0x8, 0x1, 0xffe00, 0x1f, 0x80}, {0x9, 0x7, 0x7fffffff, 0xfffffffffffffffd, 0x1, 0x80000001}]}, {0x55, 0x4, 0x1, {0x200, 0x9}, {0xea3, 0x5}, @period={0x0, 0x0, 0x5, 0x1000, 0x88, {0x9297, 0x200, 0x1, 0x1ff}, 0x5, &(0x7f0000000200)=[0x5, 0x1000, 0x80000000, 0x57f, 0x4]}}}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r5, &(0x7f0000000100)=ANY=[@ANYBLOB="73797a310b7baa59e5081adb9d7d044936c488b2c069e64f5df8e95acaa4aa6a795a43cb53657102365a30a49748c3632f12296fa7a11202f9dede55f6d19356259cea9dc14df6f0164097678319313872faced2e8d368c55e762ea2938771308c5f1761568c3b"], 0x1200e) 19:09:27 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:27 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000180)=@llc, &(0x7f0000000080)=0x80, 0x80800) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r2, 0x50, &(0x7f0000000200)}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000002c0)={0xffffffffffffffff}, 0x0, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r3, 0x3, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e20, @local}}}, 0x118) accept4$bt_l2cap(r1, 0x0, &(0x7f0000000040)=0xa8, 0x80800) 19:09:27 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f0000000440)={0xa, 0xfffffffffffffffc, 0x61d1, @local}, 0xfffffffffffffed2) r2 = socket$inet(0x2, 0x807, 0xdcc3) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e24, 0x1, @loopback, 0x7fffffff}}, 0x1000, 0x1ff, 0x6, 0x40, 0x80}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000100)={0x4, 0x0, 0x0, 0x3, 0x1f, 0x2, 0x9, 0x1ff, r3}, &(0x7f0000000140)=0x20) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000000)={'syz0'}, 0x4) 19:09:27 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, 0x0, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:27 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:27 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:27 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:27 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x100, 0x0) write$9p(r2, &(0x7f0000000380)="9e22283da8897b11ea9f1560cf59df321a33d208abdf83504f5b4589098f0da121bede4313106f81db8c5c327948fbc9336ffc6cdfec7662028ff2d3d9294f71d84a44cb3384997ad215698441a4c7164e096065d49c30afa2bd5666c17b6902eefc15f6a9a53be993eb362d5c84634d4069f2f007a0e42d96261f5aa38bdbf7a1ea5d4e878897d75c0909d1e7667c2bbe8c996843e4ed", 0x97) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:28 executing program 2: r0 = getpgid(0x0) ioprio_get$pid(0x2, r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:28 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:28 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(0x0, &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:28 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000380)={0x0, @reserved}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="d28801448ecef60e0ea0e4e250c7d8c234486760590256ffda89b1e28bb1aafb533336f93ec6e92bc0c3b2ba6699be2ae723f4e3806cfa1c1a47e421cc926614"], 0x1200e) 19:09:28 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:28 executing program 2: r0 = getpgid(0x0) ioprio_get$pid(0x2, r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:28 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', 0x0, &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x820400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:29 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x100) write$P9_RGETLOCK(r1, 0x0, 0x2d) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:29 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6400000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:29 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', 0x0, &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:29 executing program 2: r0 = getpgid(0x0) ioprio_get$pid(0x2, r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(0xffffffffffffffff) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000140)={0x2, 0x3}) sched_setscheduler(0x0, 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) 19:09:29 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:29 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='pids.events\x00', 0x0, 0x0) ioctl$CAPI_GET_ERRCODE(r0, 0x80024321, &(0x7f00000001c0)) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$RTC_AIE_OFF(r0, 0x7002) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) accept4(r2, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000100)=0x80, 0x80800) r3 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r3, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000300)={0x3, r0}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:29 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), 0x0, 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:30 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xb77, 0xa0c1) r4 = dup3(r0, r1, 0x80000) r5 = openat$cgroup_type(r4, &(0x7f0000000140)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) flistxattr(r5, &(0x7f0000000580)=""/208, 0xd0) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r3, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000100)=0x68) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$SIOCRSACCEPT(r2, 0x89e3) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r7, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r6, &(0x7f0000000300)=ANY=[@ANYBLOB="738c9c704a1cdc797a31"], 0xfffffffffffffce2) 19:09:30 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000380)={0x0, @reserved}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="d28801448ecef60e0ea0e4e250c7d8c234486760590256ffda89b1e28bb1aafb533336f93ec6e92bc0c3b2ba6699be2ae723f4e3806cfa1c1a47e421cc926614"], 0x1200e) 19:09:30 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x0) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:30 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000100)=@v2={0x2000000, [{0x200, 0xffffffffffffffff}, {0x3ff, 0xcc}]}, 0x14, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:30 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r1, 0xc0045871) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000040)=0xc) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:30 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xce02000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:30 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000380)={0x0, @reserved}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="d28801448ecef60e0ea0e4e250c7d8c234486760590256ffda89b1e28bb1aafb533336f93ec6e92bc0c3b2ba6699be2ae723f4e3806cfa1c1a47e421cc926614"], 0x1200e) 19:09:30 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:30 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r2 = getpgrp(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f0000000000)={0xffffffffffffff81}) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x20000, 0x0) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000100)={'bond0\x00'}) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) rt_sigreturn() setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:30 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x301000, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) ioctl(r0, 0x9, &(0x7f0000000380)="e93aaeee191e0a6b51c4b7d37e068c75c8d6057528118952d5db30dd704fe990f66c1cd63ad87b5eca434ae2e3f71528307d21de54221a496204cf5a0786cdc8954ee3a8d597bf07b51009ca00d0cf2dc65eafe4f5e05192427add31b1aede107ed93ad57b8a158d88c9d0e55553267b442861aa1765fe6e80343f7696f32e665201dd2374d6e4d0c4bb6d74442e233731944a16243fb7dda2820b37d6106e8b881ea3c76e5b6482ea636462ff4eab4179ea7bf67cd151675132b1386e652d32ab30bcddf9471993b5b00f13f54b25a8ceaa58c54996546610252f973b4cef272de7b0c7c04fc96b0963d71430c55f95ae0e2501057fe30ce159c5") connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) ftruncate(r0, 0x1) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="73797a31b7e2ce672277c62fa1ef12c348"], 0x1200e) 19:09:31 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000380)={0x0, @reserved}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="d28801448ecef60e0ea0e4e250c7d8c234486760590256ffda89b1e28bb1aafb533336f93ec6e92bc0c3b2ba6699be2ae723f4e3806cfa1c1a47e421cc926614"], 0x1200e) 19:09:31 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:31 executing program 0: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x1, 0x4000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x250000, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) fremovexattr(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="7436ab7f642e2f6465762f70100000000058ef2127"]) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:31 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(0xffffffffffffffff, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:32 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @dev, 0x1}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:32 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:32 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x14}, 0x9}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:33 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:33 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, 0x0, 0x0) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:33 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x64}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:33 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:33 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x0, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:33 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:33 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x200180, 0x0) write$FUSE_STATFS(r2, &(0x7f0000000380)={0x60, 0xfffffffffffffff5, 0x2, {{0x1, 0x979, 0x2, 0xfffffffffffff4ce, 0x65cc, 0x9, 0x80, 0xfffffffffffffffa}}}, 0x60) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)=ANY=[@ANYBLOB='ryz1'], 0x1200e) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U-', 0x4}, 0x28, 0x3) 19:09:34 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x14}, 0x9}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:34 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r3 = dup3(r1, r0, 0x80000) openat$cgroup_subtree(r3, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r1, 0x5450) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) ioctl$LOOP_SET_FD(r4, 0x4c00, r2) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2, 0x2013, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x2ce}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:34 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x14}, 0x9}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:34 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x880, 0x0) openat$cgroup_type(r2, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x30842) r3 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x9, 0x400000) connect$l2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @empty}, 0x3, 0x2, 0x0, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000140)=0x1000, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:35 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:35 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x0, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:35 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000000)=0x105, 0xfffffffffffffe28) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) 19:09:35 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:35 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:35 executing program 4: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x1, 0x4000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x250000, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) fremovexattr(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="7436ab7f642e2f6465762f70100000000058ef2127"]) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:35 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="73797a3133e031701740024764a645c44bf35e4ec62f0bdcdce57ea42bf4a0033210d5b29776a0aa82"], 0x1200e) 19:09:35 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x2001244e) 19:09:35 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:36 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:36 executing program 4: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x1, 0x4000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x250000, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) fremovexattr(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="7436ab7f642e2f6465762f70100000000058ef2127"]) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:36 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000000)={0x1, 0x5, 0x40, 0x6, 0xffffffff}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="ab8d1c6b9c6746b6c826b62a775bd42a178ef25a47a16fcd1de4332e7be38799ca83982c32d3beba2dee681f24de21a8e9bd05008e21d1fb23b8a190f48c989feaca240ed967ad2ea537"], 0x1200e) 19:09:36 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6400}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:36 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:36 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:37 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="73797a3133e031701740024764a645c44bf35e4ec62f0bdcdce57ea42bf4a0033210d5b29776a0aa82"], 0x1200e) 19:09:37 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:37 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000040)=""/25) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:37 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="73797a3133e031701740024764a645c44bf35e4ec62f0bdcdce57ea42bf4a0033210d5b29776a0aa82"], 0x1200e) 19:09:37 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:37 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:38 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xce02}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:38 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) r4 = dup3(r3, r1, 0x80000) ioctl$CAPI_CLR_FLAGS(r4, 0x80044325, &(0x7f0000000040)=0x1) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(r1, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000100)={0x8, 0x1ff, {0x55, 0xffffffffffff8001, 0x5d3d, {0xb4d8cc6, 0x100000000}, {0x1f, 0x10001}, @period={0x5b, 0x7ff, 0x16, 0x783c775c, 0x81, {0x1, 0x80000001, 0xb4, 0x3ff}, 0x5, &(0x7f0000000000)=[0x7, 0x2, 0x8, 0xac, 0x2]}}, {0x53, 0x9, 0x3, {0x5, 0x7fffffff}, {0x9, 0x6}, @cond=[{0x4, 0x3ed, 0x7f, 0x1f, 0x4c, 0x7fff}, {0x6, 0x3, 0x1f, 0x100000000, 0x1396, 0x3}]}}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r5, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0x4) 19:09:38 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:38 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r5, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r7, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r7, @ANYRESHEX=r0, @ANYRES32=r3, @ANYRESOCT=r6], 0xfec0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r8, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r9, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:38 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:38 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2000, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000100)) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) ioctl$PPPIOCSMRU1(r0, 0x40047452, &(0x7f0000000140)=0xfffffffffffffffe) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x501, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCNXCL(r0, 0x540d) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="33742152b3839fc974bd547a4fc58b537612c749dd2b2859e46d0fa9b014bf4d09df327341f20bc450d06d1ee9778314d7ab015ca9ab7f9946249ddc2191753007da93915123cf972d7cf0b12a6687f0f2bcee5d89ef4f75d8e828a24f43435ab2985814f8263b72cb3a497847756c12650f73bc7b5854c03edffd1ef3f9d315c301cd85f81503cef5733a2982dd02ac3dec0797204451e4ce19b024563a560d8921e33b"], 0x1200e) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x2000000303003, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r4, 0xc0405665, &(0x7f0000000040)={0x2, 0x2, 0x7fffffff, 0x1000, 0x400, 0xfffffffffffffff7, 0xc}) 19:09:38 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:38 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:38 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:38 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="c8090e55618025e341c0912000d660407a821473f4da31"], 0x1200e) 19:09:39 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:39 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:39 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:39 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000003380)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="23540c3ab5a27432b1208dcd914dba346e6ae6d8bd82b0b0243ba58bf89497ec8578f7d6635f605974b8a33d8041e811", 0x30}], 0x1}, 0x1}, {{&(0x7f0000000100)=@ethernet={0x306, @dev={[], 0xa}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000380)="ecd5e81d66908fb1525de8aa1a4dba2b72a74394c189065e47daac4d3bebdad4e91c7f4f0052926c4ba2a64b83e39baaec6e80fc85735b8bea9f3a9952b00d1558057cba56610b7cf8d971200d6ff34079bad8e9a13215eb3d0a1e5554719b6767310c76f255ade59881213c2845ad73c2ddb6a109dcdacba1b54fa233f2460e587f051e1c1bac65964819eae845173bf7c21a920c", 0x95}, {&(0x7f0000000580)="5bb7df1f3fac2098f678cdb6e6517b0a890bf502ef335d6b5ec878f5f766a2d286d5af152648f2ff5ac5e43be2e1814623a4673192255c18a87dc04d3b18be5db95cb0a5aa53ff687f003d90ecace5acb469a19ea8d9a0ea24b5a28fb4a48ddc0d6fda47fddcdd73d19dd7a4025b03f9b627435df5d235ae979813d525feb0d402362c015b3ea3f4817f306478fd9b8def373e20b6b0fd8ff044658116cc88a7be74f8c8430986deb6a1b194f54c8ca55cb23c50c0136c8899089e709ee4016e0aacfd560802f9f083d1290c2fb518adf61df5b11c9df4fb7d8e50f3181c5260181b24990cac", 0xe6}, {&(0x7f0000000680)="f1df825332cb3c67c0fea9f993c2f5e912c6364a04756b43430a0d0fb3deed1eed42bf8cf6980d7ffa0de7f1a712aff69f193d9084595ffc2792d24ea1d0ab8920202434d88c861447660aa5fca932d004c0ad34c3d801eb503731fa0891ccbc28c3e4c1f74a1c586b8cb3152e8a292b55b41bca042a2c51e5ebb6129db3548b6eacac87dcabc945fef847196ac2725031ec27d425b010346bc9b88fa7f3c27c29e6cd0a936897acbfb9dcb27f7a49807914c751fe75936453969f792a68a0cc70854d939a8638432673", 0xca}, {&(0x7f0000000780)="070ef259d6879fd9ffe5f3466ee40391a9585e822605002e9653cbf35617a3c22d6b97c766ea9536145f88a26b319df671dd18fdde5045aa899d02bf67a77ca85752ea4bee65f5aebdb5dca25a505907a81bfa66cd1c9755806e44b563177c03f357a7f6d6e4f2a1e2d5189e4f62588c0f7ae003150b933d6af1e01e63ba17fc1493893fc129000ea42d3b63ea9afdeb0a01b2d523ddc8e1296e49053b1f761143888ed6bacf5213dda5d4388bcc5f35c781a2f80b9a6d460eb43746e8", 0xbd}], 0x4, &(0x7f0000000840)=[{0xc0, 0x118, 0x6, "329ef5141e8f0b6a1c38356dce08566bd3b49b9d5cddebc09b403c7621e6c9f122f45d65632fb1e8f94abe0a017436aa29fc06f13f781a158d566eff3af1207694a71e6e71938f30d8abc9fed8e2a3d3b60c37a364b7384041f171584b03b102988af7f4b15647b7aeebc72bdfe731c30396c7c321e19a8561227d7ff41dce524712fb88aab103870ef49be0e3b18154196818f31a64c590422399d66b0098c48b1a410b6c1976f37729d0020599"}, {0xa0, 0x0, 0x8001, "0930f62d28e59e830d05b770677d78df8468c1155ccc4b0cee3a0ce32dbfe0f314780c6ee23e4c6db154124ad355ff6275d19646c5ea215da0e21f7c7471e4be20bb369b1fc6a50bdcca19377cba1b92323c27987c9fb0c3790500b91a393e3a21f8e2a192e0575724ebcd98656fb77cc40321371931e5498d81107a92bada144efedad5059f62fb0fe8bc04"}, {0x28, 0x118, 0x3, "9deabc93a06687db5502810a97f0d3fe92b40722d5ef"}, {0x78, 0x113, 0x6, "de6c49af5843d4a731d0913828ff8e7cde5dc428562d663c4c4a3b51d2a8ca128fa306966e85b23a68b8117967cb2280bcb166485fd6fdf6ac0d1deec4499ed79996ec8f7e7159af2f46e18a3e8fbb973cad6ad77b5f3fec62712aa08ae7813cd8b1"}, {0x98, 0x11f, 0x401, "28af488b66ebd5dadb5ae195a3c362ac9022156b8f4dc6aca6584cb688e7a7c039fcef45770983ecc5c135c6c9d989b7862940853133914da4d1f46628a621ccec27639ffda4253af01045d6ab82bb4fa15c5f0b44aaa9f746537ed2734bf7d7ba82194d70b05a3c7c0d5a98471b14539942f8c4a674e53e8aa35fa62eb1c5cf89"}, {0x78, 0x112, 0x8000, "f9296a6668a3c032cd1ecc463af8e0f9252bd08e3d0dbea704581ac9dbf6320003b38986c12e486cdf5661d792c0d1e2bc330637aeb5ddf645ca9891bc4265a405238f67727f023ab42eec4e0f5f1c95a2899c2f77877323aff6e6f5cc51696fa3c8ffb100"}], 0x310}, 0x8}, {{0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000300)="dc9f0a2af8959bcb1e", 0x9}, {&(0x7f0000000b80)="cdc5fe0b567f381833e940a262ef2b7b17fd75304c953c87edc6d22d818505403dd5775a514f923780b3474c5b45c39110f5f6b863eeaf770dc58ce1b1ecafac71d20d9309c2f4f22dbb273447cdbc85194f681db3b8e9cf2801f56eaade99a90b6d18e9c4985d6d55779ca195c1e294185c3844f6b80dc11f30645c2f4160907770c7caf823ce6289498eb360d92ed18093339a19f8da80c18a547058973cd648", 0xa1}], 0x2, &(0x7f0000000c80)=[{0x50, 0x117, 0x5, "3abe332e18d9d00705a2158596aaeb4d480bc502d294db59f95a1dc3ca4e1b65d29bcd1a9b543338a298d8978a486e35465e29a8b9e69e7f74"}, {0x1010, 0x113, 0x5, "871e1dcce0e64d008d28072d057bcd6ac239a6f4e91c6b4311c1671b4e068717481a3590218b12309e6093bf3e980ffd4969dc471308e62c29176c382bddb1cce6cb7c6433f18dfdfd0ffb128638beb7ee329adc78f53ca0321850393915cbac7f0f9c45da4acddb751add03b29a32a297607330fdc0771a95604a1660fef7a5455063b9ce71ac401ea75167e2199e45ce5ada92fe0ed041c5474971e98e63d3ae3549642df39e449b4fb0ac2eb105ff69c191d909459cb329221eea60b40240341c9c88108d64092ecb9c350c8fe994fab03b737217231af6afc78e6f91c12e4950a5323b0a0abe29a775710d11f8180d07d113ba2c620cfe413a4a7b3c5312a564a199dfc4aa449d105a46635f726f49621550cce399d7874f57509ae4d22f4255fa77d7a54f727abf76441293d11fa8055d9a3427afa29811df95faf3c7fb4c58c9f9dcb591835ca19edf5cdad397c1b31de6d4d6ba8daefdae3993a7c0a68b3a51a3b917006699c7b41c58984c6c79450ea89b5982e60f5f5b7f66a2c6adba94d5a47d93fdff085c327898e60338e31ac7bd0b1e04e3c0d1ee9dc227dc3055c35093f6edbd474f8ad42a22d53d0f448042dd6eefe791725676e4f4fc6d8a19b82aae8cc12e6bdc2a178d943f4eab4ba135854da9ebd15ea5683ecbce717ead57e880692a25e439261324beb0f252a5b9176f2a5ed86d48723629d2e63fca99a13a6b2cb206e3ce8995aaa21278295bafa2bbb2f21bbc5eb9cf787f9d1ea59e623ce658d286af5c1ef9429de2f0973114e9d6d0d0ff6d35450d91aae52f9e3a445991d3d6bf8739225a4ecb4052f1a4053f687850c464d0e55cfaf9b15b5bb6df7ffecc22d648b6b62bb3b5611283df312f3abf245a112800e20222dfaf9587afd52f33ad892146a21e9917759f101796dce9ad64c0271675955d5549b2ea045f7ffaaf991b01f3bce475d680dfca63f0a0c888328def609fc40d3fee82bd1fe1c51c283bcb5dab4f59297f269e05eb8ce9276f03dcc4cb2740788b8ce593fbae5b04f7fae90978b00c4a576a1440d888e9e78e396cea2c8298fcb22283a087ee1e4563c9a374bcf81f64dad7e6a98b2b7a44b0c8652f05ec74f65fa452ac46f738b34916fc4988fbefdc0869311956d9d5affe7bec7c5f24ad68d35f1039e8d64625e0db8f2914abb71ba2a2fd3da50b5713bd35e3bec8736cd58b1e52f755469f1f2d239562742a2cc05a6b21a5becc2f4be266f95e970d07c598879154d8daa806e00f96d5d09e45f496f3ff589ae44a0957e34f22322638198cdf70eb69e18fb99f3fe81dc8b554f13829e1749d214654d16a27caffa1f5781d96266a05b49359df899927b714bb1ca58c5afb022d896075aa21dabc06cfbfcb45d45999c13167bb6d02e520fd9fd95e8ec5c9aec36c6722fcddaadb674dcf72339a6a03281be0d54b81bc7500acbad2ef31c820c9cc8c344a5a16ca33dd13614761ff62b6d90705df34425a1c790835ae4f9e4e7b7d855c34e75aeef039bbaa79e7de703e593fda236026a373486b19c5b1b6f3ff467184b949d79c4ad48901e26d97dee07783c5c318b1475e1e0ee70348ada6f702511148dff41b44a3ac5d7811bf07fab2881e6816557c904fa4a8881fc269c2b079d7df7dcc1bde30efd9c591399cf4751de0166b89448c750359ded015f1a849080a64a3b80225af4da3938497531d201376a8b2dd802b55abda2f19069b34ee537e3a9ac1279a17defc5521e1abd75cbd0effcc687cdba0e6356a56ecef76aadecb7c94195ab55bf5221178c9282ebd1b013efdd166bfdd235051fefd5aa4f1a412633be15b390eeca854ad51aae5e6f4c7ffa80665245d5d3aff4d4d8c4bde490ae2a3ff699b9504951b414b4daa7f747f463d600bfb3b9025beb9bf665a25e878470e8ca83b70fb8d9d6539a51144a93a272d06d0bcafae61e88cf8c25925284c2bf31e9ebb557eb33ab08ea5deaa4b680d9167ef0b20ab158f916799ddaab0040ae4767a29f92304b9c20799afe7905566099277d3f9d292d7023744f3073353c4d433fdb0610022acd6265b90c7762b9fc618e32fe50ab9c4384264836802796f0649ea88f1ee326b84f1e1443bce63150f6b5f6c8eaed1fbadbcc6f5e1b3a15e21fe8eb4f42cc6a656bfcd7f2f4a1db4995cceaea7941e038516eb6f828f852808fd725c38faba77bb04b2eefdd02dab8af2f61755b4780350af7e34465c9fe9da650c34e428a30f58e60ebdb399b60dc7c4fd0974f3935ae4f00eb912a2705df119c758caaec4c028bde8823afa34f903838d55f643ebbf668602719e79f4943df739add010f6c2e7eeaf9c602a07806d4e3a17c48a2c03d9fe0a226407804f68805828c6cb25fc6e02a6f31c84d4643187e9c29512e9b670b506e0206b4a9e3da6dd4b5dfbb5ff6fe118bc76cdf76c751c921bbf49036a5a7c1d5de2d9bf0b93e25c87db4282cb83403d160c876a90c583da3a2c9a76512eedb391bd12aee0e12a4a8f5c6873633449b03c13c2ca0ce7668b04b74e0b97bb4767168839aec16c9c817efc4a28a39bd9330b82f83737068928c8071229d47d5639a0427c0bc76cb18d0ef5510999e5fc86dbf2545b6b515640ac1b1993f9fb485db99c7e164b26217959ff97050c230d1eccd413e06e2e58d8a47c1affc3be8361d9264c5d6fdb5ebc9b419f979810106ce86565799c9aa31b960a0a10430f733a8de66b0dab80d7eacf1c59a66e4e26a98a97e34dbdb0737b94b9ec89dfbcd55dccdb94cbe2f1d9c359be22af4fef15c74b8a5b9277a40d628cf9bee441f8323a3de4c3f9eb8a14d7e7997384b4f9ff5bc8a84ae6517383ed7c33f1d114331d1de7c710924f063facd45d31533959c89c9b221379b87258fe4462ef40769b793db87067869e40e416ed04d9fae1bd16d72f8db3d975d950cb6688b60e61e5005c9c0dfc683e81f11119b63a7dadc65f9b746fa5911a33cc1e1bbcc74db755abf1688f93b27d6ae00b35d9e2bfe9b8c8c88c04ba32afa7f5d021ee1e9a8a230e7ca05b5a3ce96ba1b4109f3791bbc770715fa954f8e862d276124fb9a2e8478f45b245044f5301a7d8ffbfae1a692a1e31ed279d78d46f7ee05ec3b0b38a5e5ddfbb2c08413ed677cc46427dacb29ca45797c70f8ecf657e2fb99ca9e216d5f28665c57fefd06fdebb339def81cb30a7ce9b68eb436639c52b9c72c6765db20322c0cf289a4ed1cbacb44859ee3f17d9103a6b9b74c3d7f00242e747e7c3ee60a8bd066cb1b75e4fa45b3f18eeaf57b435b48567d3fcbad200d6360844545edb74b9084cbf6d5736d8a7a90b8192a123176823788c2ec15c2b3eb32c8cab9b79f059871d8572457d5b7b84302a810006e8042a599f99e3f6e4c283e5797b3020df50c6b27c9f4c2973cc6b16c13663561afe98939242729369bc22c90b0f120110b3dbb41c6599efe06b64595387e4ce6a3706a170a1aa4254f41952a715b287d7ce6c3de89ff6e9d8dff6c8bcd7977c2ab4ce0d766f96af1c486042416a36fe7d7ee4257f6a2e221a70583441f32641dbeccb3e1b8a738a75c63dae32903f6a35b5077597c43e239548f51834c5835b8db9a31de64ac24d6065a0d238aa1474a5ebcf377e659c9a49c1659796d7d9b5ab331999e356c5c1dc9d192359e7e192f219777e525e1092ba994ababc3d54baa31d03ef9d32f045b30c987b20b5afbf0ade79b5c8936e6e3089700766e5733715126c00d5f8cb43c1be6ac5a6c6fb3dbe586cb1f8df7efae3e99c7ec7369208506d04a02855f01890fc837977a736c0f327fa01d1143484ac1ff6a077d16ead757f586dcf4f31b80b9d32b110a933d637f9cbb91eda81b5782ed6d93b60de7a14db899fec8f95c60ac6fd9153dfe6131c860e0bf6e1114bc0bb7ff1fd09daa75e27d2dc0de13ca434692afa1d89826bf420f01a921d314c8a347458175caf70585c52804a06421e8258f8a9a392236217bac1e55cbdc28e93a2e34c84d44f6c0c6dfb5d06e3e4cc53e66a47ad6cc9601b71b20869523580f47a8d9aef8a8fb02e5b05bbe58c233c2f2d60c0176f41767a73459d3e6ffd9dfafb6587bb378fbff9767aed79a08371b017d157cb54451cf51b7e1eb734486f9e01d65974fe7b30f243c03fadb3b27ed11af1e1d2251106c258b9c30d808cc9c03908050c19ca4d2916a0872f93705fc3604c824c124b5e06fd9ddedf15cc8c3390cd5d3311af1bdb61536a5302d06678fc134f546c80becbda8e053f39b9089376dcbfc7b7360012b519a04d69757a08e3848b01100aeb5b39dcee42a6d11d0f99c37e820257eda3fac160bc3c608640a4871c6dcae4863ec5993a1f40f01afe7821b5813a0f4d16e5c73855f36dded7f4e424b7bbd3cceaf0927ac83405fe3dac1bac3bd3aea44ce6b0ce93ddddaa473229bf2b2ef5c46535d19c7f23b0b984244594869bcbcf301e912ce800bc5e029bcd9d31d0ac35abc8adf853153acd3215ae672fa40af14f0eb562757cf5250db825304056916d4a69c2129ebe466d181bd4ae1e27e0b523c64757f5fec53fd558b528babbd8d42ca2cc681a9d01a1e93367b267c04a607173fe72d7ab598e4b9d5574242e4f6d7447134c4ad1fdb34f147ada86e674d02bcf7ab65b3051490516ef5466fe7729280db7ebb482ed229afe84fc5c70bd806bb4a6ab3d735fddbb424ad427b5d88ee66eb4e03b3df2d9b4167dc27c4c45f862c76486cab406fbe1fc097494674e2cd325f1bd1a663e2d9a57e6e22d926231f4bdcd9f5c05d83a6867a63835bd3fa2c43d0142ecc52a68dfbb8a401cda9f4d20b8b51ba3c24233117dcee927a9fde289f203edeaaa8f5000e6e75272803cb8a2a726b4dc37e28eb39c5d5bd4f804266202171fb5aafde99f9a5214bacf07bfc85024a79fc2fa759a78dcec1d609d5a28696486c6f39bc03a3ae07060497bd14aa79045089d0fb2b8ba8b3207addc3f7cf091b6a71f1bf78f21f6ca729f5f41b13487c0fffd4fcfce41f54d0097ed3729e5938837e7f911820d1bfc6d304ca140c894e67e25e1b182e681d00ea7cec47d089386c10a00926d889f7ee5d6d1b3f03ad907e30ba36ad5c866d22ffc0a10d2f0cda4c083bd9a71bdbbd12ccb6761e2edc63e268fe046111fe2e7f2387dbe6bd0ab0f462e23e8d42be6293b8dabe39d869ebd7f4c4b6a0d66d7f80b0060de13baf2d55b94dd40ac33324f2437f714c7502a58e057896644e50b9f0d454d27a83422eee9e2361f3acf49992f829c510c12d0abfd9255441cc85a7d43af946df59aeca3cb507b7f9ae00d6387e82fcd79ba964c8683519e5b08d712400c7e279af89fe35b436a41c86722bad7119e2c4e315206339c4429afb4513720040caaaa7347257e456a68eba3ef1474e14c11fd713c8886fd26ce6a3736d6b8450578430d31ae847fc6cbe4e999e990580840377b7b6a321a984b30c2fdc3ad354446fb038624d9e1bff37e50a3ecb9a3cd35e04da728d411ccc3b0611221d0a3f48f6e99d87ac014b17a45951b3e57b0b8e972127ce982a50bde2a1fff0dde131c91525166d9fb712500818a29544450f8c3a67741bc8a628fbe3cb6a8c6b67363ca39b80e44be1f8524bd2ac83931707641e476d37ff4c11d9e87e1077e576f24618e0e54bc7027fb3400a6097757e3fdb525aab590660d838dfc68c9350c85cab8bf7da780f615d45184435a49927cc420cfc0ad7c1b3ed21ede26c3f6b2dc37002e665107b13086e4c402c90b0628c3d5"}, {0xa0, 0x107, 0x7, "0d74123c757a61f7037b21bd61084aa8962033175020d3533a4c93327f86701ca0966c988430c93222894e12286c268c6f620c77f57a82c4862128b08d34749ea384a6dbf71a73d6de0fcd234fd0cc5d7f521c443458028056a0a2c63461c76529e6267436f105983df482377866c99de5e4b0c70ccc2b5849e59fdbfbc8e85c58514f60cbb4731c013f47fc017cf7"}, {0x78, 0x19e, 0x7f, "9743a012ba71af2ee211908519ae17aaf1ca6d0a420b0252c1e72dcbd309bc91089bd89e1578b8c1106f18801124434e2fc12eb8ed6c049a9209ead588d8807c18378fe2688ee0a46d55f2af965e515d0ded27bff3784f2d4412fe114e9a0675a2ad1f7f0dbb"}, {0xc8, 0x1ff, 0x9, "2f10ae7e87cdbf1869df5ce8a29f5bb149bfb6af7db7d5fae7a82af3b23499e6b682d065bfce77c1ddbe5ead746fb72269c1a743cb8c919b3024891285d1b7d86857fb5cdc369b8e8607a315c45795884289b104d5666eaa1efab1f582ee66acb26d6fcb588dcd683b648d4a1b29f6c210534f312aa5925a4c6bd416fc1e8441195b9bf0130b0aad628e19587886ae42df907ab84a861aac2c5fdf696a2998a1f48e7a08bfb9f5d410c97be9562894a4124e06c645"}, {0x78, 0x102, 0x2, "87b1d40a74b4018ae569f56f60d0cfd44b182f94a75da43943ffc813d8052288e32871a3587befe4eff5a516629db1bc5267ba8275953b7648b796d7f0b850bb632577d9f4baf1f5beae23389dc15da032d791a4935b1f445cc429ef6567c02b72f63bd2ed50d6"}], 0x12b8}, 0xc8d4}, {{0x0, 0x0, &(0x7f0000002180)=[{&(0x7f0000001f40)="45b23bc4a6c964d63744b1f185a890bd86907163c032fe25c146323a5f5b777e9997a4d92f9dc349dca8b55b95c3fe9807e6f41b3a9b48621a739775e490f9196ab53a8fc8d4f057921f7144d5d9715adb32c7cfea0f59bcd7159fb4ef3aabbe365bdb7abf0d6b74bdbb06455fe61b5b10ba7c739289c590df5f89a78dcc6f8bf7325c9eadaf5f9a1e3560d06b97ec66202a85fbef1c", 0x96}, {&(0x7f0000002000)="3c2fdba4b2145171b57e826d3e878d341687d4434d03340df4e7da55ba39c306e7331969421fba026cba52f938b118b45e99e91e3bc33e079dd64ee7cc0e8fb1c8bfd3e4369b1c43eab223769b8f3c3754668a085f69250f7456d33e2cb8d009d4151d218c9a234a5dc4dadf9d182dfd2e48c65f5524880be7605a43b484ff6bf1b398646cdff3b5dc755f8ed828a205767643e8dde2443eb2018335174062a58df175124441b56d02cd9d462e4d7dfb01291a46494fc8912c93f8ed76485f0eb48832ec18a5", 0xc6}, {&(0x7f0000002100)="63ec58fd942a74af7ef7b04c17e159c4e1e21dd5d2c30a45fd8ff764bc81c9bbd87724880bb4f78b11f7175824fc595f6ec02bf8ca8890e045b31f9dc291f87a76f0d006199cb707568b7794c5205c1e170c9bc5b60d3b77f5174efc97894fba2147b9bf25635ba8dcc2937202d9b0d77c84cde38fd9ac", 0x77}], 0x3, &(0x7f00000021c0)=[{0x1010, 0xff, 0xff, "7f0b195070a8eeab501ecdd01c18e5fc5f0b0b9f7eba9c07c7c949b8569c5205bef292b83e8ec5e415132f4cb980f500b5deba81af80e1cbb9c3813017f11aa43d502754d8103e619ae5aa9a2382c776eaffa5a94dd58d713e64820ec6ad257ca723d000e7b1e531928c2122783c23ff38b2c34e31a4c7df947bcdf03ac2524c80a3c0a50edb7cd52b8d5ddb241e57225571a7e9dd5228cab079fe9d1180e11faf6bbfa19253f5fdc468bed613126deb25288e01f58710728eb293ee36941c4f5da701251a8c90f89ec4c04a610029c2f0b157bb45c62252fc7b3899d71a073a74c841bd55fd6957a844cb2db3d07f4f04c3e54f698e03fdf90c0c752a332c7dad0e0c29dd7fdc4ba01d801620b7f8fdf7bc3bf5f423bc401c059c503e5a9f73307592dfe3ccbdd115bbb1230d10d6150ca526ab2281ae80e782cd8146f2320eb51477a39fea4420d25799d017e300aa56050ffa390fac5aa48597ce10bf1203ae3e6630b1ad3eb281b2ba564df365f6867c38ed22744b087cef50fc02165451fc67fa89ad86c850eb7cdb2833ee4752b77157590a7bbb708b0803bd6afd47fa27cce7ebd1bb346c09627b81d328c044c43d5d35b4d795ab6bc6365b1c4260eae72651a8473fd7d804ba458cdcacdc7b5e1130341233318de41527aca35e945337a0304e6c92dd04acc05d1bb7adedca44b9c6d1b5b9baeb21631c42523cdb334690d4dc66c1b2ff56597acca122feb50e8e54c0497b416d431b9471e626d194b4ff13c76c89e8dd9d3b1da9eb0311adafa86baa2edf644720cfddf8dccd353a70b482e83f94838730beff514e2a810cba0e865e93846b371bed88344be21580b5705580a227bafc797255b4e7f6bb720fbadee5ea4eb4057bca6b11f39ff823e81835767ce759611cab3c0a7df8160a30b6e8a90a8f5182136cacf3194e9384a2dfc6306948dc565536a22740317332f9cd7635c05f2d73d08c71412ff9a56867953d44e6990827378ce9ae984041989caa75824c0f1e6b53d1aa804e2ef85c1e1eb73f108f095d1b42f04ccbfa80eac4df8a0ea1945d8e7daa5e6e9c99cc9c36045b5825aab77e54e03a3055bf27005bd491ca64773440b2ea47b061bd725b5d0fb36f4dda73e0310465f57110e9c1460cba598d8fdbe458d5d4f5c4f33e8576f166c0a798370c8bebfc91c85b1c3afd5503eb7742917d943c3429857ba72e1bc73863de70d00b559b04a8ec43e00d3df16549a45f67d70116c2930f8769ece7a19ac1b2a81fc9c12cee7821c9b504c90ec457f72b6740e3e92c83fcb006cb1ea75a88944eaf24d9ac3dc4d71af9e989b1d9ff3f15a381dbed04b2e65234217060fe27e2fe11ae258be2be3594ef2ce5a0825fb832a284178888ebc5ed913eff97332209155f0ae82ff9de6e9680b0ce7677c2bacb0094651fff5b4913f4a8b7acca5cc9d60066f1f82c32975ddd91d993390f2fba5622448a3c5672b5a90e26ad7dd9093b5038fbf876235d3e39d06c8d44c6a37e6858f559b1085305642162765b26eb6b9388a5b6f18ca2b2bd833f3cc21b7a62845970a82e4fcda38f63cad1326aad2942e8d60e09d54c8330b5bc708782df1fdd1427e90debcfbdd8950c50b8d2d28c3c04121fc0ae9720341894534cc8a016ef40989f25cb46570426b94bf703eb7bb398fee23b7aad7dbcc0daa506ee0dff86ca1261e188a7ec9aaf59df327c26fa111df431a2eca9a1c443db4e45e87696048d79919cd65d2db8d8451b16ff461293be2f549206e3dbf7c1f5e8403db25b9772769522132d011a228f94a6e00a972256cb08463f8cbc45ee752de18abbf749d1f2623a5c2c3cc6452617d720a938e18eaf2e39d496b44e46b89c30cae828a7a40aa678c552569b57ee24cc5455acdc849ae6a57c03d3f02900ec84fcba48f9103304248d256f4ff3879b95e8c632e0d839aad9840ff5a4eb385c9b96e2e16af4d31ebf6b93bedf8dc570e0d45c53ff0f188ddf7efbb97f1ea1c7a94661ae7195dae71484a1d6a6ab09fb14f461d8237b2c9530ed276291017cbd366e467df847d5320cc1f555abd8881308e45edd0bdb66160acecb87fad7a0bf29d6dc8ed11333b7c4b173128dace5750ff7909660c5b96809bea0133282e709720e2aae5276a85cd78eb6eaa716694f70d58c6180701fb45af92d26eba4d46993e6f6ae18fd43d0bb2c92c1deb64f7355c489cca56f5dd5206ff01b69abe5a97690524bbdf9163719fec128f24dddecbf3adf48328fd30385e65bd20669ce66e68620564142a39a41ef90f77ca8d5cb484ed3bbafea096036bbea03002986c1abc5a21d54256375014c39b803ca99b535a5d2321a66ec49421ca9cc8e4b1b0a368353c4abf568c996328460dae195fcee94b1f437174bcc73b7375f59e6e7cc178e56e63193235ae4fe91b6c55cd2ae27e4988866ce55de085844260b68490f95e8043cf133c57302da8ba41d06285891fc631893e432f4655cd1a82b2200313eb00e80d6f864df335015a439eccede0d5e8add475159e4d7840c73ab82bb703e7dd5132b92d2013c01e6c8d6458306e5bae008cc0c2fe6bc64ce5705b905945ccb5a8e591f00faab7e9da9f4aec7fca8bda2e609ec4da93efddab8eae7351e2a719576baa924f617b2e876f496fd7447f11d42ac0c4ae9d9ceabd6e6f2d5b75603451c8da14d43bc62f8b04826405ee254fe84ab03539c4a980087ffbc67ca7f1ecd79d6240c650f947344247d70e85e8c30304846dc0e4699067489dbcd19f9a9ddab056a1b705998268653e0817db4ddc136bf6b3efddef3f335a2fdb86e4509c5027d39ec144a9c1623b3d0d829e4f13b044c09c0a5f1fe930bc2beced19ef3abd5ae6ecb477807327853351e14259f8931fb028d95cc5ab2a7a5b5a9054d54dc82241c8465a5cddab74b3395c4559d5be0ef92a9ddcf0889e09f7604adddc148b21bffc3f3972f775b03eb2e148ced61ba5313870ab84c91d02bdbb7390bd36cf55cb2492438f4e781ce5337a6f3b6d215e7da5d7eef45d9d31ac9ff915a3d9f3640f0dc06166c90898c35652b7bdfcfeb8ceb776eb3ad7e615c2ecfb7ef359fbb7dc23b6d9b0bc0f2d5dca826045e660008aa28914b6a6679aef2e3566f7fe27172ebe01efdd791831c5fa61668cc648c960ecb522b449b26afd9a22c4357fa155b22e13f4918acf7003bb3ee14173ce0696a832e31f469a56fcfdb0fad38b6e6fab5d357d8755e6eed57bbbc6650e7e2ecf93a3efeb0678b5e3b0135a37c85bac51f5d72935e1178047863d1e9e5dc42507afb8dbde9f3e52094432aac5ada4c14b506abb75baca6e7c7cf96a941dadc974ef4295069d8a27e041c6cc59b6d37b3b8f2ba5acdf0cbbcfabac59895b1b346b69620a9446792038ac47624c8cafea8b9db9a80d50daf189ed0e54b3b456b436fd6996ae4c3954391cac2f7d66d290a8ce523ed5156730f232b7874921ba9a8ca6b796a75c4aada0afbd3979ad420a92da0404434e05b10ac672a478dc28f7ebdd5baeca9ad7875f217fc19ade9f22ee35287b524f4e44df038848041dba619afbf2bd749a0abb36705320ce290130575cf92c2a5398d22dfb7399cdd68fe2dd6c41af1deeae849ba71b46543fbed4d086993d72536ba6ce0b8b61264b24526031c3b668793b476bde6a9dbafe85a7b3d8f4529d40da7b6f9be271ce75e2656d45af7a94a666f64b5996e895516884a62956c3183e12bd89c18420c4ecc693a414ebf150d75958066ff07197418d6cfca1b3bee83fcb3c6984e19137fa9b9905196aaa209b6ad261c4bada794ee616b07636dc9e140c78072a657af5891c13c91979d6f7f21824ec75d374be187785bf1efa46d52f693fe12b1ef8a69b0bcfb07ac8f851e07fb240f3dc168e7c3037f5bc3eb267d333aadda1d93dce99875dda5510634348651131ca728b920fc5868541c5a37973c75885c8d0a9173e299bd2e071bfd291ee780053626b97f4fdbea0df4c2f182610748efd0d981cad091fb185a95d7734ce6940e0dfb0d0d790e6707426554127e93ef29abfbc0178f51c4ff6cc13992797d7791096b60d2ce59db2a2c326d08b853c62071ffbe7137028284a1941d990e4066d9d1bbbe9209928997b3e11d2785790de437e8edf6b76950ca57d825e2681c4809c3fa73edccbd6e97fd4d064eb09d75f5b3f5ee827185af5f31b4d7a184becb9ddf6cf21d90447a2f4cf16b5f4ade7c088cf5cdfd94ce2ef11298e8d5e5fa1dc288d5b754675875d6a12c6592ce1f99f4f589fdae53067355f42ecfea1277cc789d14694a12a302c2c83f578ba796743f951cbad4c9a423d4cd87cffb421780833024a466948bc75d6e4c4fde852f93e7307db37c0ecd98bfc7e16b9ffbd7f95fecea866abcfe754ea00fbacc5799d7cd928d3ce9b392be273319aff4be32faf55cb8dd512a95c794912f6672209b5d2ecba548c8d0fb309f441d1158f0010e38d4d743b95e850aec1879ba54537b211f90e41f71d72f95a6d31969b1dbfb36f48d1397d55033a6e00f81ad338a1e150631dfe1d2142392c88fa6986cbe15520e633c4a050bbbe845cc6337b9cc5c5be3e0ebbbbf86ca85c8ef62ffe0f5ca447b10a66ae5d36399492c001ce488ac926bdc9c54610df8aa0c8143361c3ff53ce5a29c1eeb0fbe0ed7c3bd100fb193e973d04c6dfa0c4f34996037be780ef55dd276e1fd424d249512783bdac68f41293172ba8e54228f9273edf36a56d9aa3ed1a89964777f8d285cabed5e9fd9a9b217f2c9d31fdf9aa3c754d443401e6ab67ef54cad38421ce7db826ab1eb6a478f88ffee2bbfebe8c3ceaf8f58855aa0a19354842597a3bb08246136a0725f38f1df1156a1144b5a9e6581f0ec063be8892e1b9ef1997f3f37d70b272ce845cb25e2ef4e2b2727153212a1491426b001b01e7191b1b02bef4dbefafcaf51c08435c40e22ad82078d408adaeafc46f933362c9f9f7ec4510f6239aa0d89845a03ae7c64fd9c214e242ef12252e38500d1b556654f8a201f7c8fa75a8792e6b9b4eaefdb911e8f70bf1e3f8b9a5e94ce7d30c8dfc26afe3f877f818bcb9608578bfeeac843de91117b15a8ab6111c0c0ac03b2062a0ef5ac986634a053863976739f345aa647b77ef2e31d8a7bd87117a6214f2c5c14e6c2e25d6c06ac60ead692aa4b9aaf2177dd65f0b5625266f303ebcabfaca354bf4bb246311bff6ddeb4ed87d111080033653c7bd006cdd59b4a5898dec998c05e12c0a83e743bbd439f12b51cbc5887a52b3d666bf1bb1cea1b3fc0829acd9f56bceea9c34208bb34c10e2f7bc4ba5a82ab5c8f92dc0c549f53cebd0a9b52dc0c08127a5803943e50c11b53c611be1056f4e7b6355214be658090f73c8ffbd3ed54f4043e72cf856da416d7e73547229e43b1451e4ef2f450fc0cc34e2c2697294b5905eba2c3532bf1296110b49a82f0c9c44f6ee38aab8cd29b070f903228b1f5aac542a9c7459a6c5318df4e5b8c1cee56a4e877d76fc62eb35941d0789157768ccaa6da9b8b89040019f19c99572036f77bbda3c4256fe03365202d97f26e9b727869f13d18f6342c1c3d7a3af7774fde26332586564788f3be306b767f80c18e9826be656daf44fc708aa89db8a0f9b687fd13b87cdbae5691aa686a91c9c11318e8d5a2a78731aac8c070c68c8b3e7fbd59539a8d15d462a284ffe952fd3db481f1c87c7fb4d845aece603d662766a677fc49ef9a79384b496e65025790952cbec25d7efc0330a673e7"}, {0x108, 0x3a, 0x28, "366e54354978e6f84e8d9170401bfd43b5d531d1d171daa89eb78be3dfd59e0a4d5f275600b0335fd4002bfefa7c6c0f068f81176b0d2d5477d5239be7958c4c466b22a97e2fd87bab997efdfe6f0abe297a19a235d3ee07021795cb5540392f590734c9f8b4069896a7b57807883acc7cfadf1e2d640b2903eab11b24ca02fed9a338df23688830a40fb512c787abbfccbb272719d6b32dfd73a4ab23a296d68455664b9ce7bc837a8256238eaa74a3526e58a22b5a89e16e2fb2c87b3a3c96aa72fc6a7463c586d73d84b1d858c07841035c34b38d001db83ab88587be9d18c90c70237767209b79e80fe5ec3806333a8bed6706"}, {0x90, 0x110, 0x1, "79691743f1280eb42a10dfeaac4a49ad43bbb7449ecff904d368a4aa1d234d4c709c9684923b6d244de7b1b131e4e67414eecb68b2ee67bfc08953bbb661500e3bd2909787bda766e01aa86cd9610eb71af9f05d4309dec65176bf5dde9d4cf1645aba363e68cf5b6a18535b1c806e199464218368457d9337f7615bf7"}], 0x11a8}, 0x80000000}], 0x4, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:39 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, 0x0, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:39 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)={'syz1'}, 0x4) 19:09:39 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="c8090e55618025e341c0912000d660407a821473f4da31"], 0x1200e) 19:09:40 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:40 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="91797a31"], 0x1200e) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f0000000000)) 19:09:40 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:40 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:40 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:40 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:40 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="c8090e55618025e341c0912000d660407a821473f4da31"], 0x1200e) 19:09:40 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x81, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000040)=0x2) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:41 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:41 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="c8090e55618025e341c0912000d660407a821473f4da31"], 0x1200e) 19:09:41 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8880, 0x0) r4 = accept$inet(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x9, 0x3ff}, &(0x7f00000001c0)=0x18) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={r5}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:41 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:41 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:41 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:41 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x20200, 0x0) setsockopt$inet_mreq(r2, 0x0, 0x20, &(0x7f0000000040)={@remote, @multicast1}, 0x8) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:42 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540), 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0xf8}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:42 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) [ 781.579947][T22041] device bridge_slave_1 left promiscuous mode [ 781.599726][T22041] bridge0: port 2(bridge_slave_1) entered disabled state 19:09:42 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x64000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:42 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:42 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) fsetxattr$security_smack_entry(r2, &(0x7f0000000140)='security.SMACK64IPIN\x00', &(0x7f00000001c0)='\x0f\\\x00', 0x3, 0x2) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3, 0x900) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000040), &(0x7f0000000100)=0x4) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) [ 781.650432][T22041] device bridge_slave_0 left promiscuous mode [ 781.656721][T22041] bridge0: port 1(bridge_slave_0) entered disabled state 19:09:42 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8880, 0x0) r4 = accept$inet(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x9, 0x3ff}, &(0x7f00000001c0)=0x18) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={r5}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:42 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:42 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x10, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:42 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000000)={0x1, 0x5, 0x40, 0x6, 0xffffffff}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="ab8d1c6b9c6746b6c826b62a775bd42a178ef25a47a16fcd1de4332e7be38799ca83982c32d3beba2dee681f24de21a8e9bd05008e21d1fb23b8a190f48c989feaca240ed967ad2ea537"], 0x1200e) 19:09:42 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8880, 0x0) r4 = accept$inet(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x9, 0x3ff}, &(0x7f00000001c0)=0x18) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={r5}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:43 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) r3 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_LOCK(r3, 0x4008642a, &(0x7f0000000100)={r4}) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)=ANY=[@ANYBLOB='syx1'], 0x1200e) 19:09:43 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, 0xffffffffffffffff, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) [ 786.742473][T22041] device hsr_slave_1 left promiscuous mode [ 786.785398][T22041] device hsr_slave_0 left promiscuous mode [ 786.826877][T22041] team0 (unregistering): Port device team_slave_1 removed [ 786.838797][T22041] team0 (unregistering): Port device team_slave_0 removed [ 786.852214][T22041] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 786.896738][T22041] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 786.988445][T22041] bond0 (unregistering): Released all slaves 19:09:47 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, 0x0}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:47 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8880, 0x0) r4 = accept$inet(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x9, 0x3ff}, &(0x7f00000001c0)=0x18) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={r5}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:47 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:47 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:47 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x4, 0x30}, &(0x7f0000000040)=0xc) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000100)={r5}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)=ANY=[@ANYBLOB='ay*1'], 0x1200e) 19:09:47 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xce020000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:47 executing program 4 (fault-call:4 fault-nth:0): write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x21f) 19:09:48 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="5f5e5d7d5cec4f9aafd0010f0b5fdeb3a3"], 0x1200e) 19:09:48 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) [ 787.490963][T24918] kernel msg: ebtables bug: please report to author: Wrong len argument [ 787.535105][T24918] FAULT_INJECTION: forcing a failure. [ 787.535105][T24918] name failslab, interval 1, probability 0, space 0, times 0 [ 787.548169][T24918] CPU: 0 PID: 24918 Comm: syz-executor4 Not tainted 4.20.0-next-20190103 #5 [ 787.556851][T24918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 787.566923][T24918] Call Trace: [ 787.570227][T24918] dump_stack+0x1db/0x2d0 [ 787.574578][T24918] ? dump_stack_print_info.cold+0x20/0x20 [ 787.580324][T24918] ? debug_smp_processor_id+0x1c/0x20 [ 787.585701][T24918] ? perf_trace_lock+0x12f/0x750 [ 787.590643][T24918] ? __switch_to_asm+0x40/0x70 [ 787.595430][T24918] should_fail.cold+0xa/0x14 [ 787.600134][T24918] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 787.605965][T24918] ? __sigqueue_alloc+0x235/0x710 [ 787.611015][T24918] ? find_held_lock+0x35/0x120 [ 787.615807][T24918] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 787.622085][T24918] __should_failslab+0x121/0x190 [ 787.627046][T24918] should_failslab+0x9/0x14 [ 787.631559][T24918] kmem_cache_alloc+0x47/0x710 [ 787.636346][T24918] __sigqueue_alloc+0x3ca/0x710 [ 787.641210][T24918] ? dequeue_signal+0x650/0x650 [ 787.646081][T24918] ? wake_up_klogd+0x180/0x180 [ 787.650865][T24918] ? __might_fault+0x12b/0x1e0 [ 787.655647][T24918] ? __lock_acquire+0x572/0x4a10 [ 787.660597][T24918] ? lock_acquire+0x1db/0x570 [ 787.665303][T24918] __send_signal+0xd42/0x1ae0 [ 787.670011][T24918] ? prepare_signal+0xe10/0xe10 [ 787.674890][T24918] ? lock_acquire+0x1db/0x570 [ 787.679583][T24918] ? force_sig_info+0x55/0x310 [ 787.684361][T24918] ? kasan_check_write+0x14/0x20 [ 787.689324][T24918] ? do_raw_spin_lock+0x156/0x360 [ 787.694350][T24918] ? lock_release+0xc40/0xc40 [ 787.699038][T24918] ? rwlock_bug.part.0+0x90/0x90 [ 787.703980][T24918] ? trace_hardirqs_on_caller+0x310/0x310 [ 787.709713][T24918] send_signal+0x49/0xd0 [ 787.713962][T24918] force_sig_info+0x251/0x310 [ 787.718679][T24918] force_sig_fault+0x11b/0x180 [ 787.723452][T24918] ? force_sigsegv+0x120/0x120 [ 787.728235][T24918] ? kasan_check_write+0x14/0x20 [ 787.733313][T24918] ? up_read+0x212/0x2b0 [ 787.737592][T24918] __bad_area_nosemaphore+0x332/0x420 [ 787.742978][T24918] ? vmacache_find+0x65/0x310 [ 787.747677][T24918] bad_area+0x69/0x80 [ 787.751701][T24918] __do_page_fault+0x971/0xd60 [ 787.756486][T24918] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 787.762567][T24918] do_page_fault+0xe6/0x7d8 [ 787.767072][T24918] ? trace_hardirqs_on_caller+0xc0/0x310 [ 787.772709][T24918] ? vmalloc_sync_all+0x30/0x30 [ 787.777562][T24918] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 787.783766][T24918] ? syscall_return_slowpath+0x5f0/0x5f0 [ 787.789423][T24918] ? prepare_exit_to_usermode+0x232/0x3b0 [ 787.795141][T24918] ? page_fault+0x8/0x30 [ 787.799389][T24918] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 787.804939][T24918] ? page_fault+0x8/0x30 [ 787.809187][T24918] page_fault+0x1e/0x30 [ 787.813340][T24918] RIP: 0033: (null) [ 787.817922][T24918] Code: Bad RIP value. [ 787.821985][T24918] RSP: 002b:00007f6652204c80 EFLAGS: 00010286 [ 787.828051][T24918] RAX: ffffffffffffffff RBX: 00007f6652204c90 RCX: 0000000000457ec9 [ 787.836023][T24918] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000003 [ 787.844023][T24918] RBP: 000000000073bf00 R08: 000000000000021f R09: 0000000000000000 [ 787.851994][T24918] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f66522056d4 [ 787.859963][T24918] R13: 00000000004c5563 R14: 00000000004d9238 R15: 0000000000000004 19:09:48 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:48 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:48 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @dev}, 0xba33147a7fc176fd) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="06080000"], 0x1200e) 19:09:48 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x800000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:48 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x21f) 19:09:49 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:49 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) [ 788.377505][T24952] kernel msg: ebtables bug: please report to author: Wrong len argument 19:09:49 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket(0x2, 0x6, 0x4) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000000)=0x5, 0x4) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) r4 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x2) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r4, 0x8008ae9d, &(0x7f0000000100)=""/108) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:49 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x2, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:49 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x3, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:49 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="3ebac4ad2f307c944696d1c9bf63df5254606a970cff91f40dfbd991546dcc5efb22c0b7f75822"], 0x1200e) 19:09:49 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10], 0x2}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:49 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket(0x2, 0x6, 0x4) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000000)=0x5, 0x4) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) r4 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x2) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r4, 0x8008ae9d, &(0x7f0000000100)=""/108) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:49 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:50 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000380)=0x9, &(0x7f00000003c0)=0x2) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0xffffffffffff37c2, 0x84200) connect$l2tp(r2, &(0x7f0000000300)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x3, 0x4, 0x4, 0x2, {0xa, 0x4e23, 0x81, @remote, 0x7}}}, 0x3a) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000000c80)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e23, 0x60, @mcast1}, 0x0, &(0x7f0000000880)=[{&(0x7f0000000bc0)="1e7aefc4bc51e056de3f21a0f9d63e59aedfcbbfe77ddb35cd6a35ba1914ebda36ac4f293ff67c320700847d1b38d2e48ea4f7ed6427c1c76ed018a26885e07f7c29e370e726d5bb75305fe5364e5ba8d024c31fbe9bdf0de42df0fb7ef82206fd978cac3e0759c64127ac790c1b9d67dc4c27385db9158ce4ec8dedfbf4b36e46d8177bbe38820acc3bf48ed98b1f025e3b499ca9b0cecb043910d1d002e859e4f84b7ded50dcbc896e350f380c1fe0934b"}, {&(0x7f0000000100)="6f2a4e4928ac11f04e61ae30cb63eb2b37519df3"}, {&(0x7f0000000580)="2656e1141d23cd3b07367f35eac65b39a53621af847728e51cf5e9c2f6469c1d71d22d2f312391ddfa9035fda3591ed4d4a0b2b95db4737f116fe6bb9882ca69fe892b860ffade421bc6466448d5c1fb64a9780269c7c1535881c1c688cc22a2022064260e7f9ea97a05db97916a202d66eaab69110fb954487d1b95d7ef2f7700e5e2ccce17d8b371f731349928fde9c7ca803fa87aec7f66c3f83c4afa932304c8113785b67eccbeda2774dd6b1ee4b12e9d90c5f56f9aabc57fdf06a219b93d5f8ab982d3696ca92082a47ee8a61e74a529e229d26f6f2d5f6ccf8e29a97bccbf4c5e922520"}, {&(0x7f0000000140)="178bab336f11aa69dffcc06b1f2b2871e097f2a176505b1902ac44e5cbfc69e5356ed93857a7d63cad0d8410c8753af4fcbdef"}, {&(0x7f0000000680)="5db540b00550726dca4c2566573ddd6ee630360d818583fc75068fc6206311152df6f944d542e60a93106ae7e3eb4c015e0b8404176367aaa1175b7933c28b70f504df891d6116e2b9ab8d02c6a41da9f3ceac86da118cddfc49ac68cfaa88930a1b91ad3a233f29ef784d7220bdcf3dde5e980046bedb9505524d"}, {&(0x7f00000001c0)}, {&(0x7f0000000700)="06242e1f7339d4fd41f8c5a780b4ac38f0a247e3d4dfbec23b0c2f7461e9391d84132c35bce2d4c26d8cedb01f45823f1dde06e2664351927edcf7d5decedc6dcf4ef906ecf22d0a0c6c50fd7e242873efc64af51ed15e0a10fa59b357ad7b2c47d0bb49e7a37ce43efdc5837f8e71450f8849855c618934ecf002a9cec73133f53f0b48cdac722608bf00f7007f447e450f24a950cd5fbda609aed48c4c157a0611ca59d0b6986ca054d8efcc7501638ea52a0f382e1241e5ae5d9a19d27257"}, {&(0x7f00000007c0)="27e59f6fe1204c45408ffb30a617b36301464733d7a26d844862c18e7b20fddeaa6cee866e314750c2ed7e5c33bdd4ee62ada35099d533e5f5eb27cec70ae5a7fb2501f75b4cb696e535b72da039098ef6e1c79255be088192c923b6cd9c16b1c6827e5ac49ed39d9a958f4f23c9ee243bef112a51dd0264dddf96456821eaad1ebb1ab548c4b3761fd3c796a7ee0ff674f36c58f10249b74a90a229f084274b0074"}], 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00000000000000008f010000fdffffff1d04689d39ccd1cfc80b1ceec80baab7916eea50ed3bd75dd869deb73ddad192d84e29a17c4c03caa4a14ac9528493d532b4e2449ef67e5a03d13578fbdf094c37477a651dd11b653be910db3498f777538896f1c1a8af054da5b2f05ad963ddde3cf4000000000000000000000000000401000000000000b4117ffc09c4c125d0a7bfb22d7f632e69648cfdf867b4bd17d042ec85da4c0efc0b62cfa20eb7c6ea5871a5ad3180c227f00cc4803de3c0ce25af7216857923f0c253607ba37107a24722289a6bb57729487a1901a29e5022212c1d75a40022316bf95020070000000000000000000000000000000000000000006aaec86a99e9c8f037fe3ddb1993cc0a20df33adcb4561f939ae0a59e4bdf60e53938c44bccf51cd23ad1f78eab0d600000000000000f00d06000000080000004cb82d5b0b2556df55d0e448e73ee2d5cd4ec9ef3cc9159abf1b285c958e2ee5e155dcca309788bc05c8eeb8ac1d0c8fbfcb3d4f154cb9d9f5e01d0612bbc709d762e0a3aec14571656984e779fd565d23f49eef1095725f6280e223ded63d73f8899ef50c710981d372b889abde510d3b4baed17d00000000000000000016010000060000003429d4653bf95811e2605bfa1b10615730a2b544c5fbef36e2aad2b1c35bfc067a53a24cc4e5e4c46e373f9b23ab680931e63eee378258ce5cb1d9ceadebc1c98fc67f5c573fa4d9d7ebcbb2d7d684450e497b070000001d566cf1ac6cbe2cb95ce8166bc1a65a121131401e28a26b5ab95ab50a782f44938c9e39f74b9ee2fb8fc9fd2e23d2e131fd65bdde21be332fadbaf3889ad45df4678c15881f3dfdce3a144ed4491b1bcbd2c228d64b30f52c656f77b9746315150faaab618e1a66f3b649ee699616e6c6043b38433b0b7a5900d5a932a9afcbaf0e7c0f201556634d4499fa5176580032a9842ac46448ec84cd4a1ed5b17d01e971900a2c"]}, 0x81}], 0x2679dff7b497333, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:50 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:50 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:50 executing program 2: 19:09:50 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:50 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0x70b57d59be882bfa) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:50 executing program 2: 19:09:50 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:50 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x5, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:50 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x28000, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40001000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="93000000", @ANYRES16=r3, @ANYBLOB="000427bd7000fedbdf25110000002000020014000100ac1414aa000000000000000000000000080006006c000000500001000c00070008000000000000001400030000000000000000000000000000000000080001000a000000140003000000008b000000000000000000000000080004004e21000008000b0073697000"], 0x84}, 0x1, 0x0, 0x0, 0x20008040}, 0x4) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="73797ad15b6031"], 0x1200e) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) 19:09:50 executing program 2: 19:09:50 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:50 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:51 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6400000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:51 executing program 2: 19:09:51 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:51 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f00000001c0)) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x4, 0x200000) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000100), &(0x7f0000000140)=0x8) setsockopt$TIPC_IMPORTANCE(r3, 0x10f, 0x7f, &(0x7f0000000040)=0x6, 0x4) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000300)={0x1, {0x77359400}, 0x5, 0x1}) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$PERF_EVENT_IOC_DISABLE(r3, 0x2401, 0x8000) 19:09:51 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:51 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x11, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:51 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:51 executing program 2: 19:09:51 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x48, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:51 executing program 2: 19:09:51 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, 0x0, 0x0) 19:09:51 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000880)={{{@in=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000980)=0xe8) r4 = getuid() syz_mount_image$hfs(&(0x7f0000000140)='hfs\x00', &(0x7f00000001c0)='./file0\x00', 0xb0, 0x6, &(0x7f00000007c0)=[{&(0x7f0000000300)="042071dced86d02cb13c24f4ed72d1eb9dd092bd5770f2dbd89962c325af4b59e32ed0fbadd610341041a288a6f1c3eba5e3876673f351f3aa", 0x39, 0x200}, {&(0x7f0000000580)="1c0902989322a60647bb0dbf996642cd26866d1a9fb96363709f15925d976338a680d124563fe96dade13fa6e45a8343dfc84b86d0d8c2ad165de15f4597326937ba3fd6bb7906f91c3160df98bbe7ee0ba2f657b3095bcb09d260a2326b380677ed128590a1811ab289cf9a7fed74595f967ea8c356bc5456f04e0bc1edc49dabc75873964e97f95e475fce10732e57956a37cafa0c4838df71de7c2adc93189b35055b11d6cb69ee28f0d86371d7a25df9710f346b35d29286e0b55a0725be5d2fc6b208cb31382175cd", 0xcb, 0x10001}, {&(0x7f0000000380)="d1ee0e6d7e2eb0eace5de1c8e769f1505f4b018c73f63e5dd825ab64aa0be61ac665a1f62bf6e24e06c574634ae0d3ecc9b5a6b9d0d3c2e574838bf2cd654c0c5aca8df44216dafa117029dee86e28fba13e2b5b113c82815e9315ec76e498bd424d7c2901fe03040e42ac5b153b2984aaa8a51107442e2a9ac7f6a33e6024327a32c221a2d90dca5c4f7ba2b5d4cc1228a3a67087b25ad47648e40144aeefc9742ff831cad2baa9f6b4ccd9713be12b6ada242eb2e8eac76879a77df3", 0xbd, 0x2}, {&(0x7f0000000680)="bd1ed933c9e5a168faabf3226d63ac37fe857a9d9ecbf303ba3f70ca11fbf1cc7d82dfee9410b24f2da18d0fc6ecd685bb53c254dfcbef2c03b098e8a7b6982c5681504c", 0x44, 0x800}, {&(0x7f0000000700)="66fa5abfd61e32ec67130e373a4ba0a2507ad073f73983450f7c0d053d9c35d5fa53072f8aa22a43cb0131346ca948dc58da561d5ee8591e78a4fccfbbeb1d390c06b2e9", 0x44, 0xa033}, {&(0x7f0000000780)="d679d78d1f36ebceda41c1e5e724bba9f2538f1eb1a8f0c6efb4", 0x1a, 0x8}], 0x80000, &(0x7f00000009c0)={[{@file_umask={'file_umask', 0x3d, 0x3}}, {@type={'type', 0x3d, "f9b75420"}}, {@type={'type', 0x3d, "a6319f1d"}}, {@codepage={'codepage', 0x3d, 'cp862'}}, {@dir_umask={'dir_umask', 0x3d, 0x400}}, {@uid={'uid', 0x3d, r3}}, {@quiet='quiet'}, {@uid={'uid', 0x3d, r4}}, {@type={'type', 0x3d, "efb1d3ac"}}], [{@context={'context', 0x3d, 'root'}}]}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) dup3(r2, r2, 0x80000) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) r6 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x400, 0x0) getsockopt$inet6_dccp_int(r6, 0x21, 0x10, &(0x7f0000000040), &(0x7f0000000100)=0x4) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x43) write$binfmt_misc(r5, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:52 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xce02000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:52 executing program 2: 19:09:52 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4c, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:52 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, 0x0, 0x0) 19:09:52 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x80, 0xc2340) ioctl$RTC_WIE_OFF(r2, 0x7010) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2c, &(0x7f0000000580)={0x1000, {{0xa, 0x4e24, 0x5d, @mcast1, 0x2}}, {{0xa, 0x4e24, 0x1b, @mcast2, 0x7fffffff}}}, 0x108) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:52 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e21000008000700"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:52 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x60, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:52 executing program 2: 19:09:52 executing program 2: 19:09:52 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x68, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:52 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000380)={0x0, @in={{0x2, 0x4e20, @multicast1}}, 0x7e, 0x1}, &(0x7f0000000040)=0x90) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000580)={r4, @in6={{0xa, 0x4e23, 0x800, @empty, 0x1}}}, 0x84) 19:09:53 executing program 2: 19:09:53 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:53 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, 0x0, 0x0) 19:09:53 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6c, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:53 executing program 2: 19:09:53 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0xff, 0x10000) ioctl$NBD_DISCONNECT(r2, 0xab08) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="010000803e213f5c6461e00376bb2583e75ac16a538980d7032c4ad338b66864349ef4edd91619e097383063c3e07510f61313a8e2db4ec7d6b42b89b1f31460d0c8fd"], 0x1200e) 19:09:53 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff08000500090000002000"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:53 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x74, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:53 executing program 2: 19:09:53 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r4, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e22, 0x0, @remote}, r5}}, 0x38) 19:09:54 executing program 2: 19:09:54 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7a, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:54 executing program 2: 19:09:54 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x64}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:54 executing program 5: 19:09:54 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x88, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:54 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000000)) write$binfmt_misc(r3, &(0x7f0000000440)=ANY=[@ANYBLOB="c8de5981"], 0x1200e) ioctl$sock_bt_hci(r2, 0x800448d3, &(0x7f0000000580)="85074f3e60f8e50c67ad1b29c4c56822a4394594dcfe3c07e598971645bbc287a3d17d8f5168db8a68eb623913b981190c536bbe2a18fade0c7dac6f44cfb851ea4852ad1ca07775775b2dec25a096cd09d6eaefaefa8e0c5484991078dae1b3c43d875c903063dfc7578f929364c666b3f98913bfd8ca1a0dfaad6b6489724e2ecefc88f245c9e66d7308b1b572396d0b908408362d6e18ba528ac5e6ec96ffa3069199d4a6c232bb89e832291a0517a3af9ccd7ef8a88045e57410e1ad4ac1e06ed7af49db883fca19ecf8cca5a14849a1dc135ad6f785489b22f55fa41f4848298885b5f0a24bedf746fc70f160e2054118250a11ad342095df942021cfd90e7498c8fe6c58d0803aa7d62dd2cd10cd0964e401547f8b78587c5aabd259b2dcb9cd3c8b68625477f92e0c0f75dad085722751156c9dc6ebe0e4af8d969c96942c0b1669417277e41ccecb00eec69f6a3ddb705066213d6ce6760101b8251e6aaeecf8768fab641a3c4fdb7dd2831f4242f7463e8885a20007b3f3f474673d21d87d716e80421ea48ed2b097ae5dab0596323026e732a2fd86549feae5d6fd4d81a07b1b4ad650f308196179117648f3b8666261d18fe38e666f0ca477818984b9fe85e7c559983cada3d2ba01250e5e40b412a25ede0b7bb8ccf39f230ddb7f34782e78097e6465c330a9091d1bb0d0827aeda57e1237d8fcf22ac3d89d9bca825e5047c79ac76df4bbc152432771126a7465d1bd882d80e3aad509bbb3768911c746bed5c4133721e67f6e2734f42b21718b764cf6f8a055b80c5e617f50fde129d743132ccf820744fa36ed1f309541d36ea7c2998891290b3bc00a704ca7b97c3b69367388ea880f3ac76adbc957b043c9f6b39690fcb15395963f5a27f1bfd248ae1a12ed8e6240c7ad768d73908d97a789685f4f9b51fd167f4fff47f358434ed09d5caafe2a73793f81b2e0d437704f75aa562bd58d19923c5bc43a857a14f792c4b1563a1df903706add34830dcdbd5db1e06692ea18075c2d4f54dc5ac8a6576c444b7f836a8266d990186b043caf5ce62139b7f08816969f1dbeb6611b4e9368b0cdc1c12f1b44c8f0414b6650dc49f048dfade2049c6f9c0507e0e91abd4159fd53466cdc767aaa04fc176624211cb65a0dae5a1745248e6f7d1db3a7267c1998e3f0e75229fdbe448492150733e9f0474d65619c641c06c62da52d0ad2daff9319c33800380e8e1a3e550b9d7d90e8c1ebe066e2bb0d201cb78324ecce3259070e8a2abe620a7110e0991910e7b54ce1fece7212cd5d490d22a09ca400e9fce0436c6a1cfe0546ef6985cec894b5f2dac990742b7532659f1d8ec030e7df210e706724689765bf7a067d7cc1537f1766b15eee11ed77d7a8ff0d007e3b3da0d084f4659ab0b5b9d855ea0f8aee8e8a0f42d2d32254673cd6de990c7f58f933371542d05202280ce810761dc47c20224b3e3430cdd392c65274fa49ec37a2a288848c50b4bf9d95ab634794fcbc1b1f65780c13607b998786843190959d2b9b1bc0d0de0420633f3f3fff97a14ca48e5070e0e21115029b5a0e07f0664ffb84b8b5412023eea84378d8981993db90632c13fd6d0e09f4c104a44f1c525c5254fbf90dc7e651e2421448d8f4b0631b2852a86442361dc489c20ec1c3f054fae11c6305126d49bb7d7aa263740a4bc38285716d77a5dd0875929623010a32ca297ac552a0aff2df0d2ff6cdd18a279a76b10b22babaffd7c0e76cc64fc56f6d9105f4149eb6bf63044b388da4a808a49df06bd5f27c1a00b500ccad2e5e5b8cea340d6c454d62d51a1caa150a5bf5034f5e0ca25b638e5dec476e8b8b155640d179865c2d343d3e70fbd582c7064ae882081b6fa55710ecede988bd0f3b5329606be4fc7695c6542aa0f1886e3ff2844cd4d2b059f59ac080fef6a11be634b5545c11310ffe56def2dca57557cdaf3f4363659746bd928bad4a58c2b2d7d4348eb7737fd9e388b4f8be1b0a743e6e13ad61aa53250d0be052c031fc7f1b2c7cb30c428fb66c34dc080e5423c9f6da45422f82c4a276895082aa1fd06d47e54a569b48aa6db0b36b23b4e8a2c17f9a1b8c145b2c355bbc12fcc5b21bbaa0bc80a2843b35e11dc470e7a08185d7367abc4e90d367276c14087026ebd531a5910584e05cd5f1f08161ef1f859b75c2144d67b4c48198ba80c77437ab6b46f13a1611c0c6310af2c94ed8f3c5ea4cde946ea783d7756e1bab15e66f08d6010344ebb906fd8109550dc9c542d49848fec9de38a23db71fcafd032b083afe07c63925bc6116a3025c1da7a99174136597065701939142ffe3901c3066d7ef618e6f51c8c8f0b54c055b27371192ecbe6ff3f39907c387e0547d103a7cefac9f11690a2e6e32885846704a1f92bfc99dccbfbbcd24ec25a1cb6ecf361615458a18f15efdf770a2e7911fcdc85a43396348d749776998b6b877a47570c70305f51ed2ef1686222212863dff27449da7cb1ebbe5d24ae87e6cfee14e32f56244762b315cd8b295e5d571279182128a5fe07c68148af64dd47bcef9f7f4864287a6a88d3dc82c0664318a9a8ef66b057cf56d8cb0c81ce380eb0aca893544ba14b0bc4c26739c98762c2d7eb0601ffcac7f09a7e2db24dbf0fd2455c2ca92ef02f6a48bb312450f830481a0171fd51e4459fdc98884c803720691b90aef171c0029bcd8d8d088f0bf763c22001706e99ff6ac77f15ae437960c5df24910bfcfa2271298535f7e04391da6a9a8b12c055deb9296b6df001e8b7ef207f1481533dbafd2821418df56fc23f7a960acdc8b6d12395835c1638fb6607a1ccd18201df610377d6600eae9729a412c9d338cd2774463318050c0da472f1d6790bf59401dc2f89a6ef115d99feba0daea5c87192c3a5070738b5b77375c5fc1a93ca2e3f7a6c6c6bfb0d2a0bb842f3a1cabdc29040641c31a5223593bc0ee9d9753a986c01cb2ee2e350352c49eaf7ab12ab6ca914b2a789bb64704c0e34036eed64cf52e52110e2bc237facde17f8545e1502e65c50bf1f268d7c7a73e8549144fcb4165369413db494af90e65d0e092fdb40269dfbd2a805ba8fe5eda2251097020dceaa23b9830f8586541ec1a27b88be45717a0f0f0d1f69c3523041baad4b1eb2a0c2424b75217f6a321e79b9ab082bd299973b62984a8a92155e0b414dac783cbedfb828b20fdb218dbbcbba154deaa0ddb65032b176ec472cac71752661922387289ad6e5fee8249328ea06886227f22dee982b46893de3b7a6a596f110072cca3442cae6e6bfbfe5fc87c2c89047fdb46407e0f3d294988593329a5abe4afe21e22d830daa075456bc2feedc5dbf05052ded897c1791e82bec380feada78dfb40bc7c87514d4c2dd9310ad1b80160abd5aaba259821100c769cda7679cc24d7d40e5249b91f6e3bf832d9134080554836d2c245dbf82ccbe5192f5a16d6b7c9b2252be39e1cf31e2a8b58d2b2296dcd5cf3491d7355d448636542dcf14a7be74ebc2ca4021605203aa5a433caaacf2f8409eead3b1b1b68aab3a1a589c79fbd52564b8efa0c9868989202b52ce0b022c29a7373e50535482538ae04b213ad4d34edfe578a9572fe907170c003931e80240420644d600c0ec7259591b19c555ad2b06b97cc47e9db5e7214ba1bed8cdfdfdd9c6170d1fab25ed9e54944aa2175ec7ebde50f2812bb239a5fc6d837b62726825358809b7abc7589298ead1e1c0d134b794789d653bd6d5e9d6a5a35c1b935902df012acc4838a38f3b40d5be458529b7179d56bc2cb91a5d7f72256f628de15d16d9bdd78aafce7d07066e9071565e9c1f17bdf4af1699593e185cda04814dd9ec79ae520b4016ac147a8fe1e9b1f6d0275dfab50a129e2eb87be4278e1ac5aad1e0cdadead5fbfeeb98395eb3465181dc9f685152acd7a9333a23dc9089d1080cce9a20bf642bae40c254cbd9bc5fd32a46c3d6a76343f5f6690976bc5ee25ded04d27ca9502ab1b4571eebd2ba449bb727b43042ef663bf45146ec6efce88d9f03f75693ebb1386ef829fb979db6168bd5f23ead56f1a7a3927efb7fddbf0a9d453d49bdd823becc6e0fb7028b0d4f0b34703e5ac4b15f2b0b02d40fbf796ffe1da6811cd28c7ceae6bcd0165fe623f9b5b0eaa234c06647db98d362a98d1aaaea21ef41bfeba4b82dcd138154bb745ac0d1023e46cfad4954c573a5af33d80826a996208b4ea93418912c8e1059164ef15e613fae50c3c7a4809aaf445da929a97f0b7c63d04596554e31a4cefffa3673d7b15d7e038d32f3ad8dd2207285ef9c12351fa43fdd5a90a5a077c2dc9f41fe9ddc135829b8c96359219198e0e1aa5f94086cedc761c51b10c7eba811ac9e1e65348053ba7dfe5f0411e413593f6f78d97acaee19708480cb32c18451916d3fcd7de01d1bdc8b3cf33c27b144fd54ec3946b100e1d1f2c4dd43decebda473469c6d22b4ef3fbf059ff7b942dd0383e145311add1e0a7a34d068712ab632dcb28c44370403d81ea9cf7ace1429bc4af6d55c109fd324fa927db0222a956b6bad7b5d917b55e8123ba92f85e989e10c64788cd986e958882b368654ea56c840a59bd57cf675255ed764accfe723282779cd96a9d32d8c149d52d61fc8fb653680659bb486c14fc7cbb4b0cf862c16c3f44b52511beb0a8391841ed420bc919d9d80c15ba8fd7de5a77aba31b59cc908e040a91c3a043e23594542e38879084fa5149e1b0b1c8fedb9329ee2b142f38d6bbc501a7c52960627adc75845a535ded7da2c1792975cbab86d6bcc929c6e6ff7608ce20bcb5c9eeff8cce877846f3418b2e0aa0506d84afc4b89a2b11c9aa955b345cd4d769386cdf162a20dde843b381188207109126bb1213f5559a85536d419102fe84c72c038955718842ab5824d2572b3023776c7699dfd8de12522a0a8f73925c52a224611f2abba932885257c92c3518ae604638aff4645ce4a54e5f726b8b7f963601c0bb78b0ca61b1cedd8547fdb7a397557bd60b57facd3a65f687fa74ba03b797d84ef36057b0a86d7a506799910c9346f491539ce17f8c4b84733a14c9a52218676d3f8ca9adbdbba574180477d0dcbe2a3e3e4873121a2b1bea08101fb40b2d53beae76de2bb7967651d09ce1df98589a3a57ff7dacb94c1f11ce9d0577ff1fd6068d52ea921de5cfdd383d50bb494bff8119a65c9693eced8212fce7176cbf35bc42721c46dbaa91e8a33a977bb64e29adfd5860b3d4e0d14b2dc7639f18d9336f3f2c3b6fb15950451f93d4bc4c7afb364bd185d718f91bb83e67394e42a4b94bd7cbc3b85a8694d0619fe04f4d937d609bbfe87a6ac666abdbda06f95504933f37070fc011717623b6dccbbd18209db8685af26525613b334750fae9f2417d56d92e015084f53dac6012291884db516a4752f8f6c06fb5021d0008279415fa5df6a1414e0497a541ca0a7c1cfb108fb2393dfedb2f35587fdfb5365091269357a03bd82a66823274a6517c34b188e89ecba7d99f98f6db2b77e25a9288d271dc279a0a46c693242b26892cdc55599682a9a9acb623abead96ffbde949e7fe053af522ded1a8d3d3763c2aeaf1548535faa6e874b7eb26556ea4bffc1dc18c9052381b3b311c15d740da7f1d86bc460092b09550156b0cf5813405089853b798804d349cbca598549c3dfb8a7d2f26872e602dd8d62efe2c92c35764a88ba72938bbc9dd1bd1e487e2de2ea981f1117a6348da294137fb20826b46092e91caaf329f09c") 19:09:54 executing program 2: 19:09:54 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff08000500090000002000030014000600000000000000000000"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:54 executing program 5: 19:09:54 executing program 2: 19:09:54 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x300, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:55 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:55 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x500, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:55 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:55 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2ce}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:55 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x1004}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r2, 0x17}}, 0x10) r3 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r3, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x1200e) 19:09:55 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x600, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:55 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:55 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:55 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe000000208"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:55 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x700, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:56 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x1100, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:56 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000040)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x40000000001, 0x70, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0xae}, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) r3 = semget$private(0x0, 0x1, 0x2) semctl$SETVAL(r3, 0x0, 0x10, &(0x7f0000000000)=0x40) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0xfffffffffffff801) write$binfmt_misc(r2, &(0x7f0000000440)=ANY=[@ANYBLOB='qyz1'], 0x1200e) 19:09:56 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:56 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x2000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:56 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x64}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:56 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:56 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f00000001c0)='/dev/radio#\x00', 0x3, 0x2) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x106006a0}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x38, r2, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5179}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x40005) r3 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r3, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4080000}, 0xc, &(0x7f0000000100)={&(0x7f0000000380)={0x8c, r6, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xc77b}]}, @TIPC_NLA_MEDIA={0x44, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff001}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}]}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000040) fcntl$dupfd(r5, 0x0, r5) r7 = dup(r0) ioctl$KVM_PPC_GET_SMMU_INFO(r7, 0x8250aea6, &(0x7f0000000680)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) sysfs$3(0x3) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r5, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:56 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4800, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:56 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:56 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:56 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4c00, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:57 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:57 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0xffffffffffffff44) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:57 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6800, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:57 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340), 0x4) 19:09:57 executing program 2 (fault-call:20 fault-nth:0): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:57 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6c00, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) [ 797.227176][T25444] FAULT_INJECTION: forcing a failure. [ 797.227176][T25444] name failslab, interval 1, probability 0, space 0, times 0 [ 797.249736][T25444] CPU: 0 PID: 25444 Comm: syz-executor2 Not tainted 4.20.0-next-20190103 #5 [ 797.258430][T25444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 797.268485][T25444] Call Trace: [ 797.268515][T25444] dump_stack+0x1db/0x2d0 [ 797.268540][T25444] ? dump_stack_print_info.cold+0x20/0x20 [ 797.276149][T25444] ? perf_trace_lock+0x12f/0x750 [ 797.276163][T25444] ? perf_trace_lock+0x12f/0x750 [ 797.276191][T25444] should_fail.cold+0xa/0x14 [ 797.276211][T25444] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 797.302190][T25444] ? __unlock_page_memcg+0x53/0x100 [ 797.307418][T25444] ? find_held_lock+0x35/0x120 [ 797.312195][T25444] ? __unlock_page_memcg+0x53/0x100 [ 797.317419][T25444] __should_failslab+0x121/0x190 [ 797.322356][T25444] should_failslab+0x9/0x14 [ 797.326845][T25444] kmem_cache_alloc+0x47/0x710 [ 797.331642][T25444] ? trace_hardirqs_off_caller+0x300/0x300 [ 797.337557][T25444] mempool_alloc_slab+0x47/0x60 [ 797.342410][T25444] mempool_alloc+0x19f/0x500 [ 797.346991][T25444] ? mempool_destroy+0x40/0x40 [ 797.351744][T25444] ? lockdep_hardirqs_on+0x415/0x5d0 [ 797.357038][T25444] ? retint_kernel+0x2d/0x2d [ 797.361616][T25444] bio_alloc_bioset+0x3c1/0x720 [ 797.366454][T25444] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 797.372719][T25444] ? bvec_alloc+0x2f0/0x2f0 [ 797.377245][T25444] ? arch_local_save_flags+0x50/0x50 [ 797.382545][T25444] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 797.388004][T25444] submit_bh_wbc+0x133/0x7f0 [ 797.392625][T25444] __block_write_full_page+0x91a/0x1480 [ 797.398179][T25444] ? check_disk_change+0x140/0x140 [ 797.403285][T25444] ? submit_bh_wbc+0x7f0/0x7f0 [ 797.408073][T25444] ? retint_kernel+0x2d/0x2d [ 797.412698][T25444] ? block_write_full_page+0x21/0x270 [ 797.418114][T25444] block_write_full_page+0x21f/0x270 [ 797.423381][T25444] ? check_disk_change+0x140/0x140 [ 797.428478][T25444] blkdev_writepage+0x25/0x30 [ 797.433154][T25444] __writepage+0x67/0xe0 [ 797.437423][T25444] write_cache_pages+0xbec/0x1ce0 [ 797.442441][T25444] ? __wb_update_bandwidth+0x670/0x670 [ 797.447904][T25444] ? clear_page_dirty_for_io+0x18d0/0x18d0 [ 797.453698][T25444] ? mark_held_locks+0x100/0x100 [ 797.458622][T25444] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 797.464096][T25444] ? lockdep_hardirqs_on+0x415/0x5d0 [ 797.469380][T25444] ? trace_hardirqs_on_caller+0xc0/0x310 [ 797.475005][T25444] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 797.480446][T25444] ? perf_trace_lock+0x12f/0x750 [ 797.485367][T25444] ? debug_smp_processor_id+0x1c/0x20 [ 797.490759][T25444] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 797.496207][T25444] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 797.501680][T25444] ? blk_start_plug+0xb5/0x340 [ 797.506441][T25444] ? trace_hardirqs_on_caller+0xc0/0x310 [ 797.512055][T25444] ? blk_lld_busy+0xa0/0xa0 [ 797.516544][T25444] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 797.522700][T25444] ? check_memory_region+0xbc/0x190 [ 797.527890][T25444] generic_writepages+0xed/0x160 [ 797.532827][T25444] ? write_cache_pages+0x1ce0/0x1ce0 [ 797.538106][T25444] ? retint_kernel+0x2d/0x2d [ 797.542680][T25444] ? blkdev_readpages+0x40/0x40 [ 797.547537][T25444] blkdev_writepages+0x1e/0x30 [ 797.552294][T25444] ? blkdev_readpages+0x40/0x40 [ 797.557128][T25444] do_writepages+0x99/0x1a0 [ 797.561619][T25444] __filemap_fdatawrite_range+0x352/0x470 [ 797.567336][T25444] ? delete_from_page_cache_batch+0x1690/0x1690 [ 797.573587][T25444] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 797.579111][T25444] filemap_write_and_wait_range+0x4b/0xd0 [ 797.584853][T25444] generic_file_direct_write+0x3a2/0x4b0 [ 797.590498][T25444] __generic_file_write_iter+0x2ee/0x630 [ 797.596114][T25444] ? blkdev_write_iter+0x222/0x440 [ 797.601223][T25444] blkdev_write_iter+0x23a/0x440 [ 797.606194][T25444] ? blkdev_close+0xb0/0xb0 [ 797.610702][T25444] ? retint_kernel+0x2d/0x2d [ 797.615344][T25444] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 797.621585][T25444] ? iov_iter_init+0xea/0x220 [ 797.626250][T25444] __vfs_write+0x764/0xb40 [ 797.630663][T25444] ? kernel_read+0x120/0x120 [ 797.635240][T25444] ? retint_kernel+0x2d/0x2d [ 797.639821][T25444] ? apparmor_file_permission+0x25/0x30 [ 797.645353][T25444] ? rw_verify_area+0x118/0x360 [ 797.650204][T25444] vfs_write+0x20c/0x580 [ 797.654462][T25444] ksys_write+0x105/0x260 [ 797.658800][T25444] ? retint_kernel+0x2d/0x2d [ 797.663416][T25444] ? __ia32_sys_read+0xb0/0xb0 [ 797.668187][T25444] __x64_sys_write+0x73/0xb0 [ 797.672760][T25444] ? do_syscall_64+0xbc/0x800 [ 797.677422][T25444] do_syscall_64+0x1a3/0x800 [ 797.682002][T25444] ? syscall_return_slowpath+0x5f0/0x5f0 [ 797.687631][T25444] ? prepare_exit_to_usermode+0x232/0x3b0 [ 797.693337][T25444] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 797.698901][T25444] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 797.704819][T25444] RIP: 0033:0x457ec9 [ 797.708753][T25444] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 797.728337][T25444] RSP: 002b:00007f95cb339c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 797.736731][T25444] RAX: ffffffffffffffda RBX: 00007f95cb339c90 RCX: 0000000000457ec9 [ 797.744683][T25444] RDX: 000000000001200e RSI: 0000000020000440 RDI: 0000000000000007 [ 797.752636][T25444] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 797.760587][T25444] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f95cb33a6d4 [ 797.768555][T25444] R13: 00000000004c70ee R14: 00000000004dc808 R15: 0000000000000008 19:09:58 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6400}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:58 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x3, 0x3, 0x1, {0xa, 0x4e22, 0x5, @loopback, 0x81}}}, 0x32) r2 = accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x1c) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x80, 0x30}, &(0x7f0000000180)=0xc) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000001c0)={r3, 0x72e7}, 0x8) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="9ba0059983bb2c1f0b9eb1063c158a3c27612f91c1b8c3fc9b587992c5513b1086587aa4199db932eb324bebb46a7148d8a6a1592b679dfebfb7c76443db50cdf40345d6413abec14c93b87807748178aa48a297da7bb187ec538bdaddb8a8e5fc38d62974724cecb48a0211b87338401c01e6699da986ffacdf747a73ce6a33573e70059fd62a7aa4c311f33d628bcbf6a3a05ec5b96cc283f9060af936f123c542e45a5ef0276d76cfbfd65d5b3d175af300cdb65481e3f18fad343db8a4f8c4079fa636d1000e1821fa59e044b4b58b3e09092ab887dcf4d6b1cad7ed58f40fec6aa01176e1f6771209d13f8af21a2c103184352f"], 0x1200e) 19:09:58 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7400, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:58 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYRES16=r10, @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe000000208000100020000"], 0x3}}, 0x40000) r11 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:58 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) 19:09:58 executing program 2 (fault-call:20 fault-nth:1): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:58 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7a00, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:58 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x8800, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) [ 798.092421][T25470] FAULT_INJECTION: forcing a failure. [ 798.092421][T25470] name failslab, interval 1, probability 0, space 0, times 0 [ 798.147659][T25470] CPU: 0 PID: 25470 Comm: syz-executor2 Not tainted 4.20.0-next-20190103 #5 [ 798.156405][T25470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 798.166471][T25470] Call Trace: [ 798.169782][T25470] dump_stack+0x1db/0x2d0 [ 798.174131][T25470] ? dump_stack_print_info.cold+0x20/0x20 [ 798.179883][T25470] should_fail.cold+0xa/0x14 [ 798.184492][T25470] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 798.190343][T25470] ? retint_kernel+0x2d/0x2d [ 798.194946][T25470] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 798.200421][T25470] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 798.206593][T25470] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 798.212077][T25470] ? lockdep_hardirqs_on+0x415/0x5d0 [ 798.217378][T25470] __should_failslab+0x121/0x190 [ 798.222324][T25470] should_failslab+0x9/0x14 [ 798.222343][T25470] kmem_cache_alloc_node+0x56/0x710 [ 798.222361][T25470] ? blk_queue_enter+0xda8/0x11e0 [ 798.222389][T25470] create_task_io_context+0xa5/0x550 [ 798.222410][T25470] ? ioc_clear_queue+0x680/0x680 [ 798.247331][T25470] ? retint_kernel+0x2d/0x2d [ 798.251950][T25470] ? generic_make_request_checks+0x671/0x21d0 [ 798.258035][T25470] generic_make_request_checks+0x1c15/0x21d0 [ 798.264049][T25470] ? trace_event_raw_event_block_rq_requeue+0x6e0/0x6e0 [ 798.271011][T25470] ? lockdep_hardirqs_on+0x415/0x5d0 [ 798.276438][T25470] ? retint_kernel+0x2d/0x2d [ 798.281082][T25470] ? trace_hardirqs_on_caller+0xc0/0x310 [ 798.286738][T25470] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 798.292205][T25470] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 798.298395][T25470] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 798.304646][T25470] ? __radix_tree_lookup+0x3aa/0x4f0 [ 798.309943][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.316210][T25470] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 798.321691][T25470] ? retint_kernel+0x2d/0x2d [ 798.326319][T25470] ? generic_make_request+0x61d/0x17f0 [ 798.331808][T25470] generic_make_request+0x2ab/0x17f0 [ 798.337106][T25470] ? bio_associate_blkg_from_css+0x5c4/0xb80 [ 798.343100][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.349364][T25470] ? blk_queue_enter+0x11e0/0x11e0 [ 798.354490][T25470] ? lock_downgrade+0x910/0x910 [ 798.359354][T25470] ? kasan_check_read+0x11/0x20 [ 798.364226][T25470] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 798.370234][T25470] ? rcu_read_unlock_special+0x380/0x380 [ 798.375920][T25470] ? bio_associate_blkg_from_css+0x5eb/0xb80 [ 798.381937][T25470] submit_bio+0xba/0x480 [ 798.386204][T25470] ? submit_bio+0xba/0x480 [ 798.390628][T25470] ? rcu_read_unlock_special+0x380/0x380 [ 798.396292][T25470] ? generic_make_request+0x17f0/0x17f0 [ 798.401862][T25470] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 798.407586][T25470] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 798.413859][T25470] ? wbc_account_io+0x17e/0x2a0 [ 798.418723][T25470] submit_bh_wbc+0x5f7/0x7f0 [ 798.423323][T25470] __block_write_full_page+0x91a/0x1480 [ 798.423348][T25470] ? check_disk_change+0x140/0x140 [ 798.423371][T25470] ? submit_bh_wbc+0x7f0/0x7f0 [ 798.423396][T25470] ? balance_dirty_pages_ratelimited+0x2380/0x2380 [ 798.423425][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.451587][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.457863][T25470] ? check_preemption_disabled+0x48/0x290 [ 798.463603][T25470] block_write_full_page+0x21f/0x270 [ 798.468913][T25470] ? check_disk_change+0x140/0x140 [ 798.474049][T25470] blkdev_writepage+0x25/0x30 [ 798.478736][T25470] __writepage+0x67/0xe0 [ 798.483004][T25470] write_cache_pages+0xbec/0x1ce0 [ 798.488043][T25470] ? __wb_update_bandwidth+0x670/0x670 [ 798.493541][T25470] ? clear_page_dirty_for_io+0x18d0/0x18d0 19:09:59 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x1000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:09:59 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x2000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) [ 798.499370][T25470] ? mark_held_locks+0x100/0x100 [ 798.504332][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.510590][T25470] ? check_preemption_disabled+0x48/0x290 [ 798.516335][T25470] ? debug_smp_processor_id+0x1c/0x20 [ 798.521714][T25470] ? perf_trace_lock+0x12f/0x750 [ 798.526662][T25470] ? debug_smp_processor_id+0x1c/0x20 [ 798.532053][T25470] ? add_lock_to_list.isra.0+0x450/0x450 [ 798.537697][T25470] ? add_lock_to_list.isra.0+0x450/0x450 [ 798.543342][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 19:09:59 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x3000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) [ 798.549594][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.555845][T25470] ? check_preemption_disabled+0x48/0x290 [ 798.561586][T25470] ? trace_event_raw_event_writeback_sb_inodes_requeue+0x533/0x7d0 [ 798.569492][T25470] ? blk_start_plug+0xb5/0x340 [ 798.574298][T25470] ? blk_lld_busy+0xa0/0xa0 [ 798.578826][T25470] generic_writepages+0xed/0x160 [ 798.583769][T25470] ? write_cache_pages+0x1ce0/0x1ce0 [ 798.589084][T25470] ? _raw_spin_unlock+0x2d/0x50 [ 798.594002][T25470] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 798.600258][T25470] ? wbc_attach_and_unlock_inode+0x680/0xa90 [ 798.606289][T25470] blkdev_writepages+0x1e/0x30 [ 798.611063][T25470] ? blkdev_readpages+0x40/0x40 [ 798.615927][T25470] do_writepages+0x99/0x1a0 [ 798.620452][T25470] __filemap_fdatawrite_range+0x352/0x470 [ 798.626203][T25470] ? delete_from_page_cache_batch+0x1690/0x1690 [ 798.632453][T25470] ? generic_update_time+0x268/0x440 [ 798.637759][T25470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 798.644012][T25470] ? __mnt_drop_write+0x5d/0x80 [ 798.644032][T25470] ? __mnt_drop_write_file+0x31/0x40 [ 798.644058][T25470] filemap_write_and_wait_range+0x4b/0xd0 [ 798.644080][T25470] generic_file_direct_write+0x3a2/0x4b0 [ 798.644107][T25470] __generic_file_write_iter+0x2ee/0x630 [ 798.671220][T25470] blkdev_write_iter+0x23a/0x440 [ 798.676519][T25470] ? blkdev_close+0xb0/0xb0 [ 798.681033][T25470] ? retint_kernel+0x2d/0x2d [ 798.685635][T25470] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 798.685656][T25470] ? iov_iter_init+0xea/0x220 [ 798.685680][T25470] __vfs_write+0x764/0xb40 [ 798.685703][T25470] ? kernel_read+0x120/0x120 [ 798.685724][T25470] ? __mutex_unlock_slowpath+0x195/0x870 [ 798.711331][T25470] ? apparmor_file_permission+0x25/0x30 [ 798.716906][T25470] ? rw_verify_area+0x118/0x360 [ 798.721769][T25470] vfs_write+0x20c/0x580 [ 798.726028][T25470] ksys_write+0x105/0x260 [ 798.730370][T25470] ? __ia32_sys_read+0xb0/0xb0 [ 798.735147][T25470] ? trace_hardirqs_off_caller+0x300/0x300 [ 798.740963][T25470] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 798.746436][T25470] __x64_sys_write+0x73/0xb0 [ 798.751033][T25470] do_syscall_64+0x1a3/0x800 [ 798.755638][T25470] ? syscall_return_slowpath+0x5f0/0x5f0 [ 798.761310][T25470] ? prepare_exit_to_usermode+0x232/0x3b0 [ 798.767041][T25470] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 798.772609][T25470] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 798.778536][T25470] RIP: 0033:0x457ec9 19:09:59 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) [ 798.782445][T25470] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 798.802052][T25470] RSP: 002b:00007f95cb339c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 798.802069][T25470] RAX: ffffffffffffffda RBX: 00007f95cb339c90 RCX: 0000000000457ec9 [ 798.802079][T25470] RDX: 000000000001200e RSI: 0000000020000440 RDI: 0000000000000008 [ 798.802089][T25470] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 798.802099][T25470] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f95cb33a6d4 [ 798.802109][T25470] R13: 00000000004c70ee R14: 00000000004dc808 R15: 0000000000000009 19:09:59 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xce02}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:09:59 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:09:59 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) 19:09:59 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:09:59 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x800, 0x0) connect$tipc(r1, &(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x1}}, 0x10) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) getgroups(0x3, &(0x7f0000000000)=[0xffffffffffffffff, 0xee00, 0xee00]) r3 = getegid() setregid(r2, r3) r4 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x0, 0x80) write$P9_RGETLOCK(r4, 0x0, 0xfffffffffffffe50) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r5, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r7, 0x0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x30, r8, 0x100, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x0, 0x5, 0x9, 0x6d}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x800) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r7, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:10:00 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) 19:10:00 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:10:00 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x2000) 19:10:00 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x8011, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)=ANY=[@ANYBLOB="01800000"], 0x1200e) 19:10:00 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) 19:10:01 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:01 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:01 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:01 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x3000) 19:10:01 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400202, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x80000000c0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="73797a3571eee00d02caba1b4796f87e1c839a264fb511797660373ee9b88f52e5fdf487dfd17a60d24c95"], 0x1200e) 19:10:01 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) 19:10:01 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101742, 0x88) ioctl$KVM_GET_FPU(r2, 0x81a0ae8c, &(0x7f0000000580)) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:10:01 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) 19:10:01 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x4000) 19:10:01 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x4, 0x0) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000040)=0x7, 0x4) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:10:01 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:10:01 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) [ 801.834810][T25583] IPVS: ftp: loaded support on port[0] = 21 [ 802.206310][T25583] chnl_net:caif_netlink_parms(): no params data found [ 802.237194][T25583] bridge0: port 1(bridge_slave_0) entered blocking state [ 802.245297][T25583] bridge0: port 1(bridge_slave_0) entered disabled state [ 802.253537][T25583] device bridge_slave_0 entered promiscuous mode [ 802.390148][T25583] bridge0: port 2(bridge_slave_1) entered blocking state [ 802.397312][T25583] bridge0: port 2(bridge_slave_1) entered disabled state [ 802.405231][T25583] device bridge_slave_1 entered promiscuous mode [ 802.422815][T25583] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 802.432739][T25583] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 802.449142][T25583] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 802.457374][T25583] team0: Port device team_slave_0 added [ 802.463472][T25583] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 802.471645][T25583] team0: Port device team_slave_1 added [ 802.477619][T25583] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 802.485738][T25583] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 802.562647][T25583] device hsr_slave_0 entered promiscuous mode [ 802.599820][T25583] device hsr_slave_1 entered promiscuous mode [ 802.640183][T25583] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 802.785142][T25583] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 802.802406][T25583] bridge0: port 2(bridge_slave_1) entered blocking state [ 802.809497][T25583] bridge0: port 2(bridge_slave_1) entered forwarding state [ 802.816859][T25583] bridge0: port 1(bridge_slave_0) entered blocking state [ 802.823995][T25583] bridge0: port 1(bridge_slave_0) entered forwarding state [ 802.998282][T25583] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 803.005192][T25583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 803.015173][T25583] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 803.167759][T25583] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 803.174959][T25583] 8021q: adding VLAN 0 to HW filter on device team0 [ 803.181968][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 803.191774][ T8042] bridge0: port 1(bridge_slave_0) entered disabled state [ 803.202146][ T8042] bridge0: port 2(bridge_slave_1) entered disabled state [ 803.212220][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 803.360579][T25583] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 803.370560][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 803.379121][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 803.387763][ T8049] bridge0: port 1(bridge_slave_0) entered blocking state [ 803.394822][ T8049] bridge0: port 1(bridge_slave_0) entered forwarding state [ 803.541763][T25583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 803.550696][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 803.559394][ T8042] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 803.567705][ T8042] bridge0: port 2(bridge_slave_1) entered blocking state [ 803.574833][ T8042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 803.586771][T25583] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 803.594805][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 803.603990][ T8065] device bridge_slave_1 left promiscuous mode [ 803.611211][ T8065] bridge0: port 2(bridge_slave_1) entered disabled state [ 803.670517][ T8065] device bridge_slave_0 left promiscuous mode [ 803.676691][ T8065] bridge0: port 1(bridge_slave_0) entered disabled state [ 807.494256][ T8065] device hsr_slave_1 left promiscuous mode [ 807.556461][ T8065] device hsr_slave_0 left promiscuous mode [ 807.604503][ T8065] team0 (unregistering): Port device team_slave_1 removed [ 807.617608][ T8065] team0 (unregistering): Port device team_slave_0 removed [ 807.630040][ T8065] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 807.665711][ T8065] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 807.765606][ T8065] bond0 (unregistering): Released all slaves [ 807.877824][T25583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 807.888339][ T8033] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 807.907297][T25583] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 807.915888][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 807.924843][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 807.934972][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 807.945369][T25583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 807.957589][T25583] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 807.967365][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 807.976059][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 807.985383][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 807.993930][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 808.005436][T25583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 808.016471][T25583] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 808.028208][T25583] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 808.035572][T25583] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 808.043650][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 808.052925][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 808.068398][T25583] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 808.085196][T25583] 8021q: adding VLAN 0 to HW filter on device batadv0 19:10:08 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x5000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:08 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:10:08 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:08 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e20, 0xf100, @local, 0x5}}, 0x24) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:10:08 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x5000) 19:10:08 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e21000008000700"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:09 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:09 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:10:09 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x6000) 19:10:09 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x20400, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f00000002c0)={0x53, 0xffffffffffffffff, 0x0, 0x83, @buffer={0x0, 0x2f, &(0x7f0000000140)=""/47}, &(0x7f00000001c0), &(0x7f0000000600)=""/141, 0x4, 0x10022, 0x3, &(0x7f0000000200)}) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f00000005c0)='rxrpc\x00', &(0x7f0000000440), &(0x7f0000000580), 0xf5, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="3579247e032ce7ff36ad7509493f1de93401dde6ccca8293c8a8c3c046d9153986478dc405b093ac11ad7b5f"], 0x1200e) r4 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_G_JPEGCOMP(r4, 0x808c563d, &(0x7f0000000380)) 19:10:09 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:09 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:09 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff08000500090000002000"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:09 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x11000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:10 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x64000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:10 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x7000) 19:10:10 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000000440), 0x10e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x10001, 0x20000) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000580)={0x80000000, 0x0, "41dd2dc8fbdbe3c3f5a8f14792ccb34dac0f201d845bf567e9daa51b379f5055", 0x1f, 0x6, 0x3f, 0x81, 0x4, 0x0, 0x3, 0x800, [0x56, 0x46, 0x4, 0x80000000]}) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000b08000/0x1000)=nil, 0x1000}) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) timer_create(0x5, &(0x7f0000000140)={0x0, 0x20, 0x1, @thr={&(0x7f0000000380)="f107b20b5515d2ab1284efeb1081e3f304b715a84fb52cd2446ac2580d202148acb0e5e231e57b1a986c1525d6f755bc95c207ed788767bf4020deb9ff2df31709fb3706d29bcb37851720009b8c667c5bb1ba537205b86c25b07d22a1ad3080c31718aa90dc7df8e0448dbde40143213d3f0312e0580199f46c97d77e9e7402f81b01626b55f5ecd3fd2a59ac902c90b620af7c1d81fd15e57cc09b72c0eb2919a013d13b", &(0x7f0000000680)="5c01dc410e538861932284f9309f1a84a3f08655578ef9474071d6ed3baa4d8fd01e745956f79a40f2414d2b276b13f959524eee861cb37e89de692fb7e33026fa15bc011a010bc682b6fcba4cd41bc70048d28353462f3caab2ec8bf30f8af177d82f32daec8a679e96d4c4a9b4387f76a52d88c1"}}, &(0x7f0000000280)=0x0) ioctl$SIOCRSGCAUSE(r3, 0x89e0, &(0x7f0000000840)) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(r6, 0x0, &(0x7f0000000700)={{0x77359400}, {r7, r8+30000000}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000980)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xffffffffffffff64) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000440)) write$binfmt_misc(r5, &(0x7f0000000780)=ANY=[@ANYBLOB="7f797a311333ded87612a9a9ec4b39d7db226dd8d878e407dcc7f666a3a6463fb85ed85229f99d99476673229754e3a870282c452ba90fd0edfbf27b9b47c8c521a6c9219bdc72b322ed5fa4f9a8fdce0225cdeced64d4aaa973f35682fac51d143bda228722479e937251854645b53be707d17ef1daea2705b387e21e46ba333507b67f80507a69d6f2c4055345271e00abb39d0493e0aee8132e32643fc79aab17ca6973486bb4e26a02483f2c0da58ffa3b478898554fb9"], 0x1200e) 19:10:10 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x20000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:10 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:10 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x48000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:10 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x9000) 19:10:10 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4c000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:10 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:10 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff08000500090000002000030014000600000000000000000000"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:10 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="8062de373ef8c6b74e0b751f0dab4fb96a0b95adf89c0bf950bfde59186f14d229fb1c14"], 0x1200e) 19:10:10 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x60000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:11 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xce020000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:11 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:11 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x68000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:11 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xa000) 19:10:11 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x9000) 19:10:11 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:11 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6c000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:11 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x74000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:11 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe000000208"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:11 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:12 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7a000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:12 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xb000) 19:10:12 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:12 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xa000) 19:10:12 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x88000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:12 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:12 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xc000) 19:10:12 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x100000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:12 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:12 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) [ 812.243727][T25855] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 [ 812.343712][T25862] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:13 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:13 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x200000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:13 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000000440), 0x10e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x10001, 0x20000) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000580)={0x80000000, 0x0, "41dd2dc8fbdbe3c3f5a8f14792ccb34dac0f201d845bf567e9daa51b379f5055", 0x1f, 0x6, 0x3f, 0x81, 0x4, 0x0, 0x3, 0x800, [0x56, 0x46, 0x4, 0x80000000]}) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000b08000/0x1000)=nil, 0x1000}) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) timer_create(0x5, &(0x7f0000000140)={0x0, 0x20, 0x1, @thr={&(0x7f0000000380)="f107b20b5515d2ab1284efeb1081e3f304b715a84fb52cd2446ac2580d202148acb0e5e231e57b1a986c1525d6f755bc95c207ed788767bf4020deb9ff2df31709fb3706d29bcb37851720009b8c667c5bb1ba537205b86c25b07d22a1ad3080c31718aa90dc7df8e0448dbde40143213d3f0312e0580199f46c97d77e9e7402f81b01626b55f5ecd3fd2a59ac902c90b620af7c1d81fd15e57cc09b72c0eb2919a013d13b", &(0x7f0000000680)="5c01dc410e538861932284f9309f1a84a3f08655578ef9474071d6ed3baa4d8fd01e745956f79a40f2414d2b276b13f959524eee861cb37e89de692fb7e33026fa15bc011a010bc682b6fcba4cd41bc70048d28353462f3caab2ec8bf30f8af177d82f32daec8a679e96d4c4a9b4387f76a52d88c1"}}, &(0x7f0000000280)=0x0) ioctl$SIOCRSGCAUSE(r3, 0x89e0, &(0x7f0000000840)) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(r6, 0x0, &(0x7f0000000700)={{0x77359400}, {r7, r8+30000000}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000980)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xffffffffffffff64) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000440)) write$binfmt_misc(r5, &(0x7f0000000780)=ANY=[@ANYBLOB="7f797a311333ded87612a9a9ec4b39d7db226dd8d878e407dcc7f666a3a6463fb85ed85229f99d99476673229754e3a870282c452ba90fd0edfbf27b9b47c8c521a6c9219bdc72b322ed5fa4f9a8fdce0225cdeced64d4aaa973f35682fac51d143bda228722479e937251854645b53be707d17ef1daea2705b387e21e46ba333507b67f80507a69d6f2c4055345271e00abb39d0493e0aee8132e32643fc79aab17ca6973486bb4e26a02483f2c0da58ffa3b478898554fb9"], 0x1200e) 19:10:13 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xd000) [ 812.693845][T25874] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:13 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:13 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x300000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:13 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:13 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000000440), 0x10e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x10001, 0x20000) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000580)={0x80000000, 0x0, "41dd2dc8fbdbe3c3f5a8f14792ccb34dac0f201d845bf567e9daa51b379f5055", 0x1f, 0x6, 0x3f, 0x81, 0x4, 0x0, 0x3, 0x800, [0x56, 0x46, 0x4, 0x80000000]}) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000b08000/0x1000)=nil, 0x1000}) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) timer_create(0x5, &(0x7f0000000140)={0x0, 0x20, 0x1, @thr={&(0x7f0000000380)="f107b20b5515d2ab1284efeb1081e3f304b715a84fb52cd2446ac2580d202148acb0e5e231e57b1a986c1525d6f755bc95c207ed788767bf4020deb9ff2df31709fb3706d29bcb37851720009b8c667c5bb1ba537205b86c25b07d22a1ad3080c31718aa90dc7df8e0448dbde40143213d3f0312e0580199f46c97d77e9e7402f81b01626b55f5ecd3fd2a59ac902c90b620af7c1d81fd15e57cc09b72c0eb2919a013d13b", &(0x7f0000000680)="5c01dc410e538861932284f9309f1a84a3f08655578ef9474071d6ed3baa4d8fd01e745956f79a40f2414d2b276b13f959524eee861cb37e89de692fb7e33026fa15bc011a010bc682b6fcba4cd41bc70048d28353462f3caab2ec8bf30f8af177d82f32daec8a679e96d4c4a9b4387f76a52d88c1"}}, &(0x7f0000000280)=0x0) ioctl$SIOCRSGCAUSE(r3, 0x89e0, &(0x7f0000000840)) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(r6, 0x0, &(0x7f0000000700)={{0x77359400}, {r7, r8+30000000}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000980)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xffffffffffffff64) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000440)) write$binfmt_misc(r5, &(0x7f0000000780)=ANY=[@ANYBLOB="7f797a311333ded87612a9a9ec4b39d7db226dd8d878e407dcc7f666a3a6463fb85ed85229f99d99476673229754e3a870282c452ba90fd0edfbf27b9b47c8c521a6c9219bdc72b322ed5fa4f9a8fdce0225cdeced64d4aaa973f35682fac51d143bda228722479e937251854645b53be707d17ef1daea2705b387e21e46ba333507b67f80507a69d6f2c4055345271e00abb39d0493e0aee8132e32643fc79aab17ca6973486bb4e26a02483f2c0da58ffa3b478898554fb9"], 0x1200e) 19:10:13 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe000000208000100020000"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:14 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xe000) [ 813.357815][T25902] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 [ 813.399963][T25907] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:14 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x400000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:14 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:14 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000000440), 0x10e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x10001, 0x20000) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000580)={0x80000000, 0x0, "41dd2dc8fbdbe3c3f5a8f14792ccb34dac0f201d845bf567e9daa51b379f5055", 0x1f, 0x6, 0x3f, 0x81, 0x4, 0x0, 0x3, 0x800, [0x56, 0x46, 0x4, 0x80000000]}) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000b08000/0x1000)=nil, 0x1000}) ioctl$void(0xffffffffffffffff, 0xc0045878) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) timer_create(0x5, &(0x7f0000000140)={0x0, 0x20, 0x1, @thr={&(0x7f0000000380)="f107b20b5515d2ab1284efeb1081e3f304b715a84fb52cd2446ac2580d202148acb0e5e231e57b1a986c1525d6f755bc95c207ed788767bf4020deb9ff2df31709fb3706d29bcb37851720009b8c667c5bb1ba537205b86c25b07d22a1ad3080c31718aa90dc7df8e0448dbde40143213d3f0312e0580199f46c97d77e9e7402f81b01626b55f5ecd3fd2a59ac902c90b620af7c1d81fd15e57cc09b72c0eb2919a013d13b", &(0x7f0000000680)="5c01dc410e538861932284f9309f1a84a3f08655578ef9474071d6ed3baa4d8fd01e745956f79a40f2414d2b276b13f959524eee861cb37e89de692fb7e33026fa15bc011a010bc682b6fcba4cd41bc70048d28353462f3caab2ec8bf30f8af177d82f32daec8a679e96d4c4a9b4387f76a52d88c1"}}, &(0x7f0000000280)=0x0) ioctl$SIOCRSGCAUSE(r3, 0x89e0, &(0x7f0000000840)) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(r6, 0x0, &(0x7f0000000700)={{0x77359400}, {r7, r8+30000000}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000980)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xffffffffffffff64) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r5, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000440)) write$binfmt_misc(r5, &(0x7f0000000780)=ANY=[@ANYBLOB="7f797a311333ded87612a9a9ec4b39d7db226dd8d878e407dcc7f666a3a6463fb85ed85229f99d99476673229754e3a870282c452ba90fd0edfbf27b9b47c8c521a6c9219bdc72b322ed5fa4f9a8fdce0225cdeced64d4aaa973f35682fac51d143bda228722479e937251854645b53be707d17ef1daea2705b387e21e46ba333507b67f80507a69d6f2c4055345271e00abb39d0493e0aee8132e32643fc79aab17ca6973486bb4e26a02483f2c0da58ffa3b478898554fb9"], 0x1200e) [ 813.632050][T25921] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:14 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x500000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:14 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x600000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:14 executing program 5: openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) [ 814.206084][T25942] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 [ 814.285904][T25945] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:15 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6400000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:15 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xf000) 19:10:15 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xd000) 19:10:15 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0x1}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:15 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:15 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x700000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) [ 814.578774][T25961] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:15 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x1100000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) [ 814.629415][T25968] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 19:10:15 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:15 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x2000000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:15 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:15 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xc000) 19:10:15 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4800000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:16 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xce02000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:16 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x11000) 19:10:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:16 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB], 0x1}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:16 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x4c00000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:16 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xc000) 19:10:16 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6000000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 19:10:16 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xc000) 19:10:16 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6800000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x0) 19:10:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x0) 19:10:17 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:17 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x12000) 19:10:17 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x6c00000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:17 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x0) 19:10:17 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xf000) 19:10:17 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000"], 0x1}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:17 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7400000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:17 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e20, 0xf100, @local, 0x5}}, 0x24) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) 19:10:17 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x7a00000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:17 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="b5feffff", @ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff0800050009000000200003001400060000000000000000000000ffffe00000020800010002000000"], 0x2}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:17 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x8800000000000000, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:17 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200d) [ 817.378686][T26118] xt_check_target: 18 callbacks suppressed [ 817.378702][T26118] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 [ 817.453577][T26122] dccp_check_seqno: Step 6 failed for RESET packet, (LSWL(174730195411625) <= P.seqno(0) <= S.SWH(174730195411699)) and (P.ackno exists or LAWL(272366518180637) <= P.ackno(272366518180638) <= S.AWH(272366518180638), sending SYNC... [ 817.531242][T26111] dccp_close: ABORT with 1061 bytes unread 19:10:18 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x64}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:18 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0xf000) 19:10:18 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x2, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:18 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e21000008000700"], 0x1}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) 19:10:18 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x12000) 19:10:18 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200f) 19:10:18 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x3, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:18 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x4, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:18 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x5, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:18 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x12010) 19:10:19 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200f) 19:10:19 executing program 0 (fault-call:2 fault-nth:0): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) [ 818.536287][T26185] FAULT_INJECTION: forcing a failure. [ 818.536287][T26185] name failslab, interval 1, probability 0, space 0, times 0 [ 818.610824][T26185] CPU: 1 PID: 26185 Comm: syz-executor0 Not tainted 4.20.0-next-20190103 #5 [ 818.619594][T26185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 818.629672][T26185] Call Trace: [ 818.632992][T26185] dump_stack+0x1db/0x2d0 [ 818.637375][T26185] ? dump_stack_print_info.cold+0x20/0x20 [ 818.643121][T26185] should_fail.cold+0xa/0x14 [ 818.647735][T26185] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 818.653564][T26185] ? ___might_sleep+0x1e7/0x310 [ 818.658432][T26185] ? arch_local_save_flags+0x50/0x50 [ 818.663746][T26185] ? print_usage_bug+0xd0/0xd0 [ 818.668542][T26185] ? print_usage_bug+0xd0/0xd0 [ 818.673330][T26185] __should_failslab+0x121/0x190 [ 818.678311][T26185] should_failslab+0x9/0x14 [ 818.682849][T26185] kmem_cache_alloc_node+0x265/0x710 [ 818.688149][T26185] ? __lock_acquire+0x572/0x4a10 [ 818.693140][T26185] __alloc_skb+0xf4/0x730 [ 818.697495][T26185] ? skb_trim+0x190/0x190 [ 818.701843][T26185] ? __lock_acquire+0x572/0x4a10 19:10:19 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r2, 0x0, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2ce}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:10:19 executing program 4: write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x6, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x90, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c2000000000000000000000070000000e0000000180100006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000081000000000000000000000000000000000000ffffffff00000000736e61740000000000000000000000000000000000000000000000000005000010000000000000800000000000000000fdffffff00000000"]}, 0x220) 19:10:19 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) chroot(&(0x7f0000000840)='./file0\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000300)=0x84) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) getsockname(r1, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000440)=0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='team0\x00', 0xfffffffffffffff9) keyctl$get_security(0x11, r6, &(0x7f0000000600)=""/232, 0xe8) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r5, 0x80045301, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r8, &(0x7f0000001d00)=ANY=[@ANYRES16=r2, @ANYRES32=r8, @ANYRESHEX=r0, @ANYRES32=r4, @ANYRESOCT=r7], 0xfec0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x46000, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r9, 0x40086408, &(0x7f0000000900)={0x100000001, 0x408}) setsockopt$sock_int(r8, 0x1, 0x10, &(0x7f0000000040)=0x8000000, 0x4) recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/3, 0x3}, 0x42) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r3, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000100}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)=ANY=[@ANYBLOB="300825bd7000fbdbdf250600000018000300140002007465716c30000000000000000000000078000300080007004e2200000000000000000000080003000400000008000500e000000108000300010000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f30000000001400060000000000000000000000ffffe00000020800050000000007080001000100000024000200080008009f000000080002004e2100000800070006000000080005000000008008000500f7ffffff08000500090000002000"], 0x1}}, 0x40000) r10 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000100)='team0\x00', 0x10) sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1}}], 0x1, 0x0) [ 818.706782][T26185] ? check_noncircular+0x20/0x20 [ 818.711738][T26185] alloc_skb_with_frags+0x13a/0x770 [ 818.716973][T26185] ? mark_held_locks+0x100/0x100 [ 818.721937][T26185] ? rcu_read_unlock_special+0x380/0x380 [ 818.727596][T26185] ? skb_complete_wifi_ack+0x1b0/0x1b0 [ 818.727616][T26185] ? mark_held_locks+0x100/0x100 [ 818.727636][T26185] ? print_usage_bug+0xd0/0xd0 [ 818.742820][T26185] sock_alloc_send_pskb+0x8c9/0xad0 [ 818.742852][T26185] ? __lock_acquire+0x572/0x4a10 [ 818.742869][T26185] ? check_noncircular+0x20/0x20 [ 818.742890][T26185] ? sock_wmalloc+0x1f0/0x1f0 [ 818.742907][T26185] ? print_usage_bug+0xd0/0xd0 [ 818.742930][T26185] ? ip6_mtu+0x39c/0x520 [ 818.742946][T26185] ? find_held_lock+0x35/0x120 [ 818.742961][T26185] ? ip6_mtu+0x39c/0x520 [ 818.742984][T26185] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 818.787638][T26185] sock_alloc_send_skb+0x32/0x40 [ 818.792594][T26185] __ip6_append_data.isra.0+0x2556/0x3f20 [ 818.798330][T26185] ? rcu_read_unlock_special+0x380/0x380 [ 818.803992][T26185] ? ip_reply_glue_bits+0xc0/0xc0 [ 818.809057][T26185] ? dst_output+0x180/0x180 [ 818.813594][T26185] ? ip6_setup_cork+0x1202/0x1a60 [ 818.818652][T26185] ? ip6_autoflowlabel.part.0+0x70/0x70 [ 818.824231][T26185] ? ip6_dst_hoplimit+0x2c8/0x4c0 [ 818.829283][T26185] ip6_make_skb+0x391/0x5f0 [ 818.833809][T26185] ? ip_reply_glue_bits+0xc0/0xc0 [ 818.838857][T26185] ? ip_reply_glue_bits+0xc0/0xc0 [ 818.843900][T26185] ? ip6_push_pending_frames+0xf0/0xf0 [ 818.849370][T26185] ? rcu_read_unlock_special+0x380/0x380 [ 818.855044][T26185] ? ip6_dst_hoplimit+0xd1/0x4c0 [ 818.859998][T26185] ? ipv6_select_ident+0x170/0x170 [ 818.865133][T26185] udpv6_sendmsg+0x2b58/0x3550 [ 818.869912][T26185] ? mark_held_locks+0x100/0x100 [ 818.874862][T26185] ? ip_reply_glue_bits+0xc0/0xc0 [ 818.879925][T26185] ? udp6_unicast_rcv_skb.isra.0+0x2f0/0x2f0 [ 818.885945][T26185] ? aa_profile_af_perm+0x420/0x420 [ 818.891156][T26185] ? mark_held_locks+0x100/0x100 [ 818.896113][T26185] ? find_held_lock+0x35/0x120 [ 818.900892][T26185] ? ___might_sleep+0x1e7/0x310 [ 818.905761][T26185] ? arch_local_save_flags+0x50/0x50 [ 818.911132][T26185] ? aa_af_perm+0x5d0/0x5d0 [ 818.915676][T26185] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 818.921962][T26185] inet_sendmsg+0x1af/0x740 [ 818.926491][T26185] ? udp6_unicast_rcv_skb.isra.0+0x2f0/0x2f0 [ 818.932519][T26185] ? inet_sendmsg+0x1af/0x740 [ 818.937229][T26185] ? ipip_gro_receive+0x100/0x100 [ 818.942292][T26185] ? apparmor_socket_sendmsg+0x2a/0x30 [ 818.947782][T26185] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 818.954047][T26185] ? security_socket_sendmsg+0x93/0xc0 [ 818.959521][T26185] ? ipip_gro_receive+0x100/0x100 [ 818.964561][T26185] sock_sendmsg+0xdd/0x130 [ 818.969002][T26185] ___sys_sendmsg+0x409/0x910 [ 818.973758][T26185] ? copy_msghdr_from_user+0x570/0x570 [ 818.979243][T26185] ? ksys_dup3+0x660/0x660 [ 818.983703][T26185] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 818.989996][T26185] ? add_lock_to_list.isra.0+0x450/0x450 [ 818.995665][T26185] ? kasan_check_read+0x11/0x20 [ 819.000617][T26185] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 819.006637][T26185] ? __fget_light+0x2db/0x420 [ 819.011350][T26185] ? fget_raw+0x20/0x20 [ 819.015525][T26185] ? find_held_lock+0x35/0x120 [ 819.020317][T26185] ? __f_unlock_pos+0x19/0x20 [ 819.025037][T26185] ? proc_fail_nth_write+0xa0/0x220 [ 819.030262][T26185] ? __fdget+0x1b/0x20 [ 819.034356][T26185] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 819.040646][T26185] ? sockfd_lookup_light+0xc2/0x160 [ 819.045874][T26185] __sys_sendmmsg+0x246/0x6f0 [ 819.050582][T26185] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 819.055624][T26185] ? wait_for_completion+0x810/0x810 [ 819.060952][T26185] ? __sb_end_write+0xd9/0x110 [ 819.065736][T26185] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 819.071994][T26185] ? fput+0x128/0x1a0 [ 819.075994][T26185] ? do_syscall_64+0x8c/0x800 [ 819.080686][T26185] ? do_syscall_64+0x8c/0x800 [ 819.085408][T26185] ? trace_hardirqs_on+0xbd/0x310 [ 819.090443][T26185] ? __ia32_sys_read+0xb0/0xb0 [ 819.095221][T26185] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 819.101312][T26185] ? trace_hardirqs_off_caller+0x300/0x300 [ 819.107161][T26185] __x64_sys_sendmmsg+0x9d/0x100 [ 819.112135][T26185] do_syscall_64+0x1a3/0x800 [ 819.116762][T26185] ? syscall_return_slowpath+0x5f0/0x5f0 [ 819.122431][T26185] ? prepare_exit_to_usermode+0x232/0x3b0 [ 819.128191][T26185] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 819.133780][T26185] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 819.139696][T26185] RIP: 0033:0x457ec9 [ 819.143616][T26185] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 819.163242][T26185] RSP: 002b:00007f133bc9ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 819.171713][T26185] RAX: ffffffffffffffda RBX: 00007f133bc9ec90 RCX: 0000000000457ec9 [ 819.179709][T26185] RDX: 08000000000000fc RSI: 0000000020005fc0 RDI: 0000000000000003 [ 819.187712][T26185] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 819.195713][T26185] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f133bc9f6d4 [ 819.203713][T26185] R13: 00000000004c4ce5 R14: 00000000004d85d8 R15: 0000000000000004 [ 819.248783][T26176] ================================================================== [ 819.257342][T26176] BUG: KASAN: use-after-free in filemap_fault+0x25f5/0x2a00 [ 819.264660][T26176] Read of size 8 at addr ffff88808e1e79c8 by task syz-executor2/26176 [ 819.273328][T26176] [ 819.275678][T26176] CPU: 1 PID: 26176 Comm: syz-executor2 Not tainted 4.20.0-next-20190103 #5 [ 819.284359][T26176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 819.294435][T26176] Call Trace: [ 819.297753][T26176] dump_stack+0x1db/0x2d0 [ 819.302111][T26176] ? dump_stack_print_info.cold+0x20/0x20 [ 819.307872][T26176] ? filemap_fault+0x25f5/0x2a00 [ 819.312847][T26176] print_address_description.cold+0x7c/0x20d [ 819.318853][T26176] ? filemap_fault+0x25f5/0x2a00 [ 819.323817][T26176] ? filemap_fault+0x25f5/0x2a00 [ 819.328778][T26176] kasan_report.cold+0x1b/0x40 [ 819.333580][T26176] ? filemap_fault+0x25f5/0x2a00 [ 819.338538][T26176] __asan_report_load8_noabort+0x14/0x20 [ 819.344200][T26176] filemap_fault+0x25f5/0x2a00 [ 819.348992][T26176] ? pagecache_get_page+0x1070/0x1070 [ 819.354391][T26176] ? error_exit+0xb/0x20 [ 819.358649][T26176] ? trace_hardirqs_off_caller+0xbb/0x300 [ 819.364402][T26176] ? trace_hardirqs_off+0x310/0x310 [ 819.369630][T26176] ? find_get_entries_tag+0x13d0/0x13d0 [ 819.375202][T26176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 819.380767][T26176] ? add_lock_to_list.isra.0+0x450/0x450 [ 819.386424][T26176] ? native_iret+0x7/0x7 [ 819.390677][T26176] ? error_exit+0xb/0x20 [ 819.394937][T26176] ? __handle_mm_fault+0x42e1/0x55a0 [ 819.400245][T26176] ? __handle_mm_fault+0x42e1/0x55a0 [ 819.405557][T26176] ? find_held_lock+0x35/0x120 [ 819.410346][T26176] ? __handle_mm_fault+0x42e1/0x55a0 [ 819.415694][T26176] __do_fault+0x176/0x7b0 [ 819.420040][T26176] ? do_page_mkwrite+0x740/0x740 [ 819.424991][T26176] ? do_raw_spin_unlock+0xa0/0x330 [ 819.430141][T26176] ? do_raw_spin_trylock+0x270/0x270 [ 819.435455][T26176] ? add_mm_counter_fast.part.0+0x40/0x40 [ 819.441207][T26176] __handle_mm_fault+0x370a/0x55a0 [ 819.446356][T26176] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 819.451930][T26176] ? handle_mm_fault+0x3cc/0xc80 [ 819.456903][T26176] ? lock_downgrade+0x910/0x910 [ 819.461767][T26176] ? kasan_check_read+0x11/0x20 [ 819.466638][T26176] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 819.472629][T26176] ? rcu_read_unlock_special+0x380/0x380 [ 819.478301][T26176] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 819.484595][T26176] ? check_preemption_disabled+0x48/0x290 [ 819.490368][T26176] handle_mm_fault+0x4ec/0xc80 [ 819.495148][T26176] ? __handle_mm_fault+0x55a0/0x55a0 [ 819.500459][T26176] __do_page_fault+0x5da/0xd60 [ 819.505233][T26176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 819.510808][T26176] do_page_fault+0xe6/0x7d8 [ 819.515331][T26176] ? vmalloc_sync_all+0x30/0x30 [ 819.520224][T26176] ? find_held_lock+0x35/0x120 [ 819.524999][T26176] ? __might_fault+0x12b/0x1e0 [ 819.529782][T26176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 819.535356][T26176] page_fault+0x1e/0x30 [ 819.539532][T26176] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 819.545888][T26176] Code: 4c 8b 5e 38 4c 89 47 20 4c 89 4f 28 4c 89 57 30 4c 89 5f 38 48 8d 76 40 48 8d 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 <4c> 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 [ 819.565531][T26176] RSP: 0018:ffff88805a0a7848 EFLAGS: 00010202 [ 819.571613][T26176] RAX: ffffed100b414f20 RBX: 0000000000000038 RCX: 0000000000000007 [ 819.579600][T26176] RDX: 0000000000000000 RSI: 0000000020005fc0 RDI: ffff88805a0a78c8 [ 819.587585][T26176] RBP: ffff88805a0a7880 R08: 1ffff1100b414f19 R09: ffffed100b414f20 [ 819.595576][T26176] R10: ffffed100b414f1f R11: ffff88805a0a78ff R12: 0000000020005fc0 [ 819.603573][T26176] R13: 0000000020005ff8 R14: ffff88805a0a78c8 R15: 00007ffffffff000 [ 819.611600][T26176] ? _copy_from_user+0x10b/0x150 [ 819.616565][T26176] copy_msghdr_from_user+0xa0/0x570 [ 819.621782][T26176] ? move_addr_to_kernel.part.0+0x110/0x110 [ 819.627720][T26176] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 819.633721][T26176] ? rcu_read_unlock_special+0x380/0x380 [ 819.639410][T26176] ___sys_sendmsg+0x132/0x910 [ 819.644118][T26176] ? copy_msghdr_from_user+0x570/0x570 [ 819.649589][T26176] ? ksys_dup3+0x660/0x660 [ 819.654027][T26176] ? error_exit+0xb/0x20 [ 819.658294][T26176] ? trace_hardirqs_off_caller+0xbb/0x300 [ 819.664044][T26176] ? do_futex+0x1b0/0x2910 [ 819.668483][T26176] ? __fget_light+0x2db/0x420 [ 819.673455][T26176] ? fget_raw+0x20/0x20 [ 819.677641][T26176] ? native_iret+0x7/0x7 [ 819.681894][T26176] ? error_exit+0xb/0x20 [ 819.686145][T26176] ? __might_fault+0x12b/0x1e0 [ 819.690918][T26176] ? __might_fault+0x12b/0x1e0 [ 819.695697][T26176] ? __fdget+0x1b/0x20 [ 819.699770][T26176] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 819.706029][T26176] ? sockfd_lookup_light+0xc2/0x160 [ 819.711254][T26176] __sys_sendmmsg+0x246/0x6f0 [ 819.715961][T26176] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 819.721017][T26176] ? kasan_check_read+0x11/0x20 [ 819.725879][T26176] ? _copy_to_user+0xc9/0x120 [ 819.730591][T26176] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 819.736847][T26176] ? put_timespec64+0x115/0x1b0 [ 819.741711][T26176] ? nsecs_to_jiffies+0x30/0x30 [ 819.746576][T26176] ? do_syscall_64+0x8c/0x800 [ 819.751310][T26176] ? do_syscall_64+0x8c/0x800 [ 819.756008][T26176] ? trace_hardirqs_on+0xbd/0x310 [ 819.761049][T26176] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 819.767316][T26176] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 819.773421][T26176] ? trace_hardirqs_off_caller+0x300/0x300 [ 819.779244][T26176] __x64_sys_sendmmsg+0x9d/0x100 [ 819.784237][T26176] do_syscall_64+0x1a3/0x800 [ 819.788845][T26176] ? syscall_return_slowpath+0x5f0/0x5f0 [ 819.794499][T26176] ? prepare_exit_to_usermode+0x232/0x3b0 [ 819.800247][T26176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 819.805835][T26176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 819.811747][T26176] RIP: 0033:0x457ec9 [ 819.815659][T26176] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 819.835318][T26176] RSP: 002b:00007f95cb35ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 819.843751][T26176] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457ec9 [ 819.851739][T26176] RDX: 08000000000000fc RSI: 0000000020005fc0 RDI: 000000000000000a [ 819.859726][T26176] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 819.867717][T26176] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f95cb35b6d4 [ 819.875712][T26176] R13: 00000000004c4ce5 R14: 00000000004d85d8 R15: 00000000ffffffff [ 819.883730][T26176] [ 819.886070][T26176] Allocated by task 26179: [ 819.890500][T26176] save_stack+0x45/0xd0 [ 819.894660][T26176] kasan_kmalloc+0xcf/0xe0 [ 819.899088][T26176] kasan_slab_alloc+0xf/0x20 [ 819.903690][T26176] kmem_cache_alloc+0x12d/0x710 [ 819.908564][T26176] vm_area_alloc+0x7a/0x1d0 [ 819.913084][T26176] mmap_region+0x93b/0x1ca0 [ 819.917602][T26176] do_mmap+0xa09/0x1220 [ 819.921790][T26176] vm_mmap_pgoff+0x20b/0x2b0 [ 819.926407][T26176] ksys_mmap_pgoff+0x4f8/0x650 [ 819.931177][T26176] __x64_sys_mmap+0xe9/0x1b0 [ 819.935779][T26176] do_syscall_64+0x1a3/0x800 [ 819.940388][T26176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 819.946297][T26176] [ 819.948627][T26176] Freed by task 26186: [ 819.952729][T26176] save_stack+0x45/0xd0 [ 819.956887][T26176] __kasan_slab_free+0x102/0x150 [ 819.961836][T26176] kasan_slab_free+0xe/0x10 [ 819.966373][T26176] kmem_cache_free+0x86/0x260 [ 819.971058][T26176] vm_area_free+0x1d/0x30 [ 819.975399][T26176] remove_vma+0x142/0x180 [ 819.979730][T26176] __do_munmap+0x72e/0xef0 [ 819.984163][T26176] mmap_region+0x698/0x1ca0 [ 819.988697][T26176] do_mmap+0xa09/0x1220 [ 819.992861][T26176] vm_mmap_pgoff+0x20b/0x2b0 [ 819.997470][T26176] ksys_mmap_pgoff+0x4f8/0x650 [ 820.002254][T26176] __x64_sys_mmap+0xe9/0x1b0 [ 820.006858][T26176] do_syscall_64+0x1a3/0x800 [ 820.011453][T26176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 820.017358][T26176] [ 820.019702][T26176] The buggy address belongs to the object at ffff88808e1e7988 [ 820.019702][T26176] which belongs to the cache vm_area_struct(65:syz2) of size 200 [ 820.034838][T26176] The buggy address is located 64 bytes inside of [ 820.034838][T26176] 200-byte region [ffff88808e1e7988, ffff88808e1e7a50) [ 820.048038][T26176] The buggy address belongs to the page: [ 820.053702][T26176] page:ffffea00023879c0 count:1 mapcount:0 mapping:ffff88808d6704c0 index:0xffff88808e1e7460 [ 820.063879][T26176] flags: 0x1fffc0000000200(slab) [ 820.068857][T26176] raw: 01fffc0000000200 ffffea0002439748 ffffea000135a408 ffff88808d6704c0 [ 820.077472][T26176] raw: ffff88808e1e7460 ffff88808e1e7040 000000010000000a ffff888056e62d00 [ 820.086109][T26176] page dumped because: kasan: bad access detected [ 820.092549][T26176] page->mem_cgroup:ffff888056e62d00 [ 820.097757][T26176] [ 820.100093][T26176] Memory state around the buggy address: [ 820.105743][T26176] ffff88808e1e7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 820.113839][T26176] ffff88808e1e7900: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 820.121936][T26176] >ffff88808e1e7980: fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 820.130023][T26176] ^ [ 820.136468][T26176] ffff88808e1e7a00: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 820.144769][T26176] ffff88808e1e7a80: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 820.152860][T26176] ================================================================== [ 820.160937][T26176] Disabling lock debugging due to kernel taint [ 820.175813][T26191] ------------[ cut here ]------------ [ 820.181320][T26191] downgrading a read lock [ 820.181427][T26191] WARNING: CPU: 1 PID: 26191 at kernel/locking/lockdep.c:3553 lock_downgrade+0x4d2/0x910 [ 820.195560][T26191] Kernel panic - not syncing: panic_on_warn set ... 19:10:20 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200f) [ 820.202172][T26191] CPU: 1 PID: 26191 Comm: blkid Tainted: G B 4.20.0-next-20190103 #5 [ 820.211550][T26191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 820.221608][T26191] Call Trace: [ 820.224918][T26191] dump_stack+0x1db/0x2d0 [ 820.228920][ T3864] kobject: 'nullb0' (00000000d679549a): kobject_uevent_env [ 820.229255][T26191] ? dump_stack_print_info.cold+0x20/0x20 [ 820.229288][T26191] ? lock_downgrade+0x450/0x910 [ 820.229304][T26191] panic+0x2cb/0x65c [ 820.229318][T26191] ? add_taint.cold+0x16/0x16 [ 820.229337][T26191] ? lock_downgrade+0x4d2/0x910 [ 820.248491][ T3864] kobject: 'nullb0' (00000000d679549a): fill_kobj_path: path = '/devices/virtual/block/nullb0' [ 820.251011][T26191] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 820.251024][T26191] ? __probe_kernel_read+0x1f4/0x250 [ 820.251040][T26191] ? __warn.cold+0x5/0x48 [ 820.251053][T26191] ? __warn+0xe8/0x1d0 [ 820.251068][T26191] ? lock_downgrade+0x4d2/0x910 [ 820.251081][T26191] __warn.cold+0x20/0x48 [ 820.251099][T26191] ? lock_downgrade+0x4d2/0x910 [ 820.273619][ T3864] kobject: 'loop5' (0000000038652018): kobject_uevent_env [ 820.277697][T26191] report_bug+0x263/0x2b0 [ 820.277717][T26191] do_error_trap+0x11b/0x200 [ 820.277737][T26191] do_invalid_op+0x37/0x50 [ 820.303723][ T3864] kobject: 'loop5' (0000000038652018): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 820.305351][T26191] ? lock_downgrade+0x4d2/0x910 [ 820.305370][T26191] invalid_op+0x14/0x20 [ 820.305383][T26191] RIP: 0010:lock_downgrade+0x4d2/0x910 [ 820.305404][T26191] Code: 00 00 00 fc ff df 41 c6 04 06 f8 e9 1f ff ff ff 48 c7 c7 80 a7 4b 88 4c 89 8d 58 ff ff ff 48 89 85 60 ff ff ff e8 ee 14 e7 ff <0f> 0b 48 8b 85 60 ff ff ff 4c 8d 5d d8 4c 89 f1 48 ba 00 00 00 00 [ 820.370017][T26191] RSP: 0018:ffff8880882e7bb8 EFLAGS: 00010082 [ 820.376093][T26191] RAX: 0000000000000000 RBX: 1ffff1101105cf7d RCX: 0000000000000000 [ 820.384076][T26191] RDX: 0000000000000000 RSI: ffffffff81685116 RDI: 0000000000000006 [ 820.392059][T26191] RBP: ffff8880882e7c70 R08: ffff888091242380 R09: fffffbfff1333291 [ 820.400038][T26191] R10: fffffbfff1333290 R11: ffffffff89999483 R12: ffff888091242380 [ 820.408033][T26191] R13: ffffffff8b56ca20 R14: ffff8880882e7c08 R15: 0000000000000001 [ 820.416062][T26191] ? vprintk_func+0x86/0x189 [ 820.420668][T26191] ? lock_downgrade+0x4d2/0x910 [ 820.425527][T26191] ? __do_munmap+0xc5a/0xef0 [ 820.430127][T26191] ? lock_set_class+0x820/0x820 [ 820.434980][T26191] ? lock_acquire+0x1db/0x570 [ 820.439676][T26191] ? __vm_munmap+0xfa/0x1f0 [ 820.444179][T26191] ? __sanitizer_cov_trace_cmp8+0x18/0x20 19:10:21 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) fcntl$getownex(r0, 0x10, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0xc0045878) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000480)=""/220) connect$l2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4}}, 0xfffffffffffffec1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200f) [ 820.449068][ T3864] kobject: 'nullb0' (00000000d679549a): kobject_uevent_env [ 820.449901][T26191] ? userfaultfd_unmap_prep+0x456/0x5e0 [ 820.449916][T26191] downgrade_write+0x76/0x270 [ 820.449929][T26191] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 820.449947][T26191] ? up_read+0x2b0/0x2b0 [ 820.457183][ T3864] kobject: 'nullb0' (00000000d679549a): fill_kobj_path: path = '/devices/virtual/block/nullb0' [ 820.462704][T26191] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 820.462722][T26191] ? vma_compute_subtree_gap+0x158/0x230 [ 820.462732][T26191] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 820.462745][T26191] __do_munmap+0xc5a/0xef0 [ 820.462762][T26191] __vm_munmap+0x139/0x1f0 [ 820.462776][T26191] ? __do_munmap+0xef0/0xef0 [ 820.462800][T26191] ? __ia32_sys_fallocate+0xf0/0xf0 [ 820.487055][ T3864] kobject: 'loop5' (0000000038652018): kobject_uevent_env [ 820.488265][T26191] ? trace_hardirqs_off_caller+0x300/0x300 [ 820.488296][T26191] __x64_sys_munmap+0x67/0x80 [ 820.488314][T26191] do_syscall_64+0x1a3/0x800 [ 820.488336][T26191] ? syscall_return_slowpath+0x5f0/0x5f0 [ 820.510236][ T3864] kobject: 'loop5' (0000000038652018): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 820.514262][T26191] ? lockdep_sys_exit+0x49/0x5c [ 820.514291][T26191] ? prepare_exit_to_usermode+0x232/0x3b0 [ 820.514308][T26191] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 820.514331][T26191] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 820.583991][T26191] RIP: 0033:0x7f767ea95417 [ 820.588423][T26191] Code: f0 ff ff 73 01 c3 48 8d 0d 8a ad 20 00 31 d2 48 29 c2 89 11 48 83 c8 ff eb eb 90 90 90 90 90 90 90 90 90 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 5d ad 20 00 31 d2 48 29 c2 89 [ 820.608043][T26191] RSP: 002b:00007ffc597d4ee8 EFLAGS: 00000203 ORIG_RAX: 000000000000000b [ 820.616476][T26191] RAX: ffffffffffffffda RBX: 00007f767eca01c8 RCX: 00007f767ea95417 [ 820.624464][T26191] RDX: 0000000000474200 RSI: 00000000000033ef RDI: 00007f767ec98000 [ 820.632448][T26191] RBP: 00007ffc597d5050 R08: 0000000000000001 R09: 0000000000000007 [ 820.640428][T26191] R10: 00007f767ea8fa0b R11: 0000000000000203 R12: 000000001cfac58a [ 820.648408][T26191] R13: 000001b91cfac58a R14: 000001b91ce0f5bf R15: 00007f767ec95740 [ 820.657390][T26191] Kernel Offset: disabled [ 820.661715][T26191] Rebooting in 86400 seconds..