000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x9, 0x6, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x447, 0x10100, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x9, 0x6, 0x6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x447, 0x10100}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:16 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x101, 0x20224386, 0x6}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000200)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000240)={r1}) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x3, 0x0, 0x10000}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x8000000000, r8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:16 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:16 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x8000, 0x0) syz_open_dev$dri(&(0x7f0000000100), 0x3f, 0x101000) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000080)={0x0, 0x1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x8000, 0x0) (async) syz_open_dev$dri(&(0x7f0000000100), 0x3f, 0x101000) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000080)={0x0, 0x1}) (async) 13:11:16 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f0000000000)={{0x7ff, 0xc5}, 0x20}, 0x10) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:16 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x8, 0xfffc, 0x5}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x86101) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x30003, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x6, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000280)={r3}) (async) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000240)={0x0, r5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9}) (async) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000400)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f00000002c0), &(0x7f0000000300)=0x4) 13:11:16 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x9, 0x6, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x447, 0x10100, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x9, 0x6, 0x6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x447, 0x10100}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:16 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x8000, 0x0) syz_open_dev$dri(&(0x7f0000000100), 0x3f, 0x101000) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000080)={0x0, 0x1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x8000, 0x0) (async) syz_open_dev$dri(&(0x7f0000000100), 0x3f, 0x101000) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000080)={0x0, 0x1}) (async) 13:11:16 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:16 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x101, 0x20224386, 0x6}) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000200)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000240)={r1}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x3, 0x0, 0x10000}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x8000000000, r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:16 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f0000000000)={{0x7ff, 0xc5}, 0x20}, 0x10) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f0000000000)={{0x7ff, 0xc5}, 0x20}, 0x10) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:16 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r0, 0x7b3, &(0x7f0000000080)) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x525200) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x7, 0x5, 0x81, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:16 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:16 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8007, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 3: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x2003, 0x200, 0x8e71, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000380)={r5}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000200)={r1}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x5bc, 0x800, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x1}) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) mq_timedsend(0xffffffffffffffff, &(0x7f00000002c0)="379fe824c4d29af0ddea75efdf9813ecac13c2c39f5d6036a2018505ea03a13871be83a5478c7eeb120a0f9c15622f8b", 0x30, 0x1e40, &(0x7f0000000300)={0x0, 0x989680}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) connect$rds(r6, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000280)={0x1cad, 0x0, 0x10001}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r0, 0x7b3, &(0x7f0000000080)) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x525200) (rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x7, 0x5, 0x81, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x7f, 0x6, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x9}) bind$netrom(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$sock_netrom_SIOCDELRT(r4, 0x890c, &(0x7f0000000200)={0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bpq0, 0x5, 'syz1\x00', @bcast, 0x5, 0x3, [@bcast, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000280)) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r4, 0x7a9, &(0x7f00000002c0)={{@local, 0x65}, 0xd69, 0x9c9, 0x7, 0x32fa0704, 0x41b, 0x0, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f0000000000)={{0x7ff, 0xc5}, 0x20}, 0x10) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8007, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 32) 13:11:17 executing program 3: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x2003, 0x200, 0x8e71, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000380)={r5}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000200)={r1}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x5bc, 0x800, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x1}) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) mq_timedsend(0xffffffffffffffff, &(0x7f00000002c0)="379fe824c4d29af0ddea75efdf9813ecac13c2c39f5d6036a2018505ea03a13871be83a5478c7eeb120a0f9c15622f8b", 0x30, 0x1e40, &(0x7f0000000300)={0x0, 0x989680}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) connect$rds(r6, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000280)={0x1cad, 0x0, 0x10001}) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x2003, 0x200, 0x8e71}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000380)={r5}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000200)={r1}) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x5bc, 0x800, 0x9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x1}) (async) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) mq_timedsend(0xffffffffffffffff, &(0x7f00000002c0)="379fe824c4d29af0ddea75efdf9813ecac13c2c39f5d6036a2018505ea03a13871be83a5478c7eeb120a0f9c15622f8b", 0x30, 0x1e40, &(0x7f0000000300)={0x0, 0x989680}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) connect$rds(r6, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000280)={0x1cad, 0x0, 0x10001}) (async) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r0, 0x7b3, &(0x7f0000000080)) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x525200) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x7, 0x5, 0x81, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8007, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 32) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000080)=0x4) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 3: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x2003, 0x200, 0x8e71, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000380)={r5}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000200)={r1}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x5bc, 0x800, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x1}) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) mq_timedsend(0xffffffffffffffff, &(0x7f00000002c0)="379fe824c4d29af0ddea75efdf9813ecac13c2c39f5d6036a2018505ea03a13871be83a5478c7eeb120a0f9c15622f8b", 0x30, 0x1e40, &(0x7f0000000300)={0x0, 0x989680}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) connect$rds(r6, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000280)={0x1cad, 0x0, 0x10001}) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x2003, 0x200, 0x8e71}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000380)={r5}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000200)={r1}) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x5bc, 0x800, 0x9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x1}) (async) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) mq_timedsend(0xffffffffffffffff, &(0x7f00000002c0)="379fe824c4d29af0ddea75efdf9813ecac13c2c39f5d6036a2018505ea03a13871be83a5478c7eeb120a0f9c15622f8b", 0x30, 0x1e40, &(0x7f0000000300)={0x0, 0x989680}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) connect$rds(r6, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000280)={0x1cad, 0x0, 0x10001}) (async) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x400000003, 0x121241) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x4, 0x9, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) setsockopt$RDS_CANCEL_SENT_TO(r4, 0x114, 0x1, &(0x7f0000000300)={0x2, 0x4e24, @multicast2}, 0x10) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000100)={0x6, r6}) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x614742) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x8001, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r7, 0x40106437, &(0x7f0000000240)={r8, 0x100000001}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8007, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xc71b, 0x41002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000000), 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x0, 0x103, 0x5a4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x0, 0x0, 0x1}) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000280)=0x3ff, &(0x7f00000002c0)=0x2) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SNDRV_PCM_IOCTL_STATUS32(r6, 0x806c4120, &(0x7f0000000200)) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000400)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000080)=0x4) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x7f, 0x6, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x9}) bind$netrom(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$sock_netrom_SIOCDELRT(r4, 0x890c, &(0x7f0000000200)={0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bpq0, 0x5, 'syz1\x00', @bcast, 0x5, 0x3, [@bcast, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000280)) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r4, 0x7a9, &(0x7f00000002c0)={{@local, 0x65}, 0xd69, 0x9c9, 0x7, 0x32fa0704, 0x41b, 0x0, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) syz_open_dev$media(&(0x7f0000000040), 0x4, 0x8200) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0x8, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000080)={0x0, r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x8000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r1}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x4}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r5, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r6}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000500)={0x9b0, 0x0, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8}, {0x1e8, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x615}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x800}}, {0x8}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8}, {0x224, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x0, 0x81, 0x40, 0x9}, {0x8, 0x77, 0xfa, 0x8000}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0xbc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x298, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x2, 0xff, 0x1, 0x9}, {0x5, 0x1, 0x1, 0x8}, {0x9, 0x3, 0xfc, 0x80000000}, {0x7, 0x0, 0x0, 0x1ff}, {0x7, 0xf8, 0x1, 0x8}]}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r9}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3f}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xc6}}}]}}]}, 0x9b0}, 0x1, 0x0, 0x0, 0x4000010}, 0x48d1) 13:11:17 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xc71b, 0x41002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000000), 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x0, 0x103, 0x5a4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x0, 0x0, 0x1}) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000280)=0x3ff, &(0x7f00000002c0)=0x2) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SNDRV_PCM_IOCTL_STATUS32(r6, 0x806c4120, &(0x7f0000000200)) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000400)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xc71b, 0x41002) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000000), 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x0, 0x103, 0x5a4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x0, 0x0, 0x1}) (async) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000280)=0x3ff, &(0x7f00000002c0)=0x2) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$SNDRV_PCM_IOCTL_STATUS32(r6, 0x806c4120, &(0x7f0000000200)) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000400)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x400000003, 0x121241) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x4, 0x9, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) setsockopt$RDS_CANCEL_SENT_TO(r4, 0x114, 0x1, &(0x7f0000000300)={0x2, 0x4e24, @multicast2}, 0x10) (async) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000100)={0x6, r6}) (async) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x614742) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x8001, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r7, 0x40106437, &(0x7f0000000240)={r8, 0x100000001}) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000080)=0x4) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x400000003, 0x121241) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x4, 0x9, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) setsockopt$RDS_CANCEL_SENT_TO(r4, 0x114, 0x1, &(0x7f0000000300)={0x2, 0x4e24, @multicast2}, 0x10) (async, rerun: 64) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000100)={0x6, r6}) (async, rerun: 64) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x614742) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x8001, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r7, 0x40106437, &(0x7f0000000240)={r8, 0x100000001}) 13:11:17 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async, rerun: 64) syz_open_dev$media(&(0x7f0000000040), 0x4, 0x8200) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0x8, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000080)={0x0, r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x8000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r1}) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) (rerun: 32) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x4}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r7 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r5, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r6}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00', 0x0}) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000500)={0x9b0, 0x0, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8}, {0x1e8, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x615}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x800}}, {0x8}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8}, {0x224, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x0, 0x81, 0x40, 0x9}, {0x8, 0x77, 0xfa, 0x8000}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0xbc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x298, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x2, 0xff, 0x1, 0x9}, {0x5, 0x1, 0x1, 0x8}, {0x9, 0x3, 0xfc, 0x80000000}, {0x7, 0x0, 0x0, 0x1ff}, {0x7, 0xf8, 0x1, 0x8}]}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r9}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3f}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xc6}}}]}}]}, 0x9b0}, 0x1, 0x0, 0x0, 0x4000010}, 0x48d1) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a6}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xa7, 0x100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000000)=0x6, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x4, &(0x7f0000000200)=0x1) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x400000003, 0x121241) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x4, 0x9, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) setsockopt$RDS_CANCEL_SENT_TO(r4, 0x114, 0x1, &(0x7f0000000300)={0x2, 0x4e24, @multicast2}, 0x10) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000100)={0x6, r6}) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x614742) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x8001, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r7, 0x40106437, &(0x7f0000000240)={r8, 0x100000001}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xc71b, 0x41002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000000), 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x0, 0x103, 0x5a4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x0, 0x0, 0x1}) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000280)=0x3ff, &(0x7f00000002c0)=0x2) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SNDRV_PCM_IOCTL_STATUS32(r6, 0x806c4120, &(0x7f0000000200)) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000400)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xc71b, 0x41002) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000000), 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x0, 0x103, 0x5a4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x0, 0x0, 0x1}) (async) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000280)=0x3ff, &(0x7f00000002c0)=0x2) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$SNDRV_PCM_IOCTL_STATUS32(r6, 0x806c4120, &(0x7f0000000200)) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000400)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a3, 0x0, 0x0}) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r2}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) 13:11:17 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$media(&(0x7f0000000040), 0x4, 0x8200) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0x8, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000080)={0x0, r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x8000}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r1}) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x4}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r7 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r5, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r6}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00', 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000500)={0x9b0, 0x0, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8}, {0x1e8, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x615}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x800}}, {0x8}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8}, {0x224, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x0, 0x81, 0x40, 0x9}, {0x8, 0x77, 0xfa, 0x8000}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0xbc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x298, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x2, 0xff, 0x1, 0x9}, {0x5, 0x1, 0x1, 0x8}, {0x9, 0x3, 0xfc, 0x80000000}, {0x7, 0x0, 0x0, 0x1ff}, {0x7, 0xf8, 0x1, 0x8}]}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r9}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3f}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xc6}}}]}}]}, 0x9b0}, 0x1, 0x0, 0x0, 0x4000010}, 0x48d1) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a6}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xa7, 0x100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000000)=0x6, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x4, &(0x7f0000000200)=0x1) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x5a1181, 0x0) ioctl$PPPIOCSDEBUG(r4, 0x40047440, &(0x7f0000000080)=0x7) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r7}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x6a, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x7, 0x5, 0x5, 0x168a, 0xffffffffffffffff, 0x1c3a, '\x00', r7, 0xffffffffffffffff, 0x3, 0x0, 0x2, 0x7}, 0x48) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000000)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a3, 0x0, 0x0}) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r2}) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a6}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xa7, 0x100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000000)=0x6, 0x4) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 32) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x4, &(0x7f0000000200)=0x1) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) syz_open_dev$dri(&(0x7f0000000000), 0x5b6, 0x540) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000100)='rtc_irq_set_freq\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x9, 0x80000000, 0x59e, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x4, 0x101, 0x1ff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000200)={r5}) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000240)=0x6c, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async, rerun: 32) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (rerun: 32) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) (async, rerun: 32) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r8 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r7}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x6a, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x7, 0x5, 0x5, 0x168a, 0xffffffffffffffff, 0x1c3a, '\x00', r7, 0xffffffffffffffff, 0x3, 0x0, 0x2, 0x7}, 0x48) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000000)={r4}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) (rerun: 32) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000100)='rtc_irq_set_freq\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x9, 0x80000000, 0x59e, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x4, 0x101, 0x1ff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000200)={r5}) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000240)=0x6c, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x5b6, 0x540) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a3, 0x0, 0x0}) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r2}) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa6b0, 0x3, 0x5a2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x3}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x130880) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r7}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x6a, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x7, 0x5, 0x5, 0x168a, 0xffffffffffffffff, 0x1c3a, '\x00', r7, 0xffffffffffffffff, 0x3, 0x0, 0x2, 0x7}, 0x48) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000000)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:17 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 64) syz_open_dev$dri(&(0x7f0000000000), 0x5b6, 0x540) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x9, 0x0) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$read(0xb, r1, &(0x7f0000019100)=""/102382, 0x18fee) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$negate(0xd, r1, 0x2, r4) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa6b0, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x3}) (async, rerun: 32) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x130880) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r7}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x6a, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x7, 0x5, 0x5, 0x168a, 0xffffffffffffffff, 0x1c3a, '\x00', r7, 0xffffffffffffffff, 0x3, 0x0, 0x2, 0x7}, 0x48) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000000)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)) (async) socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r7}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x6a, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x7, 0x5, 0x5, 0x168a, 0xffffffffffffffff, 0x1c3a, '\x00', r7, 0xffffffffffffffff, 0x3, 0x0, 0x2, 0x7}, 0x48) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000000)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x9, 0x0) (async) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$read(0xb, r1, &(0x7f0000019100)=""/102382, 0x18fee) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$negate(0xd, r1, 0x2, r4) 13:11:17 executing program 3: openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x254902) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x400401) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8001}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) mq_notify(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x34}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x3, 0x5a1}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x9, 0x0) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$read(0xb, r1, &(0x7f0000019100)=""/102382, 0x18fee) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$negate(0xd, r1, 0x2, r4) syz_open_dev$dri(&(0x7f00000000c0), 0x9, 0x0) (async) add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) (async) keyctl$read(0xb, r1, &(0x7f0000019100)=""/102382, 0x18fee) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) add_key$keyring(&(0x7f0000000140), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) (async) keyctl$negate(0xd, r1, 0x2, r4) (async) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa6b0, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x3}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x130880) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)) 13:11:17 executing program 3: openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x254902) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x400401) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8001}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) mq_notify(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x34}) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x254902) (async) syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x400401) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8001}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) mq_notify(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x34}) (async) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x3, 0x5a1}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x3, 0x5a1}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x3, 0x220000) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000240), 0xfffffffffffffe48) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x200005a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x30343, 0x0) r4 = socket$bt_cmtp(0x1f, 0x3, 0x5) ioctl$sock_bt_cmtp_CMTPCONNDEL(r4, 0x400443c9, &(0x7f00000002c0)={@any, 0x7}) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000080)=0xf46) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000200)='rpcgss_createauth\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) r8 = socket$bt_cmtp(0x1f, 0x3, 0x5) pipe2$watch_queue(&(0x7f0000000280), 0x80) setsockopt$bt_BT_FLUSHABLE(r8, 0x112, 0x8, &(0x7f0000000100)=0x9, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:17 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x5, 0x4, 0x76}) 13:11:17 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (fail_nth: 1) 13:11:17 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x3, 0x5a1}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x3, 0x5a1}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x3, 0x220000) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000240), 0xfffffffffffffe48) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x200005a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x30343, 0x0) r4 = socket$bt_cmtp(0x1f, 0x3, 0x5) ioctl$sock_bt_cmtp_CMTPCONNDEL(r4, 0x400443c9, &(0x7f00000002c0)={@any, 0x7}) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000080)=0xf46) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000200)='rpcgss_createauth\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) r8 = socket$bt_cmtp(0x1f, 0x3, 0x5) pipe2$watch_queue(&(0x7f0000000280), 0x80) setsockopt$bt_BT_FLUSHABLE(r8, 0x112, 0x8, &(0x7f0000000100)=0x9, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) syz_open_dev$dri(&(0x7f00000000c0), 0x3, 0x220000) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000240), 0xfffffffffffffe48) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x200005a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x30343, 0x0) (async) socket$bt_cmtp(0x1f, 0x3, 0x5) (async) ioctl$sock_bt_cmtp_CMTPCONNDEL(r4, 0x400443c9, &(0x7f00000002c0)={@any, 0x7}) (async) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000080)=0xf46) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000200)='rpcgss_createauth\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) (async) socket$bt_cmtp(0x1f, 0x3, 0x5) (async) pipe2$watch_queue(&(0x7f0000000280), 0x80) (async) setsockopt$bt_BT_FLUSHABLE(r8, 0x112, 0x8, &(0x7f0000000100)=0x9, 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) (async) 13:11:17 executing program 3: openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x254902) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x400401) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8001}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) mq_notify(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x34}) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x254902) (async) syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x400401) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8001}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) mq_notify(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x34}) (async) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x5, 0x4, 0x76}) [ 2769.699522] FAULT_INJECTION: forcing a failure. [ 2769.699522] name failslab, interval 1, probability 0, space 0, times 0 [ 2769.724079] CPU: 0 PID: 27656 Comm: syz-executor.0 Not tainted 4.14.281-syzkaller #0 [ 2769.731982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2769.741424] Call Trace: [ 2769.744127] dump_stack+0x1b2/0x281 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x4802) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x4802) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 64) [ 2769.747763] should_fail.cold+0x10a/0x149 [ 2769.751917] should_failslab+0xd6/0x130 [ 2769.755919] kmem_cache_alloc+0x28e/0x3c0 [ 2769.760069] getname_flags+0xc8/0x550 [ 2769.763871] do_sys_open+0x1ce/0x410 [ 2769.767608] ? fput_many+0xe/0x140 [ 2769.771150] ? filp_open+0x60/0x60 [ 2769.774757] ? __do_page_fault+0x159/0xad0 [ 2769.778995] ? do_syscall_64+0x4c/0x640 [ 2769.782974] ? SyS_open+0x30/0x30 [ 2769.786424] do_syscall_64+0x1d5/0x640 [ 2769.790316] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2769.795505] RIP: 0033:0x7f28fa284024 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) socketpair(0x2c, 0x80000, 0xf32f, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_bt_cmtp_CMTPCONNADD(r3, 0x400443c8, &(0x7f0000000080)={0xffffffffffffffff, 0x8}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:18 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:18 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x3, 0x220000) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000240), 0xfffffffffffffe48) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x200005a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x30343, 0x0) (async) r4 = socket$bt_cmtp(0x1f, 0x3, 0x5) ioctl$sock_bt_cmtp_CMTPCONNDEL(r4, 0x400443c9, &(0x7f00000002c0)={@any, 0x7}) (async) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000080)=0xf46) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000200)='rpcgss_createauth\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) r8 = socket$bt_cmtp(0x1f, 0x3, 0x5) (async) pipe2$watch_queue(&(0x7f0000000280), 0x80) setsockopt$bt_BT_FLUSHABLE(r8, 0x112, 0x8, &(0x7f0000000100)=0x9, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:18 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (fail_nth: 2) [ 2769.799208] RSP: 002b:00007f28f8c45ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2769.806920] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f28fa284024 [ 2769.814186] RDX: 0000000000200200 RSI: 00007f28f8c45d40 RDI: 00000000ffffff9c [ 2769.821451] RBP: 00007f28f8c45d40 R08: 0000000000000000 R09: 0000000000000000 [ 2769.828807] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000200200 [ 2769.836081] R13: 00007ffea5a877bf R14: 00007f28f8c46300 R15: 0000000000022000 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) socketpair(0x2c, 0x80000, 0xf32f, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_bt_cmtp_CMTPCONNADD(r3, 0x400443c8, &(0x7f0000000080)={0xffffffffffffffff, 0x8}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000080)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x5, 0x4, 0x76}) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x4802) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x4802) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:18 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r8) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xe, 0x9e89, 0x7, 0x6, 0x4d0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x48) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x8, &(0x7f0000000000)=@raw=[@alu={0x4, 0x1, 0x6, 0xb, 0x5, 0x20, 0xffffffffffffffff}, @generic={0x3f, 0x7, 0x8, 0x5, 0x3}, @exit, @generic={0xcd, 0x3, 0xf, 0x1ff, 0x3f}, @call={0x85, 0x0, 0x0, 0x4e}, @map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, @jmp={0x5, 0x1, 0x5, 0x5, 0x6, 0x30, 0x4}], &(0x7f0000000080)='syzkaller\x00', 0x800, 0x0, 0x0, 0x41000, 0xf, '\x00', r7, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x5, 0x2, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[0xffffffffffffffff, 0x1, r8, r9, 0x1, r10, 0x1, 0x1]}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async, rerun: 32) socketpair(0x2c, 0x80000, 0xf32f, &(0x7f0000000000)={0xffffffffffffffff}) (rerun: 32) ioctl$sock_bt_cmtp_CMTPCONNADD(r3, 0x400443c8, &(0x7f0000000080)={0xffffffffffffffff, 0x8}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2769.959882] FAULT_INJECTION: forcing a failure. [ 2769.959882] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2769.971789] CPU: 1 PID: 27734 Comm: syz-executor.0 Not tainted 4.14.281-syzkaller #0 [ 2769.979670] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2769.989022] Call Trace: [ 2769.991613] dump_stack+0x1b2/0x281 [ 2769.995242] should_fail.cold+0x10a/0x149 [ 2769.999393] __alloc_pages_nodemask+0x22c/0x2720 [ 2770.004157] ? lock_downgrade+0x740/0x740 [ 2770.008311] ? __lock_acquire+0x5fc/0x3f20 [ 2770.012540] ? get_pid_task+0x91/0x130 [ 2770.016409] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2770.021330] ? lock_downgrade+0x740/0x740 [ 2770.025458] ? get_pid_task+0xb8/0x130 [ 2770.029344] ? proc_fail_nth_write+0x7b/0x180 [ 2770.033846] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2770.038757] cache_grow_begin+0x91/0x700 [ 2770.042807] ? fs_reclaim_release+0xd0/0x110 [ 2770.047199] ? check_preemption_disabled+0x35/0x240 [ 2770.052202] cache_alloc_refill+0x273/0x350 [ 2770.056508] kmem_cache_alloc+0x333/0x3c0 [ 2770.060640] getname_flags+0xc8/0x550 [ 2770.064425] do_sys_open+0x1ce/0x410 [ 2770.068117] ? fput_many+0xe/0x140 [ 2770.071637] ? filp_open+0x60/0x60 [ 2770.075158] ? __do_page_fault+0x159/0xad0 [ 2770.079375] ? do_syscall_64+0x4c/0x640 [ 2770.083329] ? SyS_open+0x30/0x30 [ 2770.086763] do_syscall_64+0x1d5/0x640 [ 2770.090635] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2770.095802] RIP: 0033:0x7f28fa284024 [ 2770.099490] RSP: 002b:00007f28f8c45ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 13:11:18 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r8) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xe, 0x9e89, 0x7, 0x6, 0x4d0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x48) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x8, &(0x7f0000000000)=@raw=[@alu={0x4, 0x1, 0x6, 0xb, 0x5, 0x20, 0xffffffffffffffff}, @generic={0x3f, 0x7, 0x8, 0x5, 0x3}, @exit, @generic={0xcd, 0x3, 0xf, 0x1ff, 0x3f}, @call={0x85, 0x0, 0x0, 0x4e}, @map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, @jmp={0x5, 0x1, 0x5, 0x5, 0x6, 0x30, 0x4}], &(0x7f0000000080)='syzkaller\x00', 0x800, 0x0, 0x0, 0x41000, 0xf, '\x00', r7, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x5, 0x2, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[0xffffffffffffffff, 0x1, r8, r9, 0x1, r10, 0x1, 0x1]}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)) (async) socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r8) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xe, 0x9e89, 0x7, 0x6, 0x4d0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x48) (async) pipe2$watch_queue(&(0x7f00000002c0), 0x80) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x8, &(0x7f0000000000)=@raw=[@alu={0x4, 0x1, 0x6, 0xb, 0x5, 0x20, 0xffffffffffffffff}, @generic={0x3f, 0x7, 0x8, 0x5, 0x3}, @exit, @generic={0xcd, 0x3, 0xf, 0x1ff, 0x3f}, @call={0x85, 0x0, 0x0, 0x4e}, @map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, @jmp={0x5, 0x1, 0x5, 0x5, 0x6, 0x30, 0x4}], &(0x7f0000000080)='syzkaller\x00', 0x800, 0x0, 0x0, 0x41000, 0xf, '\x00', r7, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x5, 0x2, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[0xffffffffffffffff, 0x1, r8, r9, 0x1, r10, 0x1, 0x1]}, 0x80) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7ff, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0xe258, 0x4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000000)) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x3ff, 0x3346, 0x1, 0x7fffffff}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) [ 2770.107204] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f28fa284024 [ 2770.114458] RDX: 0000000000200200 RSI: 00007f28f8c45d40 RDI: 00000000ffffff9c [ 2770.121713] RBP: 00007f28f8c45d40 R08: 0000000000000000 R09: 0000000000000000 [ 2770.128965] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000200200 [ 2770.136216] R13: 00007ffea5a877bf R14: 00007f28f8c46300 R15: 0000000000022000 13:11:18 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:18 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (fail_nth: 3) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x3ff, 0x3346, 0x1, 0x7fffffff}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x3ff, 0x3346, 0x1, 0x7fffffff}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) (async) 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000000)) 13:11:18 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r6 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r8) (async, rerun: 32) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xe, 0x9e89, 0x7, 0x6, 0x4d0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x48) (async, rerun: 32) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x8, &(0x7f0000000000)=@raw=[@alu={0x4, 0x1, 0x6, 0xb, 0x5, 0x20, 0xffffffffffffffff}, @generic={0x3f, 0x7, 0x8, 0x5, 0x3}, @exit, @generic={0xcd, 0x3, 0xf, 0x1ff, 0x3f}, @call={0x85, 0x0, 0x0, 0x4e}, @map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, @jmp={0x5, 0x1, 0x5, 0x5, 0x6, 0x30, 0x4}], &(0x7f0000000080)='syzkaller\x00', 0x800, 0x0, 0x0, 0x41000, 0xf, '\x00', r7, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x5, 0x2, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[0xffffffffffffffff, 0x1, r8, r9, 0x1, r10, 0x1, 0x1]}, 0x80) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7ff, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0xe258, 0x4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:18 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$get_security(0x11, r4, &(0x7f0000000100)=""/64, 0x40) [ 2770.254772] FAULT_INJECTION: forcing a failure. [ 2770.254772] name failslab, interval 1, probability 0, space 0, times 0 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x3ff, 0x3346, 0x1, 0x7fffffff}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x3ff, 0x3346, 0x1, 0x7fffffff}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) (async) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x9fc1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2770.297212] CPU: 1 PID: 27775 Comm: syz-executor.0 Not tainted 4.14.281-syzkaller #0 [ 2770.305114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2770.314465] Call Trace: [ 2770.317233] dump_stack+0x1b2/0x281 [ 2770.320870] should_fail.cold+0x10a/0x149 [ 2770.325025] should_failslab+0xd6/0x130 [ 2770.329006] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2770.333686] apparmor_file_alloc_security+0x129/0x800 [ 2770.338886] security_file_alloc+0x66/0xa0 [ 2770.343120] ? selinux_is_enabled+0x5/0x50 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x9fc1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x0) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x9fc1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7ff, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0xe258, 0x4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7ff, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0xe258, 0x4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) [ 2770.347350] get_empty_filp+0x16b/0x3f0 [ 2770.351320] path_openat+0x84/0x2970 [ 2770.355035] ? get_pid_task+0x91/0x130 [ 2770.358932] ? path_lookupat+0x780/0x780 [ 2770.363004] ? trace_hardirqs_on+0x10/0x10 [ 2770.367248] do_filp_open+0x179/0x3c0 [ 2770.371049] ? may_open_dev+0xe0/0xe0 [ 2770.374855] ? __alloc_fd+0x1be/0x490 [ 2770.378837] ? lock_downgrade+0x740/0x740 [ 2770.382993] ? do_raw_spin_unlock+0x164/0x220 [ 2770.387489] ? _raw_spin_unlock+0x29/0x40 [ 2770.391651] ? __alloc_fd+0x1be/0x490 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000000)={r4, 0xffffffff00000001}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) (async) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000000)={r4, 0xffffffff00000001}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) [ 2770.395470] do_sys_open+0x296/0x410 [ 2770.399183] ? fput_many+0xe/0x140 [ 2770.402726] ? filp_open+0x60/0x60 [ 2770.406265] ? __do_page_fault+0x159/0xad0 [ 2770.410500] ? do_syscall_64+0x4c/0x640 [ 2770.414474] ? SyS_open+0x30/0x30 [ 2770.417932] do_syscall_64+0x1d5/0x640 [ 2770.421825] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2770.427010] RIP: 0033:0x7f28fa284024 [ 2770.430724] RSP: 002b:00007f28f8c45ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2770.438426] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f28fa284024 13:11:18 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (fail_nth: 4) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x9fc1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (rerun: 32) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000000)={r4, 0xffffffff00000001}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 64) 13:11:18 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x10000) r5 = getpid() pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r5, r6, 0x0, 0x2, &(0x7f0000000080)='!\x00'}, 0x30) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000000)) 13:11:18 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$get_security(0x11, r4, &(0x7f0000000100)=""/64, 0x40) [ 2770.445693] RDX: 0000000000200200 RSI: 00007f28f8c45d40 RDI: 00000000ffffff9c [ 2770.452969] RBP: 00007f28f8c45d40 R08: 0000000000000000 R09: 0000000000000000 [ 2770.460245] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000200200 [ 2770.467506] R13: 00007ffea5a877bf R14: 00007f28f8c46300 R15: 0000000000022000 13:11:18 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x10000) r5 = getpid() pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r5, r6, 0x0, 0x2, &(0x7f0000000080)='!\x00'}, 0x30) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x10000) (async) getpid() (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r5, r6, 0x0, 0x2, &(0x7f0000000080)='!\x00'}, 0x30) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:18 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x200, 0x593, 0xb9f3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0x80000001}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x20, 0x4, 0x6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000240), &(0x7f0000000280)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x4182, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x8, &(0x7f0000000000)=0x7fffffff, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) [ 2770.566583] FAULT_INJECTION: forcing a failure. [ 2770.566583] name failslab, interval 1, probability 0, space 0, times 0 [ 2770.583743] CPU: 1 PID: 27852 Comm: syz-executor.0 Not tainted 4.14.281-syzkaller #0 [ 2770.591643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2770.600996] Call Trace: [ 2770.603589] dump_stack+0x1b2/0x281 [ 2770.607223] should_fail.cold+0x10a/0x149 [ 2770.611989] should_failslab+0xd6/0x130 13:11:18 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x200, 0x593, 0xb9f3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0x80000001}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x20, 0x4, 0x6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000240), &(0x7f0000000280)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x4182, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x200, 0x593, 0xb9f3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0x80000001}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x20, 0x4, 0x6}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000240), &(0x7f0000000280)=0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x4182, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:18 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x8, &(0x7f0000000000)=0x7fffffff, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x8, &(0x7f0000000000)=0x7fffffff, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) [ 2770.615971] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2770.620655] apparmor_file_alloc_security+0x129/0x800 [ 2770.625847] security_file_alloc+0x66/0xa0 [ 2770.630080] ? selinux_is_enabled+0x5/0x50 [ 2770.634401] get_empty_filp+0x16b/0x3f0 [ 2770.638381] path_openat+0x84/0x2970 [ 2770.642093] ? get_pid_task+0x91/0x130 [ 2770.645978] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2770.650829] ? path_lookupat+0x780/0x780 [ 2770.654888] ? trace_hardirqs_on+0x10/0x10 [ 2770.659130] do_filp_open+0x179/0x3c0 [ 2770.662932] ? may_open_dev+0xe0/0xe0 [ 2770.666736] ? __alloc_fd+0x1be/0x490 [ 2770.670536] ? lock_downgrade+0x740/0x740 [ 2770.674679] ? do_raw_spin_unlock+0x164/0x220 [ 2770.679173] ? _raw_spin_unlock+0x29/0x40 [ 2770.683318] ? __alloc_fd+0x1be/0x490 [ 2770.687120] do_sys_open+0x296/0x410 [ 2770.690833] ? fput_many+0xe/0x140 [ 2770.694371] ? filp_open+0x60/0x60 [ 2770.697916] ? __do_page_fault+0x159/0xad0 [ 2770.702151] ? do_syscall_64+0x4c/0x640 [ 2770.706123] ? SyS_open+0x30/0x30 [ 2770.709569] do_syscall_64+0x1d5/0x640 [ 2770.713536] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2770.718713] RIP: 0033:0x7f28fa284024 [ 2770.722402] RSP: 002b:00007f28f8c45ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2770.730205] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f28fa284024 [ 2770.737454] RDX: 0000000000200200 RSI: 00007f28f8c45d40 RDI: 00000000ffffff9c [ 2770.744701] RBP: 00007f28f8c45d40 R08: 0000000000000000 R09: 0000000000000000 [ 2770.752902] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000200200 [ 2770.760244] R13: 00007ffea5a877bf R14: 00007f28f8c46300 R15: 0000000000022000 13:11:19 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (fail_nth: 5) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x8, &(0x7f0000000000)=0x7fffffff, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x8, &(0x7f0000000000)=0x7fffffff, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x200, 0x593, 0xb9f3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0x80000001}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x20, 0x4, 0x6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000240), &(0x7f0000000280)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x4182, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x200, 0x593, 0xb9f3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0x80000001}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x20, 0x4, 0x6}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000240), &(0x7f0000000280)=0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x4182, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$get_security(0x11, r4, &(0x7f0000000100)=""/64, 0x40) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async) add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) (async) keyctl$get_security(0x11, r4, &(0x7f0000000100)=""/64, 0x40) (async) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 32) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 32) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x10000) r5 = getpid() (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async, rerun: 32) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async, rerun: 32) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r5, r6, 0x0, 0x2, &(0x7f0000000080)='!\x00'}, 0x30) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bind$rds(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) [ 2770.844613] FAULT_INJECTION: forcing a failure. [ 2770.844613] name failslab, interval 1, probability 0, space 0, times 0 [ 2770.870512] CPU: 0 PID: 27923 Comm: syz-executor.0 Not tainted 4.14.281-syzkaller #0 [ 2770.878414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2770.887770] Call Trace: [ 2770.890365] dump_stack+0x1b2/0x281 [ 2770.894003] should_fail.cold+0x10a/0x149 [ 2770.898244] should_failslab+0xd6/0x130 [ 2770.902224] kmem_cache_alloc+0x28e/0x3c0 [ 2770.906385] __d_alloc+0x2a/0xa20 [ 2770.909838] ? __save_stack_trace+0x63/0x160 [ 2770.914248] ? deref_stack_reg+0x124/0x1a0 [ 2770.918484] d_alloc+0x46/0x240 [ 2770.921767] d_alloc_parallel+0xd6/0x16b0 [ 2770.925916] ? lookup_fast+0x2ea/0xe30 [ 2770.929807] ? check_preemption_disabled+0x35/0x240 [ 2770.934830] ? __d_lookup_rcu+0x640/0x640 [ 2770.938997] ? lock_acquire+0x170/0x3f0 [ 2770.942973] ? lookup_slow+0x129/0x400 [ 2770.946867] lookup_slow+0x175/0x400 [ 2770.950592] ? follow_dotdot_rcu+0xf00/0xf00 [ 2770.955000] ? lookup_fast+0x430/0xe30 [ 2770.958893] ? security_inode_permission+0xb5/0xf0 [ 2770.963827] walk_component+0x6a1/0xbc0 [ 2770.967886] ? lookup_fast+0xe30/0xe30 [ 2770.971856] ? walk_component+0xbc0/0xbc0 [ 2770.976045] path_lookupat+0x1bb/0x780 [ 2770.979933] ? path_mountpoint+0x940/0x940 [ 2770.984162] ? __lockdep_init_map+0x100/0x560 [ 2770.988654] ? __lockdep_init_map+0x100/0x560 [ 2770.993152] ? debug_mutex_init+0x28/0x60 [ 2770.997295] path_openat+0x18eb/0x2970 [ 2771.001177] ? get_pid_task+0x91/0x130 [ 2771.005062] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2771.009906] ? path_lookupat+0x780/0x780 [ 2771.013965] ? trace_hardirqs_on+0x10/0x10 [ 2771.018202] do_filp_open+0x179/0x3c0 [ 2771.021999] ? may_open_dev+0xe0/0xe0 [ 2771.025817] ? lock_downgrade+0x740/0x740 [ 2771.029969] ? do_raw_spin_unlock+0x164/0x220 [ 2771.034457] ? _raw_spin_unlock+0x29/0x40 [ 2771.038599] ? __alloc_fd+0x1be/0x490 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x49e, 0x141201) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0xfffffffffffffffb, 0x40200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000000)='fsi_master_gpio_break\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1000000000, 0x0) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000200)) socketpair(0xf, 0x5, 0x3, &(0x7f0000000280)={0xffffffffffffffff}) setsockopt$llc_int(r4, 0x10c, 0x2, &(0x7f00000002c0)=0x2b, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000300)={r5}) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000240)=0x1) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x6002, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000100)={0x0, 0x1e4e}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r3}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000000)={r3, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r3}) (async) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000000)={r3, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x49e, 0x141201) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0xfffffffffffffffb, 0x40200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) [ 2771.042400] do_sys_open+0x296/0x410 [ 2771.046111] ? fput_many+0xe/0x140 [ 2771.049642] ? filp_open+0x60/0x60 [ 2771.053179] ? __do_page_fault+0x159/0xad0 [ 2771.057405] ? do_syscall_64+0x4c/0x640 [ 2771.061366] ? SyS_open+0x30/0x30 [ 2771.064811] do_syscall_64+0x1d5/0x640 [ 2771.068686] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2771.073855] RIP: 0033:0x7f28fa284024 [ 2771.077550] RSP: 002b:00007f28f8c45ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2771.085240] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f28fa284024 13:11:19 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (fail_nth: 6) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r3}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000000)={r3, 0x4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x49e, 0x141201) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0xfffffffffffffffb, 0x40200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x14000003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000200), 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000240)={0x7f, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000280)={r5, 0x1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x20000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb61cc0c5be9040ad, 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000106d0ce3430000000000ef2c32e0fcc854fb73770a910590bbc4078edf9e6e268373d16d0a09a6975606c8bbdd8113e1dbb6a5f548"], &(0x7f0000000300)='syzkaller\x00', 0x8, 0xed, &(0x7f0000000680)=""/237, 0x40f00, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f0000000480)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x80000000, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r7, r7]}, 0x80) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000100)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000440)={r9}) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000000)='fsi_master_gpio_break\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1000000000, 0x0) (async) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000200)) (async) socketpair(0xf, 0x5, 0x3, &(0x7f0000000280)={0xffffffffffffffff}) setsockopt$llc_int(r4, 0x10c, 0x2, &(0x7f00000002c0)=0x2b, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000300)={r5}) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000240)=0x1) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x6002, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000100)={0x0, 0x1e4e}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0x2afb9002, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2771.092484] RDX: 0000000000200200 RSI: 00007f28f8c45d40 RDI: 00000000ffffff9c [ 2771.099735] RBP: 00007f28f8c45d40 R08: 0000000000000000 R09: 0000000000000000 [ 2771.106979] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000200200 [ 2771.114226] R13: 00007ffea5a877bf R14: 00007f28f8c46300 R15: 0000000000022000 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x805f6, 0x80200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x59e, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x6, 0x0, 0x2}) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, &(0x7f0000000240)=0x3490e91d, 0x4) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x35e20e23, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000200)={r4, 0x5}) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0x2afb9002, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x14000003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000200), 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000240)={0x7f, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000280)={r5, 0x1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x20000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb61cc0c5be9040ad, 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000106d0ce3430000000000ef2c32e0fcc854fb73770a910590bbc4078edf9e6e268373d16d0a09a6975606c8bbdd8113e1dbb6a5f548"], &(0x7f0000000300)='syzkaller\x00', 0x8, 0xed, &(0x7f0000000680)=""/237, 0x40f00, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f0000000480)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x80000000, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r7, r7]}, 0x80) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000100)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000440)={r9}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x14000003, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000200), 0x9, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000240)={0x7f, 0x0, 0x10001}) (async) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000280)={r5, 0x1}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x20000) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb61cc0c5be9040ad, 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000106d0ce3430000000000ef2c32e0fcc854fb73770a910590bbc4078edf9e6e268373d16d0a09a6975606c8bbdd8113e1dbb6a5f548"], &(0x7f0000000300)='syzkaller\x00', 0x8, 0xed, &(0x7f0000000680)=""/237, 0x40f00, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f0000000480)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x80000000, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r7, r7]}, 0x80) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000100)={r9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000440)={r9}) (async) 13:11:19 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000000)='fsi_master_gpio_break\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1000000000, 0x0) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000200)) socketpair(0xf, 0x5, 0x3, &(0x7f0000000280)={0xffffffffffffffff}) setsockopt$llc_int(r4, 0x10c, 0x2, &(0x7f00000002c0)=0x2b, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000300)={r5}) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000240)=0x1) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x6002, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000100)={0x0, 0x1e4e}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000000)='fsi_master_gpio_break\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x1000000000, 0x0) (async) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000200)) (async) socketpair(0xf, 0x5, 0x3, &(0x7f0000000280)) (async) setsockopt$llc_int(r4, 0x10c, 0x2, &(0x7f00000002c0)=0x2b, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000300)={r5}) (async) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000240)=0x1) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x6002, 0x0) (async) ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000100)={0x0, 0x1e4e}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 32) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0x2afb9002, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x805f6, 0x80200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x59e, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x6, 0x0, 0x2}) (async) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, &(0x7f0000000240)=0x3490e91d, 0x4) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x35e20e23, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000200)={r4, 0x5}) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) 13:11:19 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) (async) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x14000003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000200), 0x9, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000240)={0x7f, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000280)={r5, 0x1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x20000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb61cc0c5be9040ad, 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000106d0ce3430000000000ef2c32e0fcc854fb73770a910590bbc4078edf9e6e268373d16d0a09a6975606c8bbdd8113e1dbb6a5f548"], &(0x7f0000000300)='syzkaller\x00', 0x8, 0xed, &(0x7f0000000680)=""/237, 0x40f00, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f0000000480)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x80000000, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r7, r7]}, 0x80) (async) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000100)={r9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000440)={r9}) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) (async) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x805f6, 0x80200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x59e, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x6, 0x0, 0x2}) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, &(0x7f0000000240)=0x3490e91d, 0x4) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x35e20e23, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000200)={r4, 0x5}) syz_open_dev$dri(&(0x7f00000000c0), 0x805f6, 0x80200) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x59e}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x6, 0x0, 0x2}) (async) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, &(0x7f0000000240)=0x3490e91d, 0x4) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x35e20e23, 0x0, 0x2}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000200)={r4, 0x5}) (async) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x4000001, 0x77ec}) r1 = syz_open_dev$dri(&(0x7f0000000200), 0x0, 0x181a83) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x7, 0x3, 0x2005a0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x4, 0x3, 0xfffffe01, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) r7 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0xd77, 0x80d80) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r8, 0x112, 0xb, &(0x7f0000000240), 0x2) syz_open_dev$sndpcmc(&(0x7f0000000100), 0x2, 0x200000) ioctl$SNDRV_PCM_IOCTL_PREPARE(r7, 0x4140, 0x0) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x46200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000200)=0x7, &(0x7f0000000240)=0x2) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x4000001, 0x77ec}) (async) r1 = syz_open_dev$dri(&(0x7f0000000200), 0x0, 0x181a83) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x7, 0x3, 0x2005a0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x4, 0x3, 0xfffffe01, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) r7 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0xd77, 0x80d80) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r8, 0x112, 0xb, &(0x7f0000000240), 0x2) syz_open_dev$sndpcmc(&(0x7f0000000100), 0x2, 0x200000) ioctl$SNDRV_PCM_IOCTL_PREPARE(r7, 0x4140, 0x0) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000080), 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x46200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x46200) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:19 executing program 0: pipe2$watch_queue(&(0x7f0000000000), 0x80) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x84, 0x4800) socket$netlink(0x10, 0x3, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f0000000100)=0x6812, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000080)={0x1, 0x0, 0x1}) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000080), 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000200)=0x7, &(0x7f0000000240)=0x2) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:19 executing program 0: pipe2$watch_queue(&(0x7f0000000000), 0x80) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x46200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x4000001, 0x77ec}) (async) r1 = syz_open_dev$dri(&(0x7f0000000200), 0x0, 0x181a83) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x7, 0x3, 0x2005a0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x4, 0x3, 0xfffffe01, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) r7 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0xd77, 0x80d80) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r8, 0x112, 0xb, &(0x7f0000000240), 0x2) (async) syz_open_dev$sndpcmc(&(0x7f0000000100), 0x2, 0x200000) (async) ioctl$SNDRV_PCM_IOCTL_PREPARE(r7, 0x4140, 0x0) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x84, 0x4800) socket$netlink(0x10, 0x3, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f0000000100)=0x6812, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000080)={0x1, 0x0, 0x1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x84, 0x4800) (async) socket$netlink(0x10, 0x3, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) socket$bt_hidp(0x1f, 0x3, 0x6) (async) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f0000000100)=0x6812, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000080)={0x1, 0x0, 0x1}) (async) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000080), 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000200)=0x7, &(0x7f0000000240)=0x2) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x8001, 0x10000) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40106439, &(0x7f0000000080)={0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(0xffffffffffffffff, 0x7a9, &(0x7f0000000100)={{@my=0x1, 0x6c}, 0x5, 0x1000, 0xea, 0x9261, 0x58, 0x1, 0x75cf, 0x4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:19 executing program 0: pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='svcsock_marker\x00', r5}, 0x10) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x84, 0x4800) (async) socket$netlink(0x10, 0x3, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f0000000100)=0x6812, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000080)={0x1, 0x0, 0x1}) 13:11:19 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x81, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0xca7, 0x400100) r5 = syz_open_dev$dri(&(0x7f0000000140), 0x5, 0x280000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0xffff5a0a, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000100)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000200)={0x200, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000240)={r7, 0x3f}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x8001, 0x10000) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40106439, &(0x7f0000000080)={0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(0xffffffffffffffff, 0x7a9, &(0x7f0000000100)={{@my=0x1, 0x6c}, 0x5, 0x1000, 0xea, 0x9261, 0x58, 0x1, 0x75cf, 0x4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:19 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:19 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='svcsock_marker\x00', r5}, 0x10) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='svcsock_marker\x00', r5}, 0x10) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) mq_timedsend(r2, &(0x7f0000000200)="81ab622c2d7b1fbecf76057bcb38becca5feca715a47dea2edc4edc5092513b533329a4fe906f0064d0d35887b8e56f3b63beecd1a241e3868404121414a77d72c4f95cae562b03f776363d65dde5385b2c9327e43a7e36ce0d7983aeca47799cb3031b268033ae0f1eaffaf1631d9958e5be6612f61f3f07fa2189fc065113342ae0b9f15e9467967f4add5580db0feb84bf09a92", 0x95, 0x8000000000000000, &(0x7f0000000100)={r3, r4+60000000}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x2ddf, 0x20000) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:19 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x81, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x2}) 13:11:20 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x81, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0xca7, 0x400100) (async) r5 = syz_open_dev$dri(&(0x7f0000000140), 0x5, 0x280000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0xffff5a0a, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000100)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000200)={0x200, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000240)={r7, 0x3f}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x81, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x2}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) mq_timedsend(r2, &(0x7f0000000200)="81ab622c2d7b1fbecf76057bcb38becca5feca715a47dea2edc4edc5092513b533329a4fe906f0064d0d35887b8e56f3b63beecd1a241e3868404121414a77d72c4f95cae562b03f776363d65dde5385b2c9327e43a7e36ce0d7983aeca47799cb3031b268033ae0f1eaffaf1631d9958e5be6612f61f3f07fa2189fc065113342ae0b9f15e9467967f4add5580db0feb84bf09a92", 0x95, 0x8000000000000000, &(0x7f0000000100)={r3, r4+60000000}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x2ddf, 0x20000) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async, rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='svcsock_marker\x00', r5}, 0x10) (async, rerun: 64) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x81, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0xca7, 0x400100) r5 = syz_open_dev$dri(&(0x7f0000000140), 0x5, 0x280000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0xffff5a0a, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000100)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000200)={0x200, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000240)={r7, 0x3f}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x81, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0xca7, 0x400100) (async) syz_open_dev$dri(&(0x7f0000000140), 0x5, 0x280000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0xffff5a0a}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000100)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000200)={0x200, 0x0, 0x10001}) (async) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000240)={r7, 0x3f}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x8001, 0x10000) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40106439, &(0x7f0000000080)={0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(0xffffffffffffffff, 0x7a9, &(0x7f0000000100)={{@my=0x1, 0x6c}, 0x5, 0x1000, 0xea, 0x9261, 0x58, 0x1, 0x75cf, 0x4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) mq_timedsend(r2, &(0x7f0000000200)="81ab622c2d7b1fbecf76057bcb38becca5feca715a47dea2edc4edc5092513b533329a4fe906f0064d0d35887b8e56f3b63beecd1a241e3868404121414a77d72c4f95cae562b03f776363d65dde5385b2c9327e43a7e36ce0d7983aeca47799cb3031b268033ae0f1eaffaf1631d9958e5be6612f61f3f07fa2189fc065113342ae0b9f15e9467967f4add5580db0feb84bf09a92", 0x95, 0x8000000000000000, &(0x7f0000000100)={r3, r4+60000000}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x2ddf, 0x20000) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x81, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x2}) 13:11:20 executing program 5: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000100)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8, 0x2, 0x8, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast]}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r4}) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000002c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000240)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x15a5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0x2, &(0x7f0000000080)=0x1a, 0x4) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r8}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000280)={0x6, r8}) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r4}) ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0) syz_open_dev$media(&(0x7f0000000100), 0x8001, 0x8000) 13:11:20 executing program 4: r0 = socket(0x1e, 0x80000, 0x8c) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000200)=0xff80, &(0x7f0000000240)=0x2) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x971, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000100)='mm_vmscan_writepage\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) mq_timedsend(0xffffffffffffffff, &(0x7f0000000300)="66ed7a3926cc68909cb413e9b25fcd190bbc3504834d98790a417a59f25090282b25cb93a79709d5d4bb93884ecef2b0cbd6c7df0329dc4ef7ec8133f4f8284f0651b672d13bac3d3aeed3cfdfb670f6d9aa1b04a5cf1abbd1a09d3b9f49f9637c8bf7cfe672d06a68e73bd8f54c1adc", 0x70, 0x5, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x198c, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={r5, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xfffffff7, 0xe055}) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x8}) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000140), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0x3, 0x20}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x0, 0x0, 0x2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000000), 0x4) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000300)=0x469b, 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000002c0)={0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 4: r0 = socket(0x1e, 0x80000, 0x8c) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000200)=0xff80, &(0x7f0000000240)=0x2) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x971, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000100)='mm_vmscan_writepage\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) mq_timedsend(0xffffffffffffffff, &(0x7f0000000300)="66ed7a3926cc68909cb413e9b25fcd190bbc3504834d98790a417a59f25090282b25cb93a79709d5d4bb93884ecef2b0cbd6c7df0329dc4ef7ec8133f4f8284f0651b672d13bac3d3aeed3cfdfb670f6d9aa1b04a5cf1abbd1a09d3b9f49f9637c8bf7cfe672d06a68e73bd8f54c1adc", 0x70, 0x5, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x198c, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={r5, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) socket(0x1e, 0x80000, 0x8c) (async) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000200)=0xff80, &(0x7f0000000240)=0x2) (async) syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x971, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000100)='mm_vmscan_writepage\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) mq_timedsend(0xffffffffffffffff, &(0x7f0000000300)="66ed7a3926cc68909cb413e9b25fcd190bbc3504834d98790a417a59f25090282b25cb93a79709d5d4bb93884ecef2b0cbd6c7df0329dc4ef7ec8133f4f8284f0651b672d13bac3d3aeed3cfdfb670f6d9aa1b04a5cf1abbd1a09d3b9f49f9637c8bf7cfe672d06a68e73bd8f54c1adc", 0x70, 0x5, 0x0) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x198c, 0x0, 0x10001}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={r5, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:20 executing program 5: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async, rerun: 32) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async, rerun: 32) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000100)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8, 0x2, 0x8, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast]}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r4}) (rerun: 64) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xfffffff7, 0xe055}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xfffffff7, 0xe055}) (async) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000240)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x15a5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0x2, &(0x7f0000000080)=0x1a, 0x4) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r8}) (async) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000280)={0x6, r8}) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r4}) (async) ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0) (async) syz_open_dev$media(&(0x7f0000000100), 0x8001, 0x8000) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x8}) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000140), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0x3, 0x20}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x0, 0x0, 0x2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000000), 0x4) (async) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) (async) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) (async) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000300)=0x469b, 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000002c0)={0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (rerun: 64) 13:11:20 executing program 4: r0 = socket(0x1e, 0x80000, 0x8c) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000200)=0xff80, &(0x7f0000000240)=0x2) (async) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x971, 0x5a2}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000100)='mm_vmscan_writepage\x00'}, 0x10) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 64) mq_timedsend(0xffffffffffffffff, &(0x7f0000000300)="66ed7a3926cc68909cb413e9b25fcd190bbc3504834d98790a417a59f25090282b25cb93a79709d5d4bb93884ecef2b0cbd6c7df0329dc4ef7ec8133f4f8284f0651b672d13bac3d3aeed3cfdfb670f6d9aa1b04a5cf1abbd1a09d3b9f49f9637c8bf7cfe672d06a68e73bd8f54c1adc", 0x70, 0x5, 0x0) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 64) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000000)={0x198c, 0x0, 0x10001}) (rerun: 64) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={r5, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x8}) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000140), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0x3, 0x20}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x0, 0x0, 0x2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000000), 0x4) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000300)=0x469b, 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000002c0)={0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xfffffff7, 0xe055}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xfffffff7, 0xe055}) (async) 13:11:20 executing program 5: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000100)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8, 0x2, 0x8, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast]}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r4}) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000100)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8, 0x2, 0x8, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast]}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r4}) (async) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000240)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x15a5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0x2, &(0x7f0000000080)=0x1a, 0x4) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r8}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000280)={0x6, r8}) (async) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r4}) (async) ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0) (async) syz_open_dev$media(&(0x7f0000000100), 0x8001, 0x8000) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xfffffffd, 0x1ff, 0xffff}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x246141) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0xd5, 0x7, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x1c3040) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) write$ppp(0xffffffffffffffff, &(0x7f0000000040)="ac6e1e175faadf23504c54e7672a9fc816bd179b23b13ac372a27c6de8fdc5e54ae63a7ae7efb222208ebb6aa74d4523918aca6113", 0x35) 13:11:20 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000000000)=0x2, &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0xe040, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xfffffffd, 0x1ff, 0xffff}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x246141) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0xd5, 0x7, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x1c3040) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) write$ppp(0xffffffffffffffff, &(0x7f0000000040)="ac6e1e175faadf23504c54e7672a9fc816bd179b23b13ac372a27c6de8fdc5e54ae63a7ae7efb222208ebb6aa74d4523918aca6113", 0x35) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x1c3040) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) (async) write$ppp(0xffffffffffffffff, &(0x7f0000000040)="ac6e1e175faadf23504c54e7672a9fc816bd179b23b13ac372a27c6de8fdc5e54ae63a7ae7efb222208ebb6aa74d4523918aca6113", 0x35) (async) 13:11:20 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000000000)=0x2, &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000000000)=0x2, &(0x7f0000000080)=0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0xe040, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xfffffffd, 0x1ff, 0xffff}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x246141) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0xd5, 0x7, 0x8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) syz_open_dev$dri(&(0x7f0000000000), 0x8, 0x1c3040) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) (async) write$ppp(0xffffffffffffffff, &(0x7f0000000040)="ac6e1e175faadf23504c54e7672a9fc816bd179b23b13ac372a27c6de8fdc5e54ae63a7ae7efb222208ebb6aa74d4523918aca6113", 0x35) 13:11:20 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000000000)=0x2, &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000000000)=0x2, &(0x7f0000000080)=0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0xe040, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCGDEBUG(r5, 0x80047441, &(0x7f0000000100)) ioctl$sock_bt_cmtp_CMTPCONNDEL(0xffffffffffffffff, 0x400443c9, &(0x7f0000000000)={@any, 0x3}) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCGDEBUG(r5, 0x80047441, &(0x7f0000000100)) ioctl$sock_bt_cmtp_CMTPCONNDEL(0xffffffffffffffff, 0x400443c9, &(0x7f0000000000)={@any, 0x3}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$PPPIOCGDEBUG(r5, 0x80047441, &(0x7f0000000100)) (async) ioctl$sock_bt_cmtp_CMTPCONNDEL(0xffffffffffffffff, 0x400443c9, &(0x7f0000000000)={@any, 0x3}) (async) 13:11:20 executing program 5: r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0), 0xc, &(0x7f00000015c0)={&(0x7f0000003500)=ANY=[@ANYBLOB="cc030000", @ANYRES16=r1, @ANYBLOB="080027bd7000fddbdf250300000008000100a071550172d613d7b1694915ae668acf022143905ad0c2a292036dd84ef034c7304507be8b79d70cca15faadf8c5051f3be0a0139050d1c9a9e0ddf0dbd594e4d40a0277c99265894803ce13df259b5152dfd178266872444b3b4f6b2223529f2bf4ca7156120f05a1474b000399a72e0e40980d3f795cce9a6ca0202bd63b80a8fc7fa181460a13ff00ef2c342f0bad35dfad2327917de82be63944bdb05001315df34dd8ffd3f820a89a8f20a68f7387cf1ca5a58c2ed0038e8740cbaad64dc249f187e5decee32f11508fbfd874d1cf6fffdcc10db613219ea4f6094c79f2ff1f7d15486c21de74d340977f0d76a05a6dc175203d619cc3", @ANYRESOCT=r2, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r2, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES64=r4, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r2, @ANYBLOB="0400028008000100", @ANYRES32=r4, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB="ad9d65cfb289aea0109ce12aa0a565c41d5f53f3839fefb42e1a9fa56768022a2fc84668e2747761d339af401e333b35afdb3480f00df9cbce38564b3ae919b7daf0ed22d4babf7f26d3670dc98b8cdfbb7995a551a91de3e7e8a006f7667778eb9b5cbe835cde0bad89f1f4abd2077a43c0a770ad33aa0e7e0f1abf71d4469c2ff39f3776286474c35a0601af3958cfa1b364082af2310f8aef99e0f917f7d0bd0fbbc8505df71b85a56a1145826464eb3c861bdf166269ba17d31fdca52c4610f901927381c2d6b5509dd17f57e1d69957cc7d50d446e965deb523c2", @ANYRESDEC=0x0, @ANYRES32=r2, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRESHEX, @ANYBLOB="08000100", @ANYBLOB="dcd653bfd889faf710ac8b84f2d8682b7d8625dbf0048e54407cfb5df905671175cdaad6711427781c67f7254d9e2aca3c9b349396304086f7c3e92bbf49e01b0a9eda4db77f79d89dcb14c967360a498e01cfd242edcb44f4a1c99086246823fc1440c1ffae89f07ce577136ad3d8e0bf133cd35fe9b5f12661fcd492d317981772973e2b595dad2ed0fb08abd2f6a778efb31d5d83ac3fdb02689870a73ebcd88e2e581db8d7fc9377aca73c6729d32f3ba4d4d5c87ed1d4e121c5d8e5daffcf604b8828d2c9eaf5a547d2523978868ae07d252b905468d995e96749c60abbe339981280f86231221112f1bdb97d9a8f79390885b3f40d8c70320bee184b365783772ee5f14aac6c8b0efd7e9774af13449bfd326969e25b76c877493291710ec0f44d80d042b74da07bc6e864b51edc58449378585a06dd9922f6a851099c7df4e76b09dcfe06bc2c1dd54985d615fc7576f0719ab874fbd8a83ecb07e48d4c27617a90d58bb53be5c17f0663d20688cbc6c96fa0bf26d2a7851c782ef03833b296dcc21318cf90ccc964d6bd03e0df7f550cb68c2c965c6fef2f43e182d1dbf9e0c1162951e496273d51b128822faafa62e9179cdeaa63a14037331c23a268d48c4df1b8af6671dad9883d50d1765c8de3a866347f52dce95119dacd7d392efa8eb0d03a0e63839806bdade5f5fe5a1bb0c176f4bcbd3724c14c498c5a31fe97a32b39953ee4a76c694a02bfd65bf120d3d4250076f0177ed09162e383b0362f23b15f9b2481b67a536da390438a72a133750f578592541f20d2a7bffe0ceb59a918da62bd38bb015c550899ebc5b023cc3449b3cfdbd3c15ca42521d0b3eb4f354e7a6b91c921875c9b16343361147203527e1f2acb313643bb846d7447d433a237de9719dc8ecaccd3baa3f82dd368452d0d029a10937af888aeb6d80d7fb9cd0c8b2f65ca62713857664d2a11d2abcb22aee16e468560b8c3761a4c7f44eabc6198a18d5b90dbb4aa0b0cfce2b5a5a8eb37a6aad6c86dae6b5b55e9e8e8f3cc0f01c3e2ae23d7f2fdecd074f529e217ec347c7aea66eb317765eca2cd8c8973cd7a4df14f35e4cbfdb3725f8a6ca36b78f4b76612c5c8324230ddbea5bc3da8fca6efeb6b955e5123cada690d91b4554f41b403fd169fe29c33ae4b27c40bb3b46e7288a8a46710dd8c25598d8624622fcccf6f4aa8ee0c4b6d53d043492751b12693603b67e2beda3b9ad1e4f7864d68b8e34eed40e9fea6cda8a6412208bf8322c1d6776cacfd2b20398c50a018c71b90389df675b1c07424c4407622bad34f090c09563cb050410d84ccd483f5aa3ea744a461a20ab0045e4adb773834265cf73996aa2b47dfbe274820d44b0ab32c0257c8600215f82cd9fb442f944c826bff4f763ba392d285285e36c8683e00829c2e5a3e1d120735de6ea250ef09a32e1686611112a43de2a0e81c4cc8ee728b6a58f855f1751bff19d715c85ef8f15c31a41ed7ec9f50709302531a32a0e50e302641c755e6782bf0471397081f64258a4f1886961d5d908229aca54274cc29a92a2fc0cd65b35a6ae65658242a4f9cc40ab316b712390f0a43afc2631cfb77b29c8377ba377320bebe4a08141b37ac04dc6404679357a236103218e2557dcedaa8542b978d7fa4eb1e4678aa4930a17d4e7158f7d206c80e0f8af099eeef1d03d8e8dc1799557663de38b723b84324aa380dc6e9ffa6c63992acefe93c86a47b2205c8e16e03642c9c90f407ed4291c31b33562bcfe8b2d0d2291898da7a8f6e99600ab59b1a803c016cb582354a8cb102f8bcb056696d83088075fcba2c521084cce771ca68b3fcec67603684500a2cf8b48830a520270b15bacb6d07e42803db7be7449b0bacc57cea3c0efeafe7d212d5659f47e464fc653d3d79200b99a2053a7f72c795c37c25f7392eb64147779a7a64a4996267cdc970c2fb90a243532a1c79dfea556aedc9e96bff0c18a2669d0819d50b5b3dfb27ccdcbc6a6a796107d97ba44a308b518237f6249609ec406351f893a76a0bc945abcc9c0c78fd71ed981a47041d731cde53d317eaa015b063144fbed674911035c32f3e7020fb07f8254eafe7a5736fdfd3cef8a8c0a86651997275de9a239eb9ec300dcf09d2ca6012a807ec440c7710484bd36c29849c77f09cbb06dd280508d5efaa2c74f1d056639ac7605ac8b85f80b9a92216248ca72ef82f51898ffb1dc1b26beab15261f458b69d28d2fa2250454e17ef73e3787a161e791621340bfb45537a0e814b162c51f377a77dc2d39eb52c461d4e211f03164c23afaa36ac9872bf27a141aca06fef6bdac0987b3ee291cfbaecedd4e872010918305ae86c41e31c0ce51a49c9a8655e004e364b850fbfd5fb218ff5c9798e709902dab3b5fe287a6bf1bfb21670231e5e4602d5f21f9dd0f6eca83c072404502c801428b7cca0b6f0136152b234dbcf8632f632505b3dd84b761d24d76cfd8de2078adc84a1f7b62476779b51ba7d31fff5828542e53197793d7086213bb90a7b0db5521c0200e23ac2892c5d84540736107c40073dc0f9a8ee511e2ade1c4c9a6d27935a644f69f52fc79246926f106732b6b52b8b12c9a0ad7c746e944b838586dba2cc4c68dd29927fe17dd885ccb994965d3578b1c789c59b334d0ee90249e11401cb5414b2e7726f5ea6ebea88168c62a62213f9a84478ab6da454f81f10fbe7a491f8aeffd79e15f1b0635a46a423dd2065577df21abbcced5c9e0d05a6e4b333b1c24c38f507ba32fa03f901372fc657d8ac375630ad38364d91d5c7b7c0add09e63e198609930fc67239de43b81eb01f1a138a0c309b6c8f0bb4db1dae26ff2591c37f942b5ef7f2cb1e8a2d81292dc5ebc981b4c2e62b8fea2b310d96a014bcaeeb2cea4f23ae274ba55000f9981d1316fd518ccdad8399072d313ddaaa18c75cb6dfe6ac8ea5917502ccc343fe196722e334712b6d82de4e004e5ee0156556f18bc1f98a98046d5803d5270c99352b215973c4953161b586d7540d297bd9b660a675bf4fdb76b89b1a9b062a4aacc604b0dbdd4fe96fc06d5e319d99f1b5ec4e4c66493f5ca0d61fd0a9648e3f50af5d647c6ee4a828d6cc781d35cc557e81babaaf8019c07e31aae9185ac23a686d267ee93564429d935104f1cb0e16572ef4a6c5ff87159d8a63cfcaf874f3cecb230329c854e6e186f682db614956a5742d5bd4485de537f7056194dff112df40119f2321ad1aab8f9bb2182a5b2c548db8636030d0ce1792821c01156db3ff46b68bea9ba4c2f4206780a828123c1399dd226c62b2e2c8b6d6b415a45d4ddf2e7b2a3b87488edc2c515de0ed3bf1c65386ae458bd895129e8611104db7087983aa0af355d0930a2828e8bb960251caf54b3f7d1fed37f73a0ad75ac514ed7c5d927030f4a451ce24aa6fe431e89380531b0b403ed9b90dc8e76e54b4c8f5547e9d6ad67120f6a39a2ac81901c2385c2565eb471586e2bff66f1943b68f3238d60cc7234be9ccf55f103b0db66c12571dbe619d505c6a3cfc5209865a813888886e9f3b1d7a4defd2c9e5b0daa6ef4cde5602f093b9a3f1f7bc9afd1d9f2b5d0aec0c7d8ff52cbaf1d7d5bbf31b244dfb64e52e73ad404a5bbf2bc59b16b099ef412dd66b045432e0afde978d204abde574d011f42ea499666a45c45046d25b2dad572e9cfe1f61d46bb1c1b3cb4c7370e1face56d64071973aeb7b621669b7b21d08631871f4150cc9b71ea6fddbc5286ec6f532898eba45cd88f9a52e2f64e1f2accc4acd70d10e573c05257f3db4d9046256ed8349f333376723283ff20ab3365f7c7b9c5c874bd935bd34ca2e5c45fa5f6461192563fb9e0fff15aaf7538d8ee9afec46f89846cdc3266d2268f8a97c8286731760858079bb41280118e86bde8a3edd39cc2a9a4a9397205c4714d6c4c4d86a6a2b140fb3734a4f0a079e9a42c261e54bd28abe6fd9d0b9631dad17b59b9c9740735e55eaf0308e3d8391746a5e1a82b63ae39b50a0f6d3b16def9e86172d6d8091de96a06ad70c80ff15e0f89e9866db103b8ff935a71db6fc46887981af8c72261677360081c2d6aa9c8500151c6b7181c00d595305d68e7ae760257d3933e68986a718dadc8c5aed128ba459629a058daf21d665b11be131c942046f0f7f2d9637b7b26ce052734e5c30033fe9af6c5f66448118546f19f64581518beb4510aefb0d5ce973744d43b1f650fdb53504135d8cd45996016775fcaeccfc098d144e22931e18883b5aaeb68b19bd873ad4e5852fe05dfd29cb816c03672eb90886479501f8af486025b0b5b241ab45f9610db53ed7cc851c77563cf47589d7f8c7fbd8f9d7a3806ffbabe3b9eee8d7866435c27e90e8b6ac9094914fd5f7be76ecf3273594e70b880c49f64e2dc12497ab6074a88c61358dfbcddd6bf3f932421acd07e82ae643463913f73284f70194b93d27ee5cf2039ce72496016a2e88c9bbbbdd8f292efe1c97285a389dfbe84d88196a3675b0580cd718d2875bb64d814eaef41967aac5f7ee3c6f76a9330c0d9e9f6aa3698420bbaee6cf4e2ac186cfefddf6a1300c7a7ac8d1a86289c4a45d4935bbc4c47b806140126c20cd56304ec3be591b15ddfeb430dc57ff4b8936c70de54c89df134df7690f77baed709b0a74c818bc9713762d1bd6349252d39a45651d836e37b5d4128e7206b001a61c5f2ec509534ed6d23013dae3bbde15662ee16042a6bcfe10b2c8f445604c755bfee6e9b63c39d210b7b578f07fca14c4f833178d71c93c1767cf2110cb12f63b9ec2bf70281bd6a04f858a68103e65de7e24958b77c1fbafb663e62bacce219e4218178302ee8d7031207899006f84a14ef49f573e301002af8a76b6e04fcb5968df66b01a915cbcd8fbecf9cb25e41d18a17a2eed4f1eb88ce424c4e8f848cf8e23a51690a3eb46f7563b7bcf53473cf841bfdb500435d308e5b041cdefc2f88ad6dfdcc49fa107eb5e529e007a2fe045cc62d03f80c6e9eff5fa2e6c6e5af8645d359d0ef6bf65c135c53f8aead7200759eb1ca9c4fb7290236157962e4e28aaf4602ae057bb2a2156307867bdc6db10627c51edacd4d839a60079a0a7e7a27a6d140350cf35396b517f7f5f2dc3a020d46c19a68a26fbec39118c579e832d5b3fd819761101ac3d1884d3526658ff9cac77fe57e4a0e31795c28eed9a165ea67a0d9f531b425bab5257a00a85a5a7f277da8623eba52a10c5c1c87ef81dfb9e321bc4ec253b981ee980c4e4a1745304d9540f3c8bd6dab8a6d948fdb4683637e5a96249d39254f190db5759eff9ed78bb5b936392a7883e1bfc4ce5fddc00e8b42f3f047ef2526a214ff8efc9c800809441065284e7addef420e9e9b6c7b12ee4b07c47da46ced81c5570c7af6a589703c7e90693277b14b7f5036a4c71970fd5509c4ca64f664b61dbc3e15ac29b71d0a024ff5bd82c6a33b25135bdee15aececb8777bbab9909160e0fc529eeaeb06fb9ade2741d2ca27ad92a6cdfc8ce14f8fd28a0ba005417b27db3ef3b28d89278b346513bf5142abf1f44e4f872b81e61a5db3d2ec6d0f6f2797e6cf300354016cca44c513c05149fa7b7ec7fe1948eec3e16bff60c5cdf99c6318283cd063ea5bf9d9e284ca367300a4bd7eadd0325b4598c2b132c1660431ee9875392e65add611124458348b8d7bc88257b7e4bf5804e5e81e112e8a8a6b4fcac6aaf2af5780b6d6f1471a1ece0e82048ab2330eff7546ba7af41c0a9cbfdfc0fddd3e05", @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004004000000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r4, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000b8821b0e2a000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}, 0x1, 0x0, 0x0, 0x48000}, 0x8840) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001b40)=ANY=[@ANYBLOB="d0030000", @ANYRES16=r5, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r6, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=r6, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r6, @ANYBLOB="0400028008000100", @ANYRES32=r6, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="f8000280400001002400010071756575655f696400000000000000000000000005a2e745df647cba000300030000000800040040", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000000ca08000000"], 0x3d0}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x4) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000740)={&(0x7f0000000200)={0x534, r0, 0x800, 0x70bd29, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x288, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x400, 0x3, 0x2c, 0x4}, {0x4, 0x2, 0x17, 0x4}, {0x9, 0x40, 0x2, 0x4}]}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x800}}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x64}}, {0x8}}}]}}, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [{0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x2, 0x7, 0xb3, 0x1000}, {0x0, 0x4, 0x1, 0x8000}, {0x2, 0x2, 0xe0, 0xffffffff}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0x1ff, 0x8, 0x9a, 0x3}, {0x3ff, 0x80, 0x2a, 0x1f}, {0x5, 0x3, 0x4, 0x7e3}, {0x5, 0xf8, 0x40, 0x1}, {0x1, 0xff, 0x9, 0x6}, {0xff, 0x8, 0x32, 0xaab}, {0x81, 0x0, 0x53, 0x8000}]}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}]}, 0x534}, 0x1, 0x0, 0x0, 0x80}, 0x20004000) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) r12 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r12, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r12, 0xc01064b3, &(0x7f00000001c0)={r13}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r12, 0xc00464b4, &(0x7f0000000040)={r11}) 13:11:20 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) r0 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), 0x4) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x1) 13:11:20 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x200001) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x7, 0x7fffffff, 0x2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCGDEBUG(r5, 0x80047441, &(0x7f0000000100)) (async) ioctl$sock_bt_cmtp_CMTPCONNDEL(0xffffffffffffffff, 0x400443c9, &(0x7f0000000000)={@any, 0x3}) 13:11:20 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x40800) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000200)={0x80000000, &(0x7f0000000080), &(0x7f0000000100)=[{{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f0000000240)={{0x80000000, 0x0, 0x6, [0x3, 0x5]}, {r3, 0x0, 0x3, [0x8, 0x80]}, 0x10000000, [0x8, 0xca3c]}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:20 executing program 5: r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0), 0xc, &(0x7f00000015c0)={&(0x7f0000003500)=ANY=[@ANYBLOB="cc030000", @ANYRES16=r1, @ANYBLOB="080027bd7000fddbdf250300000008000100a071550172d613d7b1694915ae668acf022143905ad0c2a292036dd84ef034c7304507be8b79d70cca15faadf8c5051f3be0a0139050d1c9a9e0ddf0dbd594e4d40a0277c99265894803ce13df259b5152dfd178266872444b3b4f6b2223529f2bf4ca7156120f05a1474b000399a72e0e40980d3f795cce9a6ca0202bd63b80a8fc7fa181460a13ff00ef2c342f0bad35dfad2327917de82be63944bdb05001315df34dd8ffd3f820a89a8f20a68f7387cf1ca5a58c2ed0038e8740cbaad64dc249f187e5decee32f11508fbfd874d1cf6fffdcc10db613219ea4f6094c79f2ff1f7d15486c21de74d340977f0d76a05a6dc175203d619cc3", @ANYRESOCT=r2, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r2, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES64=r4, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r2, @ANYBLOB="0400028008000100", @ANYRES32=r4, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB="ad9d65cfb289aea0109ce12aa0a565c41d5f53f3839fefb42e1a9fa56768022a2fc84668e2747761d339af401e333b35afdb3480f00df9cbce38564b3ae919b7daf0ed22d4babf7f26d3670dc98b8cdfbb7995a551a91de3e7e8a006f7667778eb9b5cbe835cde0bad89f1f4abd2077a43c0a770ad33aa0e7e0f1abf71d4469c2ff39f3776286474c35a0601af3958cfa1b364082af2310f8aef99e0f917f7d0bd0fbbc8505df71b85a56a1145826464eb3c861bdf166269ba17d31fdca52c4610f901927381c2d6b5509dd17f57e1d69957cc7d50d446e965deb523c2", @ANYRESDEC=0x0, @ANYRES32=r2, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRESHEX, @ANYBLOB="08000100", @ANYBLOB="dcd653bfd889faf710ac8b84f2d8682b7d8625dbf0048e54407cfb5df905671175cdaad6711427781c67f7254d9e2aca3c9b349396304086f7c3e92bbf49e01b0a9eda4db77f79d89dcb14c967360a498e01cfd242edcb44f4a1c99086246823fc1440c1ffae89f07ce577136ad3d8e0bf133cd35fe9b5f12661fcd492d317981772973e2b595dad2ed0fb08abd2f6a778efb31d5d83ac3fdb02689870a73ebcd88e2e581db8d7fc9377aca73c6729d32f3ba4d4d5c87ed1d4e121c5d8e5daffcf604b8828d2c9eaf5a547d2523978868ae07d252b905468d995e96749c60abbe339981280f86231221112f1bdb97d9a8f79390885b3f40d8c70320bee184b365783772ee5f14aac6c8b0efd7e9774af13449bfd326969e25b76c877493291710ec0f44d80d042b74da07bc6e864b51edc58449378585a06dd9922f6a851099c7df4e76b09dcfe06bc2c1dd54985d615fc7576f0719ab874fbd8a83ecb07e48d4c27617a90d58bb53be5c17f0663d20688cbc6c96fa0bf26d2a7851c782ef03833b296dcc21318cf90ccc964d6bd03e0df7f550cb68c2c965c6fef2f43e182d1dbf9e0c1162951e496273d51b128822faafa62e9179cdeaa63a14037331c23a268d48c4df1b8af6671dad9883d50d1765c8de3a866347f52dce95119dacd7d392efa8eb0d03a0e63839806bdade5f5fe5a1bb0c176f4bcbd3724c14c498c5a31fe97a32b39953ee4a76c694a02bfd65bf120d3d4250076f0177ed09162e383b0362f23b15f9b2481b67a536da390438a72a133750f578592541f20d2a7bffe0ceb59a918da62bd38bb015c550899ebc5b023cc3449b3cfdbd3c15ca42521d0b3eb4f354e7a6b91c921875c9b16343361147203527e1f2acb313643bb846d7447d433a237de9719dc8ecaccd3baa3f82dd368452d0d029a10937af888aeb6d80d7fb9cd0c8b2f65ca62713857664d2a11d2abcb22aee16e468560b8c3761a4c7f44eabc6198a18d5b90dbb4aa0b0cfce2b5a5a8eb37a6aad6c86dae6b5b55e9e8e8f3cc0f01c3e2ae23d7f2fdecd074f529e217ec347c7aea66eb317765eca2cd8c8973cd7a4df14f35e4cbfdb3725f8a6ca36b78f4b76612c5c8324230ddbea5bc3da8fca6efeb6b955e5123cada690d91b4554f41b403fd169fe29c33ae4b27c40bb3b46e7288a8a46710dd8c25598d8624622fcccf6f4aa8ee0c4b6d53d043492751b12693603b67e2beda3b9ad1e4f7864d68b8e34eed40e9fea6cda8a6412208bf8322c1d6776cacfd2b20398c50a018c71b90389df675b1c07424c4407622bad34f090c09563cb050410d84ccd483f5aa3ea744a461a20ab0045e4adb773834265cf73996aa2b47dfbe274820d44b0ab32c0257c8600215f82cd9fb442f944c826bff4f763ba392d285285e36c8683e00829c2e5a3e1d120735de6ea250ef09a32e1686611112a43de2a0e81c4cc8ee728b6a58f855f1751bff19d715c85ef8f15c31a41ed7ec9f50709302531a32a0e50e302641c755e6782bf0471397081f64258a4f1886961d5d908229aca54274cc29a92a2fc0cd65b35a6ae65658242a4f9cc40ab316b712390f0a43afc2631cfb77b29c8377ba377320bebe4a08141b37ac04dc6404679357a236103218e2557dcedaa8542b978d7fa4eb1e4678aa4930a17d4e7158f7d206c80e0f8af099eeef1d03d8e8dc1799557663de38b723b84324aa380dc6e9ffa6c63992acefe93c86a47b2205c8e16e03642c9c90f407ed4291c31b33562bcfe8b2d0d2291898da7a8f6e99600ab59b1a803c016cb582354a8cb102f8bcb056696d83088075fcba2c521084cce771ca68b3fcec67603684500a2cf8b48830a520270b15bacb6d07e42803db7be7449b0bacc57cea3c0efeafe7d212d5659f47e464fc653d3d79200b99a2053a7f72c795c37c25f7392eb64147779a7a64a4996267cdc970c2fb90a243532a1c79dfea556aedc9e96bff0c18a2669d0819d50b5b3dfb27ccdcbc6a6a796107d97ba44a308b518237f6249609ec406351f893a76a0bc945abcc9c0c78fd71ed981a47041d731cde53d317eaa015b063144fbed674911035c32f3e7020fb07f8254eafe7a5736fdfd3cef8a8c0a86651997275de9a239eb9ec300dcf09d2ca6012a807ec440c7710484bd36c29849c77f09cbb06dd280508d5efaa2c74f1d056639ac7605ac8b85f80b9a92216248ca72ef82f51898ffb1dc1b26beab15261f458b69d28d2fa2250454e17ef73e3787a161e791621340bfb45537a0e814b162c51f377a77dc2d39eb52c461d4e211f03164c23afaa36ac9872bf27a141aca06fef6bdac0987b3ee291cfbaecedd4e872010918305ae86c41e31c0ce51a49c9a8655e004e364b850fbfd5fb218ff5c9798e709902dab3b5fe287a6bf1bfb21670231e5e4602d5f21f9dd0f6eca83c072404502c801428b7cca0b6f0136152b234dbcf8632f632505b3dd84b761d24d76cfd8de2078adc84a1f7b62476779b51ba7d31fff5828542e53197793d7086213bb90a7b0db5521c0200e23ac2892c5d84540736107c40073dc0f9a8ee511e2ade1c4c9a6d27935a644f69f52fc79246926f106732b6b52b8b12c9a0ad7c746e944b838586dba2cc4c68dd29927fe17dd885ccb994965d3578b1c789c59b334d0ee90249e11401cb5414b2e7726f5ea6ebea88168c62a62213f9a84478ab6da454f81f10fbe7a491f8aeffd79e15f1b0635a46a423dd2065577df21abbcced5c9e0d05a6e4b333b1c24c38f507ba32fa03f901372fc657d8ac375630ad38364d91d5c7b7c0add09e63e198609930fc67239de43b81eb01f1a138a0c309b6c8f0bb4db1dae26ff2591c37f942b5ef7f2cb1e8a2d81292dc5ebc981b4c2e62b8fea2b310d96a014bcaeeb2cea4f23ae274ba55000f9981d1316fd518ccdad8399072d313ddaaa18c75cb6dfe6ac8ea5917502ccc343fe196722e334712b6d82de4e004e5ee0156556f18bc1f98a98046d5803d5270c99352b215973c4953161b586d7540d297bd9b660a675bf4fdb76b89b1a9b062a4aacc604b0dbdd4fe96fc06d5e319d99f1b5ec4e4c66493f5ca0d61fd0a9648e3f50af5d647c6ee4a828d6cc781d35cc557e81babaaf8019c07e31aae9185ac23a686d267ee93564429d935104f1cb0e16572ef4a6c5ff87159d8a63cfcaf874f3cecb230329c854e6e186f682db614956a5742d5bd4485de537f7056194dff112df40119f2321ad1aab8f9bb2182a5b2c548db8636030d0ce1792821c01156db3ff46b68bea9ba4c2f4206780a828123c1399dd226c62b2e2c8b6d6b415a45d4ddf2e7b2a3b87488edc2c515de0ed3bf1c65386ae458bd895129e8611104db7087983aa0af355d0930a2828e8bb960251caf54b3f7d1fed37f73a0ad75ac514ed7c5d927030f4a451ce24aa6fe431e89380531b0b403ed9b90dc8e76e54b4c8f5547e9d6ad67120f6a39a2ac81901c2385c2565eb471586e2bff66f1943b68f3238d60cc7234be9ccf55f103b0db66c12571dbe619d505c6a3cfc5209865a813888886e9f3b1d7a4defd2c9e5b0daa6ef4cde5602f093b9a3f1f7bc9afd1d9f2b5d0aec0c7d8ff52cbaf1d7d5bbf31b244dfb64e52e73ad404a5bbf2bc59b16b099ef412dd66b045432e0afde978d204abde574d011f42ea499666a45c45046d25b2dad572e9cfe1f61d46bb1c1b3cb4c7370e1face56d64071973aeb7b621669b7b21d08631871f4150cc9b71ea6fddbc5286ec6f532898eba45cd88f9a52e2f64e1f2accc4acd70d10e573c05257f3db4d9046256ed8349f333376723283ff20ab3365f7c7b9c5c874bd935bd34ca2e5c45fa5f6461192563fb9e0fff15aaf7538d8ee9afec46f89846cdc3266d2268f8a97c8286731760858079bb41280118e86bde8a3edd39cc2a9a4a9397205c4714d6c4c4d86a6a2b140fb3734a4f0a079e9a42c261e54bd28abe6fd9d0b9631dad17b59b9c9740735e55eaf0308e3d8391746a5e1a82b63ae39b50a0f6d3b16def9e86172d6d8091de96a06ad70c80ff15e0f89e9866db103b8ff935a71db6fc46887981af8c72261677360081c2d6aa9c8500151c6b7181c00d595305d68e7ae760257d3933e68986a718dadc8c5aed128ba459629a058daf21d665b11be131c942046f0f7f2d9637b7b26ce052734e5c30033fe9af6c5f66448118546f19f64581518beb4510aefb0d5ce973744d43b1f650fdb53504135d8cd45996016775fcaeccfc098d144e22931e18883b5aaeb68b19bd873ad4e5852fe05dfd29cb816c03672eb90886479501f8af486025b0b5b241ab45f9610db53ed7cc851c77563cf47589d7f8c7fbd8f9d7a3806ffbabe3b9eee8d7866435c27e90e8b6ac9094914fd5f7be76ecf3273594e70b880c49f64e2dc12497ab6074a88c61358dfbcddd6bf3f932421acd07e82ae643463913f73284f70194b93d27ee5cf2039ce72496016a2e88c9bbbbdd8f292efe1c97285a389dfbe84d88196a3675b0580cd718d2875bb64d814eaef41967aac5f7ee3c6f76a9330c0d9e9f6aa3698420bbaee6cf4e2ac186cfefddf6a1300c7a7ac8d1a86289c4a45d4935bbc4c47b806140126c20cd56304ec3be591b15ddfeb430dc57ff4b8936c70de54c89df134df7690f77baed709b0a74c818bc9713762d1bd6349252d39a45651d836e37b5d4128e7206b001a61c5f2ec509534ed6d23013dae3bbde15662ee16042a6bcfe10b2c8f445604c755bfee6e9b63c39d210b7b578f07fca14c4f833178d71c93c1767cf2110cb12f63b9ec2bf70281bd6a04f858a68103e65de7e24958b77c1fbafb663e62bacce219e4218178302ee8d7031207899006f84a14ef49f573e301002af8a76b6e04fcb5968df66b01a915cbcd8fbecf9cb25e41d18a17a2eed4f1eb88ce424c4e8f848cf8e23a51690a3eb46f7563b7bcf53473cf841bfdb500435d308e5b041cdefc2f88ad6dfdcc49fa107eb5e529e007a2fe045cc62d03f80c6e9eff5fa2e6c6e5af8645d359d0ef6bf65c135c53f8aead7200759eb1ca9c4fb7290236157962e4e28aaf4602ae057bb2a2156307867bdc6db10627c51edacd4d839a60079a0a7e7a27a6d140350cf35396b517f7f5f2dc3a020d46c19a68a26fbec39118c579e832d5b3fd819761101ac3d1884d3526658ff9cac77fe57e4a0e31795c28eed9a165ea67a0d9f531b425bab5257a00a85a5a7f277da8623eba52a10c5c1c87ef81dfb9e321bc4ec253b981ee980c4e4a1745304d9540f3c8bd6dab8a6d948fdb4683637e5a96249d39254f190db5759eff9ed78bb5b936392a7883e1bfc4ce5fddc00e8b42f3f047ef2526a214ff8efc9c800809441065284e7addef420e9e9b6c7b12ee4b07c47da46ced81c5570c7af6a589703c7e90693277b14b7f5036a4c71970fd5509c4ca64f664b61dbc3e15ac29b71d0a024ff5bd82c6a33b25135bdee15aececb8777bbab9909160e0fc529eeaeb06fb9ade2741d2ca27ad92a6cdfc8ce14f8fd28a0ba005417b27db3ef3b28d89278b346513bf5142abf1f44e4f872b81e61a5db3d2ec6d0f6f2797e6cf300354016cca44c513c05149fa7b7ec7fe1948eec3e16bff60c5cdf99c6318283cd063ea5bf9d9e284ca367300a4bd7eadd0325b4598c2b132c1660431ee9875392e65add611124458348b8d7bc88257b7e4bf5804e5e81e112e8a8a6b4fcac6aaf2af5780b6d6f1471a1ece0e82048ab2330eff7546ba7af41c0a9cbfdfc0fddd3e05", @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004004000000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r4, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000b8821b0e2a000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}, 0x1, 0x0, 0x0, 0x48000}, 0x8840) (async) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r7 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001b40)=ANY=[@ANYBLOB="d0030000", @ANYRES16=r5, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r6, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=r6, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r6, @ANYBLOB="0400028008000100", @ANYRES32=r6, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="f8000280400001002400010071756575655f696400000000000000000000000005a2e745df647cba000300030000000800040040", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000000ca08000000"], 0x3d0}}, 0x0) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x4) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000740)={&(0x7f0000000200)={0x534, r0, 0x800, 0x70bd29, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x288, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x400, 0x3, 0x2c, 0x4}, {0x4, 0x2, 0x17, 0x4}, {0x9, 0x40, 0x2, 0x4}]}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x800}}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x64}}, {0x8}}}]}}, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [{0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x2, 0x7, 0xb3, 0x1000}, {0x0, 0x4, 0x1, 0x8000}, {0x2, 0x2, 0xe0, 0xffffffff}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0x1ff, 0x8, 0x9a, 0x3}, {0x3ff, 0x80, 0x2a, 0x1f}, {0x5, 0x3, 0x4, 0x7e3}, {0x5, 0xf8, 0x40, 0x1}, {0x1, 0xff, 0x9, 0x6}, {0xff, 0x8, 0x32, 0xaab}, {0x81, 0x0, 0x53, 0x8000}]}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}]}, 0x534}, 0x1, 0x0, 0x0, 0x80}, 0x20004000) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) r12 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r12, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r12, 0xc01064b3, &(0x7f00000001c0)={r13}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r12, 0xc00464b4, &(0x7f0000000040)={r11}) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x200001) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x7, 0x7fffffff, 0x2}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x40800) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) r0 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), 0x4) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x1) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) socket$bt_bnep(0x1f, 0x3, 0x4) (async) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), 0x4) (async) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) (async) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) (async) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x1) (async) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x5a2}) getsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) r6 = syz_open_dev$dri(&(0x7f0000000100), 0x9, 0x10643) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000200)={0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000200)={0x80000000, &(0x7f0000000080), &(0x7f0000000100)=[{{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f0000000240)={{0x80000000, 0x0, 0x6, [0x3, 0x5]}, {r3, 0x0, 0x3, [0x8, 0x80]}, 0x10000000, [0x8, 0xca3c]}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x200001) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x7, 0x7fffffff, 0x2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x200001) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x7, 0x7fffffff, 0x2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:21 executing program 5: r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r3 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0), 0xc, &(0x7f00000015c0)={&(0x7f0000003500)=ANY=[@ANYBLOB="cc030000", @ANYRES16=r1, @ANYBLOB="080027bd7000fddbdf250300000008000100a071550172d613d7b1694915ae668acf022143905ad0c2a292036dd84ef034c7304507be8b79d70cca15faadf8c5051f3be0a0139050d1c9a9e0ddf0dbd594e4d40a0277c99265894803ce13df259b5152dfd178266872444b3b4f6b2223529f2bf4ca7156120f05a1474b000399a72e0e40980d3f795cce9a6ca0202bd63b80a8fc7fa181460a13ff00ef2c342f0bad35dfad2327917de82be63944bdb05001315df34dd8ffd3f820a89a8f20a68f7387cf1ca5a58c2ed0038e8740cbaad64dc249f187e5decee32f11508fbfd874d1cf6fffdcc10db613219ea4f6094c79f2ff1f7d15486c21de74d340977f0d76a05a6dc175203d619cc3", @ANYRESOCT=r2, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r2, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES64=r4, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r2, @ANYBLOB="0400028008000100", @ANYRES32=r4, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB="ad9d65cfb289aea0109ce12aa0a565c41d5f53f3839fefb42e1a9fa56768022a2fc84668e2747761d339af401e333b35afdb3480f00df9cbce38564b3ae919b7daf0ed22d4babf7f26d3670dc98b8cdfbb7995a551a91de3e7e8a006f7667778eb9b5cbe835cde0bad89f1f4abd2077a43c0a770ad33aa0e7e0f1abf71d4469c2ff39f3776286474c35a0601af3958cfa1b364082af2310f8aef99e0f917f7d0bd0fbbc8505df71b85a56a1145826464eb3c861bdf166269ba17d31fdca52c4610f901927381c2d6b5509dd17f57e1d69957cc7d50d446e965deb523c2", @ANYRESDEC=0x0, @ANYRES32=r2, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRESHEX, @ANYBLOB="08000100", @ANYBLOB="dcd653bfd889faf710ac8b84f2d8682b7d8625dbf0048e54407cfb5df905671175cdaad6711427781c67f7254d9e2aca3c9b349396304086f7c3e92bbf49e01b0a9eda4db77f79d89dcb14c967360a498e01cfd242edcb44f4a1c99086246823fc1440c1ffae89f07ce577136ad3d8e0bf133cd35fe9b5f12661fcd492d317981772973e2b595dad2ed0fb08abd2f6a778efb31d5d83ac3fdb02689870a73ebcd88e2e581db8d7fc9377aca73c6729d32f3ba4d4d5c87ed1d4e121c5d8e5daffcf604b8828d2c9eaf5a547d2523978868ae07d252b905468d995e96749c60abbe339981280f86231221112f1bdb97d9a8f79390885b3f40d8c70320bee184b365783772ee5f14aac6c8b0efd7e9774af13449bfd326969e25b76c877493291710ec0f44d80d042b74da07bc6e864b51edc58449378585a06dd9922f6a851099c7df4e76b09dcfe06bc2c1dd54985d615fc7576f0719ab874fbd8a83ecb07e48d4c27617a90d58bb53be5c17f0663d20688cbc6c96fa0bf26d2a7851c782ef03833b296dcc21318cf90ccc964d6bd03e0df7f550cb68c2c965c6fef2f43e182d1dbf9e0c1162951e496273d51b128822faafa62e9179cdeaa63a14037331c23a268d48c4df1b8af6671dad9883d50d1765c8de3a866347f52dce95119dacd7d392efa8eb0d03a0e63839806bdade5f5fe5a1bb0c176f4bcbd3724c14c498c5a31fe97a32b39953ee4a76c694a02bfd65bf120d3d4250076f0177ed09162e383b0362f23b15f9b2481b67a536da390438a72a133750f578592541f20d2a7bffe0ceb59a918da62bd38bb015c550899ebc5b023cc3449b3cfdbd3c15ca42521d0b3eb4f354e7a6b91c921875c9b16343361147203527e1f2acb313643bb846d7447d433a237de9719dc8ecaccd3baa3f82dd368452d0d029a10937af888aeb6d80d7fb9cd0c8b2f65ca62713857664d2a11d2abcb22aee16e468560b8c3761a4c7f44eabc6198a18d5b90dbb4aa0b0cfce2b5a5a8eb37a6aad6c86dae6b5b55e9e8e8f3cc0f01c3e2ae23d7f2fdecd074f529e217ec347c7aea66eb317765eca2cd8c8973cd7a4df14f35e4cbfdb3725f8a6ca36b78f4b76612c5c8324230ddbea5bc3da8fca6efeb6b955e5123cada690d91b4554f41b403fd169fe29c33ae4b27c40bb3b46e7288a8a46710dd8c25598d8624622fcccf6f4aa8ee0c4b6d53d043492751b12693603b67e2beda3b9ad1e4f7864d68b8e34eed40e9fea6cda8a6412208bf8322c1d6776cacfd2b20398c50a018c71b90389df675b1c07424c4407622bad34f090c09563cb050410d84ccd483f5aa3ea744a461a20ab0045e4adb773834265cf73996aa2b47dfbe274820d44b0ab32c0257c8600215f82cd9fb442f944c826bff4f763ba392d285285e36c8683e00829c2e5a3e1d120735de6ea250ef09a32e1686611112a43de2a0e81c4cc8ee728b6a58f855f1751bff19d715c85ef8f15c31a41ed7ec9f50709302531a32a0e50e302641c755e6782bf0471397081f64258a4f1886961d5d908229aca54274cc29a92a2fc0cd65b35a6ae65658242a4f9cc40ab316b712390f0a43afc2631cfb77b29c8377ba377320bebe4a08141b37ac04dc6404679357a236103218e2557dcedaa8542b978d7fa4eb1e4678aa4930a17d4e7158f7d206c80e0f8af099eeef1d03d8e8dc1799557663de38b723b84324aa380dc6e9ffa6c63992acefe93c86a47b2205c8e16e03642c9c90f407ed4291c31b33562bcfe8b2d0d2291898da7a8f6e99600ab59b1a803c016cb582354a8cb102f8bcb056696d83088075fcba2c521084cce771ca68b3fcec67603684500a2cf8b48830a520270b15bacb6d07e42803db7be7449b0bacc57cea3c0efeafe7d212d5659f47e464fc653d3d79200b99a2053a7f72c795c37c25f7392eb64147779a7a64a4996267cdc970c2fb90a243532a1c79dfea556aedc9e96bff0c18a2669d0819d50b5b3dfb27ccdcbc6a6a796107d97ba44a308b518237f6249609ec406351f893a76a0bc945abcc9c0c78fd71ed981a47041d731cde53d317eaa015b063144fbed674911035c32f3e7020fb07f8254eafe7a5736fdfd3cef8a8c0a86651997275de9a239eb9ec300dcf09d2ca6012a807ec440c7710484bd36c29849c77f09cbb06dd280508d5efaa2c74f1d056639ac7605ac8b85f80b9a92216248ca72ef82f51898ffb1dc1b26beab15261f458b69d28d2fa2250454e17ef73e3787a161e791621340bfb45537a0e814b162c51f377a77dc2d39eb52c461d4e211f03164c23afaa36ac9872bf27a141aca06fef6bdac0987b3ee291cfbaecedd4e872010918305ae86c41e31c0ce51a49c9a8655e004e364b850fbfd5fb218ff5c9798e709902dab3b5fe287a6bf1bfb21670231e5e4602d5f21f9dd0f6eca83c072404502c801428b7cca0b6f0136152b234dbcf8632f632505b3dd84b761d24d76cfd8de2078adc84a1f7b62476779b51ba7d31fff5828542e53197793d7086213bb90a7b0db5521c0200e23ac2892c5d84540736107c40073dc0f9a8ee511e2ade1c4c9a6d27935a644f69f52fc79246926f106732b6b52b8b12c9a0ad7c746e944b838586dba2cc4c68dd29927fe17dd885ccb994965d3578b1c789c59b334d0ee90249e11401cb5414b2e7726f5ea6ebea88168c62a62213f9a84478ab6da454f81f10fbe7a491f8aeffd79e15f1b0635a46a423dd2065577df21abbcced5c9e0d05a6e4b333b1c24c38f507ba32fa03f901372fc657d8ac375630ad38364d91d5c7b7c0add09e63e198609930fc67239de43b81eb01f1a138a0c309b6c8f0bb4db1dae26ff2591c37f942b5ef7f2cb1e8a2d81292dc5ebc981b4c2e62b8fea2b310d96a014bcaeeb2cea4f23ae274ba55000f9981d1316fd518ccdad8399072d313ddaaa18c75cb6dfe6ac8ea5917502ccc343fe196722e334712b6d82de4e004e5ee0156556f18bc1f98a98046d5803d5270c99352b215973c4953161b586d7540d297bd9b660a675bf4fdb76b89b1a9b062a4aacc604b0dbdd4fe96fc06d5e319d99f1b5ec4e4c66493f5ca0d61fd0a9648e3f50af5d647c6ee4a828d6cc781d35cc557e81babaaf8019c07e31aae9185ac23a686d267ee93564429d935104f1cb0e16572ef4a6c5ff87159d8a63cfcaf874f3cecb230329c854e6e186f682db614956a5742d5bd4485de537f7056194dff112df40119f2321ad1aab8f9bb2182a5b2c548db8636030d0ce1792821c01156db3ff46b68bea9ba4c2f4206780a828123c1399dd226c62b2e2c8b6d6b415a45d4ddf2e7b2a3b87488edc2c515de0ed3bf1c65386ae458bd895129e8611104db7087983aa0af355d0930a2828e8bb960251caf54b3f7d1fed37f73a0ad75ac514ed7c5d927030f4a451ce24aa6fe431e89380531b0b403ed9b90dc8e76e54b4c8f5547e9d6ad67120f6a39a2ac81901c2385c2565eb471586e2bff66f1943b68f3238d60cc7234be9ccf55f103b0db66c12571dbe619d505c6a3cfc5209865a813888886e9f3b1d7a4defd2c9e5b0daa6ef4cde5602f093b9a3f1f7bc9afd1d9f2b5d0aec0c7d8ff52cbaf1d7d5bbf31b244dfb64e52e73ad404a5bbf2bc59b16b099ef412dd66b045432e0afde978d204abde574d011f42ea499666a45c45046d25b2dad572e9cfe1f61d46bb1c1b3cb4c7370e1face56d64071973aeb7b621669b7b21d08631871f4150cc9b71ea6fddbc5286ec6f532898eba45cd88f9a52e2f64e1f2accc4acd70d10e573c05257f3db4d9046256ed8349f333376723283ff20ab3365f7c7b9c5c874bd935bd34ca2e5c45fa5f6461192563fb9e0fff15aaf7538d8ee9afec46f89846cdc3266d2268f8a97c8286731760858079bb41280118e86bde8a3edd39cc2a9a4a9397205c4714d6c4c4d86a6a2b140fb3734a4f0a079e9a42c261e54bd28abe6fd9d0b9631dad17b59b9c9740735e55eaf0308e3d8391746a5e1a82b63ae39b50a0f6d3b16def9e86172d6d8091de96a06ad70c80ff15e0f89e9866db103b8ff935a71db6fc46887981af8c72261677360081c2d6aa9c8500151c6b7181c00d595305d68e7ae760257d3933e68986a718dadc8c5aed128ba459629a058daf21d665b11be131c942046f0f7f2d9637b7b26ce052734e5c30033fe9af6c5f66448118546f19f64581518beb4510aefb0d5ce973744d43b1f650fdb53504135d8cd45996016775fcaeccfc098d144e22931e18883b5aaeb68b19bd873ad4e5852fe05dfd29cb816c03672eb90886479501f8af486025b0b5b241ab45f9610db53ed7cc851c77563cf47589d7f8c7fbd8f9d7a3806ffbabe3b9eee8d7866435c27e90e8b6ac9094914fd5f7be76ecf3273594e70b880c49f64e2dc12497ab6074a88c61358dfbcddd6bf3f932421acd07e82ae643463913f73284f70194b93d27ee5cf2039ce72496016a2e88c9bbbbdd8f292efe1c97285a389dfbe84d88196a3675b0580cd718d2875bb64d814eaef41967aac5f7ee3c6f76a9330c0d9e9f6aa3698420bbaee6cf4e2ac186cfefddf6a1300c7a7ac8d1a86289c4a45d4935bbc4c47b806140126c20cd56304ec3be591b15ddfeb430dc57ff4b8936c70de54c89df134df7690f77baed709b0a74c818bc9713762d1bd6349252d39a45651d836e37b5d4128e7206b001a61c5f2ec509534ed6d23013dae3bbde15662ee16042a6bcfe10b2c8f445604c755bfee6e9b63c39d210b7b578f07fca14c4f833178d71c93c1767cf2110cb12f63b9ec2bf70281bd6a04f858a68103e65de7e24958b77c1fbafb663e62bacce219e4218178302ee8d7031207899006f84a14ef49f573e301002af8a76b6e04fcb5968df66b01a915cbcd8fbecf9cb25e41d18a17a2eed4f1eb88ce424c4e8f848cf8e23a51690a3eb46f7563b7bcf53473cf841bfdb500435d308e5b041cdefc2f88ad6dfdcc49fa107eb5e529e007a2fe045cc62d03f80c6e9eff5fa2e6c6e5af8645d359d0ef6bf65c135c53f8aead7200759eb1ca9c4fb7290236157962e4e28aaf4602ae057bb2a2156307867bdc6db10627c51edacd4d839a60079a0a7e7a27a6d140350cf35396b517f7f5f2dc3a020d46c19a68a26fbec39118c579e832d5b3fd819761101ac3d1884d3526658ff9cac77fe57e4a0e31795c28eed9a165ea67a0d9f531b425bab5257a00a85a5a7f277da8623eba52a10c5c1c87ef81dfb9e321bc4ec253b981ee980c4e4a1745304d9540f3c8bd6dab8a6d948fdb4683637e5a96249d39254f190db5759eff9ed78bb5b936392a7883e1bfc4ce5fddc00e8b42f3f047ef2526a214ff8efc9c800809441065284e7addef420e9e9b6c7b12ee4b07c47da46ced81c5570c7af6a589703c7e90693277b14b7f5036a4c71970fd5509c4ca64f664b61dbc3e15ac29b71d0a024ff5bd82c6a33b25135bdee15aececb8777bbab9909160e0fc529eeaeb06fb9ade2741d2ca27ad92a6cdfc8ce14f8fd28a0ba005417b27db3ef3b28d89278b346513bf5142abf1f44e4f872b81e61a5db3d2ec6d0f6f2797e6cf300354016cca44c513c05149fa7b7ec7fe1948eec3e16bff60c5cdf99c6318283cd063ea5bf9d9e284ca367300a4bd7eadd0325b4598c2b132c1660431ee9875392e65add611124458348b8d7bc88257b7e4bf5804e5e81e112e8a8a6b4fcac6aaf2af5780b6d6f1471a1ece0e82048ab2330eff7546ba7af41c0a9cbfdfc0fddd3e05", @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004004000000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r4, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000b8821b0e2a000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}, 0x1, 0x0, 0x0, 0x48000}, 0x8840) (async) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001b40)=ANY=[@ANYBLOB="d0030000", @ANYRES16=r5, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r6, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=r6, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r6, @ANYBLOB="0400028008000100", @ANYRES32=r6, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="f8000280400001002400010071756575655f696400000000000000000000000005a2e745df647cba000300030000000800040040", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000000ca08000000"], 0x3d0}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x4) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000740)={&(0x7f0000000200)={0x534, r0, 0x800, 0x70bd29, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x288, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x400, 0x3, 0x2c, 0x4}, {0x4, 0x2, 0x17, 0x4}, {0x9, 0x40, 0x2, 0x4}]}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x800}}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x64}}, {0x8}}}]}}, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [{0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x2, 0x7, 0xb3, 0x1000}, {0x0, 0x4, 0x1, 0x8000}, {0x2, 0x2, 0xe0, 0xffffffff}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0x1ff, 0x8, 0x9a, 0x3}, {0x3ff, 0x80, 0x2a, 0x1f}, {0x5, 0x3, 0x4, 0x7e3}, {0x5, 0xf8, 0x40, 0x1}, {0x1, 0xff, 0x9, 0x6}, {0xff, 0x8, 0x32, 0xaab}, {0x81, 0x0, 0x53, 0x8000}]}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}]}, 0x534}, 0x1, 0x0, 0x0, 0x80}, 0x20004000) (async) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) r12 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r12, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r12, 0xc01064b3, &(0x7f00000001c0)={r13}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r12, 0xc00464b4, &(0x7f0000000040)={r11}) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x7, 0x40800) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) r0 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), 0x4) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x1) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) socket$bt_bnep(0x1f, 0x3, 0x4) (async) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), 0x4) (async) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x4) (async) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000280)=0x1, 0x4) (async) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x1) (async) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x5a2}) (async, rerun: 64) getsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 32) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) r6 = syz_open_dev$dri(&(0x7f0000000100), 0x9, 0x10643) (async) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x4) (async) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000200)={0x8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000200)={0x80000000, &(0x7f0000000080), &(0x7f0000000100)=[{{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f0000000240)={{0x80000000, 0x0, 0x6, [0x3, 0x5]}, {r3, 0x0, 0x3, [0x8, 0x80]}, 0x10000000, [0x8, 0xca3c]}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x4, 0x10003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000040), 0x3, 0x711841) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x10001, 0x6900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0xa, 0x60c2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x6b78, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f0000000280)) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x800, 0xc83, 0x0, 0x0}) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000240)={0x22, 0x2, 0x3, 0x2, 0x67}, 0x6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000100), 0x80) socket$bt_bnep(0x1f, 0x3, 0x4) r5 = socket$bt_cmtp(0x1f, 0x3, 0x5) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740)=0x3, 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x201dc, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000300)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r6, 0x9}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x4, 0x10003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000040), 0x3, 0x711841) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) syz_open_dev$dri(&(0x7f0000000040), 0x3, 0x711841) (async) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) (async) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x5a2}) getsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) r6 = syz_open_dev$dri(&(0x7f0000000100), 0x9, 0x10643) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000200)={0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x0, 0x5a2}) (async) getsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) syz_open_dev$dri(&(0x7f0000000100), 0x9, 0x10643) (async) pipe2$watch_queue(&(0x7f0000000240), 0x80) (async) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x4) (async) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000200)={0x8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x8000, 0x34000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000100)=0x9) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x2, r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x4, 0x10003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 64) 13:11:21 executing program 1: recvfrom$llc(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x1, &(0x7f0000000000)={0x1a, 0x303, 0x4, 0x1, 0xfc, 0x81}, 0x10) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080), 0xff, 0xc0800) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000100)={0x4e}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x3, 0xb, 0xffffff0d, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x10001, 0x6900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0xa, 0x60c2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x6b78, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f0000000280)) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x800, 0xc83, 0x0, 0x0}) (async) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000240)={0x22, 0x2, 0x3, 0x2, 0x67}, 0x6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000100), 0x80) (rerun: 32) socket$bt_bnep(0x1f, 0x3, 0x4) (async, rerun: 32) r5 = socket$bt_cmtp(0x1f, 0x3, 0x5) (rerun: 32) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740)=0x3, 0x2) (async, rerun: 64) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x201dc, 0x0}) (rerun: 64) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async, rerun: 32) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r6, 0x9}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x8000, 0x34000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000100)=0x9) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x2, r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x8000, 0x34000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000100)=0x9) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x2, r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:21 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000040), 0x3, 0x711841) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x10001, 0x6900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0xa, 0x60c2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x6b78, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f0000000280)) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x800, 0xc83, 0x0, 0x0}) (async) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000240)={0x22, 0x2, 0x3, 0x2, 0x67}, 0x6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000100), 0x80) socket$bt_bnep(0x1f, 0x3, 0x4) r5 = socket$bt_cmtp(0x1f, 0x3, 0x5) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740)=0x3, 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x201dc, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r6, 0x9}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000240)={0x0, 0x20}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x50, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0xc944}, 0x20000050) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x9, 0x4, 0x7f, 0x4}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 1: recvfrom$llc(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x1, &(0x7f0000000000)={0x1a, 0x303, 0x4, 0x1, 0xfc, 0x81}, 0x10) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080), 0xff, 0xc0800) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000100)={0x4e}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x3, 0xb, 0xffffff0d, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000000)) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000200)={0x0, 0x800}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x2, 0x8, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000240)={0x0, 0x20}) (async) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x50, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0xc944}, 0x20000050) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x8000, 0x34000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000100)=0x9) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x2, r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x8000, 0x34000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000100)=0x9) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x2, r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x9, 0x4, 0x7f, 0x4}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000000)) 13:11:21 executing program 1: recvfrom$llc(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x1, &(0x7f0000000000)={0x1a, 0x303, 0x4, 0x1, 0xfc, 0x81}, 0x10) (async) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r4 = syz_open_dev$dri(&(0x7f0000000080), 0xff, 0xc0800) (async) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000100)={0x4e}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x3, 0xb, 0xffffff0d, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x3f, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000240)={0x0, 0x20}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x50, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0xc944}, 0x20000050) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000240)={0x0, 0x20}) (async) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x50, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0xc944}, 0x20000050) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000000)) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async, rerun: 32) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000200)={0x0, 0x800}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x2, 0x8, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x9, 0x4, 0x7f, 0x4}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x9, 0x4, 0x7f, 0x4}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x323402) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x400102, 0x0) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x3f, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000200)={0x0, 0x800}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x2, 0x8, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r4, 0x40106437, &(0x7f0000000200)={0x0, 0x800}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x2, 0x8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000100)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000001280)={0x7, 0x3, 0xfff}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$media(&(0x7f0000000080), 0x1, 0x105501) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000100), &(0x7f0000001200)}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000000)={&(0x7f0000000200)=[0x5, 0xffffffff, 0x1, 0x10001, 0xfffffffa, 0x4, 0x1, 0x8f40, 0x4, 0x80000000, 0xff, 0x7, 0x4, 0x4, 0x49894e9b, 0x2d, 0x80000001, 0x0, 0x57d, 0x0, 0x100, 0x6, 0x2, 0xff, 0x0, 0x2, 0x7, 0x6, 0x1, 0x2, 0x7, 0x40, 0x12, 0xfffffffe, 0x0, 0x2, 0x3, 0x6, 0x9, 0xab, 0x5, 0xfffffffb, 0x3, 0x4, 0x2, 0xfffff800, 0x9, 0xd2, 0x200, 0x5, 0x5, 0x20000000, 0x8, 0x200, 0x9, 0x1, 0x5, 0x0, 0x7, 0x8, 0x3fc379cc, 0x0, 0x983e, 0x543, 0x800, 0x4, 0x1, 0x0, 0x5, 0xfffffff8, 0x2, 0x1, 0x2, 0x4, 0x7fffffff, 0xc4, 0x1, 0xc11d, 0x66f205ec, 0x5, 0x4, 0x8001, 0x6, 0x7, 0x401, 0x1, 0x9, 0x2, 0x6, 0x7, 0x80000001, 0x2, 0x3, 0x1, 0x2e, 0x9, 0x4, 0x8, 0x6, 0x9, 0x7f, 0x7, 0x1, 0x1, 0x0, 0x4, 0x1, 0x4, 0x40, 0x0, 0x3, 0x4, 0x4, 0xc4, 0x4, 0x1, 0x9, 0xfffffff7, 0x7fffffff, 0x4a6a, 0x7ff, 0x8, 0x1, 0x7, 0x1, 0x7f, 0x8, 0x47f7, 0x4, 0xfffffc00, 0x101, 0x4, 0xf7ba, 0x5fe6, 0x7f, 0x3, 0x10001, 0x2, 0x4, 0x0, 0x1, 0x6, 0x2, 0x9, 0x7fff, 0x0, 0x8e3c, 0x0, 0x58, 0x80000001, 0x46f, 0x9, 0x76, 0x1f, 0x1000, 0x9f, 0x9, 0x7fff, 0x80000001, 0x7, 0x2113826b, 0xffff, 0x80, 0x10001, 0x6, 0x80000000, 0x7, 0x1, 0xfffffffc, 0x101, 0x3, 0x5, 0x8, 0x6, 0x10001, 0xffff8001, 0x2, 0x0, 0x3, 0xaaf, 0x8000, 0x5, 0x400, 0x8897, 0x7, 0x1, 0x0, 0x71, 0x80, 0xe68, 0x2, 0x6, 0x38, 0x80000000, 0x0, 0x4, 0x1, 0x3, 0x80, 0x9, 0x20, 0xffff, 0xa8d7, 0x1f, 0x8, 0x0, 0x401, 0x100, 0x7fffffff, 0x9c, 0x3, 0x0, 0x0, 0x4, 0x5, 0x5, 0x7, 0x5, 0xffffffff, 0x48, 0x2, 0x3, 0xab87, 0x3, 0x8, 0x9, 0xaf64, 0x19c, 0x3, 0x100, 0x201b, 0x1, 0x80, 0x2, 0x3, 0x8, 0x0, 0x9a9, 0x75, 0x4, 0x6, 0x269b, 0x3, 0x20, 0x8aeb, 0xac0, 0x401, 0x1, 0x1000, 0xa199, 0x4, 0x1ff, 0x200, 0x7, 0x200, 0x8c7, 0x1, 0x7ff, 0x3ae656fd, 0x0, 0xaa8, 0xffffff13, 0x8, 0x8001, 0x5, 0x0, 0x4, 0x1, 0x0, 0x3, 0x6, 0xffff, 0x18, 0x0, 0x2c00ad0a, 0x10001, 0x3, 0x7, 0x200, 0xffffffe1, 0x3, 0x8, 0x40, 0x6, 0x7, 0x1, 0x1, 0xfffffc00, 0x2, 0x9, 0x800, 0xe5, 0x22, 0xc35, 0xc5, 0x0, 0x3, 0x7ff, 0x3, 0x3, 0x0, 0x5, 0x3, 0x8001, 0x2, 0x3, 0x9, 0xf030, 0x1, 0x800, 0x0, 0x8000, 0x101, 0x6080, 0x3, 0x12, 0x800, 0x7f, 0x7, 0x8000, 0x8, 0xa2d, 0x6, 0x7fffffff, 0x6, 0x100, 0x1, 0x18800000, 0x6, 0x2208, 0x8, 0x781, 0x4, 0xca9, 0xffff9282, 0x2, 0x0, 0x1, 0x67b, 0x2, 0xffffffff, 0x81, 0x0, 0x8, 0x8, 0x80000001, 0x100, 0x1, 0x8001, 0x6, 0x79a30729, 0x5, 0x8, 0x7ff, 0xffff, 0x0, 0x4, 0x80000000, 0x5, 0x20, 0x9, 0x8, 0x80, 0x7, 0x5fe8, 0x18, 0x1, 0x262c, 0x0, 0x1, 0x8, 0x0, 0x2, 0x0, 0x8, 0x8, 0x6bc, 0x6, 0x4, 0x8, 0x0, 0x9, 0x3c91, 0xfffffffd, 0x800, 0x0, 0x9, 0x80, 0x3ad, 0xc4b, 0x1, 0xffff21d7, 0x0, 0x58d9, 0x1, 0xcb6, 0x80, 0x40, 0x1ff, 0x96, 0xe6d3, 0x0, 0x1, 0x5, 0xc70, 0x4, 0x4, 0x3, 0x97f, 0x0, 0x23, 0x0, 0x80, 0x400, 0x1, 0x7, 0x4, 0x2, 0x3, 0x6506, 0xf6, 0x7fff, 0x0, 0xbd24, 0x4, 0x49c, 0x4, 0x6, 0x2, 0xed, 0x81, 0x0, 0x9, 0xb7, 0x80000000, 0x2, 0x2, 0x20, 0x2, 0x200, 0xfffff800, 0x4, 0xfffffff7, 0x8, 0x1, 0x9, 0x2, 0x25f64927, 0x3, 0x3, 0xe7, 0x0, 0x7, 0x3f, 0x7d9, 0x9, 0x80000001, 0x1, 0xff, 0x3ff, 0x1000, 0x1, 0x7, 0x5, 0x8, 0x44, 0x1, 0x6, 0xd833, 0x2800000, 0x49, 0x3, 0x9, 0xffffffff, 0x8, 0x2, 0x401, 0x80000000, 0x7, 0x5, 0x80, 0x7fff, 0x0, 0x358, 0x491c, 0xffffff18, 0x8, 0x80, 0x7, 0x7, 0x0, 0x2, 0xfff, 0x4, 0x6, 0x8, 0x3, 0x2, 0x0, 0x8, 0x5, 0xfff, 0x1ff, 0xb7, 0xf8, 0xff, 0x101, 0x7fa1, 0x1ff, 0xffffffff, 0x10000, 0xffffffff, 0x3f, 0x9, 0x2, 0x3, 0xffffffff, 0x7f, 0x1, 0x8, 0x7, 0xfffffffd, 0x4, 0x6, 0x100, 0xce, 0x5, 0x7fff, 0x6, 0x4, 0x0, 0x0, 0x101, 0x3, 0x7, 0x6, 0x735, 0x81, 0xfffffff9, 0x8, 0xff, 0x2, 0x0, 0x5, 0x8, 0x80000001, 0x20, 0x809, 0x4, 0x8, 0x26c6, 0xa3, 0x0, 0x3ff, 0x6, 0x27a, 0x7, 0x1, 0x7f, 0x6, 0x8, 0x8000, 0x2, 0x7, 0x80000001, 0x9, 0x20, 0x3, 0x5, 0xffffffe0, 0x4, 0x8, 0xfffffffc, 0x20, 0x3, 0xffff, 0x3, 0x101, 0x0, 0x2, 0x8, 0xdab, 0x2, 0x401, 0xfffffffd, 0x1, 0x7, 0x0, 0x100, 0xb9e, 0xffffff80, 0x2, 0x1, 0x3, 0xff, 0x9, 0x5, 0x8d1, 0x7, 0x9, 0x0, 0x7f, 0x7, 0x576b, 0x8, 0x10000, 0x9, 0x9, 0x81, 0x80000000, 0x8, 0x8, 0xfffffffb, 0x0, 0x0, 0x6, 0x81, 0x6, 0x59, 0x5, 0x24, 0x0, 0xef87, 0x7ff, 0x1a0, 0x6, 0x3, 0x80000000, 0x9, 0x0, 0x1, 0x9, 0x1, 0x2, 0xffff, 0x66, 0xfffffffc, 0x9, 0x100, 0x8001, 0x3, 0x7, 0x5, 0x4, 0x4, 0x4, 0x2f09, 0x2, 0x401, 0x0, 0x0, 0x1ff, 0x3, 0x9, 0xffffffff, 0x0, 0x8, 0x0, 0x7, 0x1ff, 0xa11, 0x9, 0x2, 0x2, 0x1, 0x7, 0x0, 0x8, 0x8, 0x8, 0x2, 0x4, 0x10001, 0x8, 0xea15, 0x6, 0x5, 0x0, 0x6, 0x1, 0x80000000, 0x1ff, 0x9, 0x4, 0xfffffffd, 0x800, 0x7ff, 0x3, 0xafe, 0x3, 0x401, 0x0, 0xffffffff, 0x0, 0x9, 0x757, 0x490264ab, 0x5, 0x0, 0x3, 0x9, 0xac2, 0xf7, 0x10000, 0x4, 0x0, 0x9a, 0x81, 0x101, 0x40, 0xffff, 0x7, 0x4, 0x8, 0x66d3, 0x4, 0x8, 0xfff, 0x0, 0x7, 0x80000000, 0xff, 0x1f, 0x4, 0x7, 0x3f, 0x200, 0x1, 0x9, 0x8, 0x80000001, 0x1, 0x1, 0x0, 0xa7b7, 0x0, 0x5, 0xfff, 0xfff, 0x5, 0xffff0001, 0x7f, 0xca1, 0xfe000000, 0x8, 0x9000, 0x8, 0x7fffffff, 0x805bdef0, 0x5, 0x40, 0x9, 0x7ff, 0xfffff85a, 0x401, 0x33d, 0x2, 0x1, 0x20, 0xd7, 0x200, 0x8cc9, 0x6, 0x5, 0x40, 0x3, 0x0, 0x6, 0x8001, 0x8, 0x8, 0x7, 0x6, 0x5, 0x400, 0x8000, 0x0, 0xff, 0xffff93a0, 0x9, 0x6, 0x4, 0x5, 0x8, 0x400, 0x5, 0xd8a0, 0xfffffff8, 0x4, 0x10000, 0x9, 0xff, 0x0, 0x90, 0x7, 0xfffffc01, 0x3f, 0x3f, 0x5, 0x9, 0x3f, 0x1, 0x3, 0x9, 0x400, 0x1, 0x217, 0x3, 0x100, 0x2, 0x4, 0x5, 0x9c9, 0x2, 0x3, 0x40, 0x10000, 0x54, 0x1, 0x8000, 0xff, 0x1f, 0x3, 0x3, 0x7, 0x80, 0x8, 0x1ff, 0xe993, 0x2, 0x4, 0x9, 0x0, 0x8, 0x1, 0x64, 0x1000000, 0xd59f, 0x3, 0x7fffffff, 0x7, 0x0, 0x6, 0x1ff, 0x3, 0x80000001, 0x9, 0x9, 0x2, 0x3, 0x401, 0x20, 0x0, 0x8, 0x9, 0x76, 0x5, 0x3, 0xb6, 0x4, 0x4, 0x3f, 0xdff, 0x80000001, 0x8c, 0xe5, 0x5, 0xfffffffb, 0x2, 0xa4c1, 0x6, 0x7, 0xe06f, 0xefe, 0x0, 0x1, 0x1f, 0x0, 0x1f, 0x6bec, 0x3, 0x7ff, 0x2d4a, 0x8, 0x6, 0x40, 0x1, 0x8001, 0x4, 0xfffffffa, 0xffffffff, 0x2, 0x3, 0x20, 0x8, 0x3, 0x2, 0x8e, 0x0, 0x0, 0xed9, 0x9, 0x80000001, 0x6, 0x80, 0x0, 0x8, 0x4, 0xa47, 0x5, 0x10001, 0x1000, 0x3ff, 0x0, 0x1, 0x9000, 0x0, 0x3, 0xfffffff9, 0x101, 0x7ff, 0x1, 0x0, 0x6, 0x8, 0x9, 0x7c7, 0x1, 0x9, 0x9, 0xff, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x8f7, 0x300, 0x9f, 0xfffffff7, 0x80000001, 0xff, 0x1, 0x7, 0x8fd, 0x2, 0x7, 0x7fffffff, 0x57ea, 0xad, 0x0, 0x101, 0x2, 0xffffffff, 0x0, 0x2e, 0xb4, 0x81, 0x5, 0x8000, 0xeeb, 0x6, 0x2, 0x8de, 0x8, 0x3, 0x7ff, 0x7fffffff, 0x1, 0x101, 0x7, 0x40, 0x5, 0x8, 0xd4b, 0xff, 0x0, 0x8000, 0x0, 0x100, 0x0, 0x2, 0x3, 0x9, 0x4262, 0x1, 0x1, 0x8, 0x2ae, 0x800, 0x3, 0x101, 0x6a, 0x7ff, 0x4, 0x9, 0x1ff, 0x1, 0x0, 0x0, 0x8, 0x1ff, 0x2815, 0x20, 0x5, 0x9275, 0x7, 0x81, 0x2, 0x6, 0x2, 0x4, 0x9, 0x40, 0x4, 0x8, 0x2, 0x7f, 0x3, 0x7f, 0x6, 0x8], 0x5, 0x400, 0x3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x400102, 0x0) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000001280)={0x7, 0x3, 0xfff}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$media(&(0x7f0000000080), 0x1, 0x105501) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000100), &(0x7f0000001200)}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 64) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000000)={&(0x7f0000000200)=[0x5, 0xffffffff, 0x1, 0x10001, 0xfffffffa, 0x4, 0x1, 0x8f40, 0x4, 0x80000000, 0xff, 0x7, 0x4, 0x4, 0x49894e9b, 0x2d, 0x80000001, 0x0, 0x57d, 0x0, 0x100, 0x6, 0x2, 0xff, 0x0, 0x2, 0x7, 0x6, 0x1, 0x2, 0x7, 0x40, 0x12, 0xfffffffe, 0x0, 0x2, 0x3, 0x6, 0x9, 0xab, 0x5, 0xfffffffb, 0x3, 0x4, 0x2, 0xfffff800, 0x9, 0xd2, 0x200, 0x5, 0x5, 0x20000000, 0x8, 0x200, 0x9, 0x1, 0x5, 0x0, 0x7, 0x8, 0x3fc379cc, 0x0, 0x983e, 0x543, 0x800, 0x4, 0x1, 0x0, 0x5, 0xfffffff8, 0x2, 0x1, 0x2, 0x4, 0x7fffffff, 0xc4, 0x1, 0xc11d, 0x66f205ec, 0x5, 0x4, 0x8001, 0x6, 0x7, 0x401, 0x1, 0x9, 0x2, 0x6, 0x7, 0x80000001, 0x2, 0x3, 0x1, 0x2e, 0x9, 0x4, 0x8, 0x6, 0x9, 0x7f, 0x7, 0x1, 0x1, 0x0, 0x4, 0x1, 0x4, 0x40, 0x0, 0x3, 0x4, 0x4, 0xc4, 0x4, 0x1, 0x9, 0xfffffff7, 0x7fffffff, 0x4a6a, 0x7ff, 0x8, 0x1, 0x7, 0x1, 0x7f, 0x8, 0x47f7, 0x4, 0xfffffc00, 0x101, 0x4, 0xf7ba, 0x5fe6, 0x7f, 0x3, 0x10001, 0x2, 0x4, 0x0, 0x1, 0x6, 0x2, 0x9, 0x7fff, 0x0, 0x8e3c, 0x0, 0x58, 0x80000001, 0x46f, 0x9, 0x76, 0x1f, 0x1000, 0x9f, 0x9, 0x7fff, 0x80000001, 0x7, 0x2113826b, 0xffff, 0x80, 0x10001, 0x6, 0x80000000, 0x7, 0x1, 0xfffffffc, 0x101, 0x3, 0x5, 0x8, 0x6, 0x10001, 0xffff8001, 0x2, 0x0, 0x3, 0xaaf, 0x8000, 0x5, 0x400, 0x8897, 0x7, 0x1, 0x0, 0x71, 0x80, 0xe68, 0x2, 0x6, 0x38, 0x80000000, 0x0, 0x4, 0x1, 0x3, 0x80, 0x9, 0x20, 0xffff, 0xa8d7, 0x1f, 0x8, 0x0, 0x401, 0x100, 0x7fffffff, 0x9c, 0x3, 0x0, 0x0, 0x4, 0x5, 0x5, 0x7, 0x5, 0xffffffff, 0x48, 0x2, 0x3, 0xab87, 0x3, 0x8, 0x9, 0xaf64, 0x19c, 0x3, 0x100, 0x201b, 0x1, 0x80, 0x2, 0x3, 0x8, 0x0, 0x9a9, 0x75, 0x4, 0x6, 0x269b, 0x3, 0x20, 0x8aeb, 0xac0, 0x401, 0x1, 0x1000, 0xa199, 0x4, 0x1ff, 0x200, 0x7, 0x200, 0x8c7, 0x1, 0x7ff, 0x3ae656fd, 0x0, 0xaa8, 0xffffff13, 0x8, 0x8001, 0x5, 0x0, 0x4, 0x1, 0x0, 0x3, 0x6, 0xffff, 0x18, 0x0, 0x2c00ad0a, 0x10001, 0x3, 0x7, 0x200, 0xffffffe1, 0x3, 0x8, 0x40, 0x6, 0x7, 0x1, 0x1, 0xfffffc00, 0x2, 0x9, 0x800, 0xe5, 0x22, 0xc35, 0xc5, 0x0, 0x3, 0x7ff, 0x3, 0x3, 0x0, 0x5, 0x3, 0x8001, 0x2, 0x3, 0x9, 0xf030, 0x1, 0x800, 0x0, 0x8000, 0x101, 0x6080, 0x3, 0x12, 0x800, 0x7f, 0x7, 0x8000, 0x8, 0xa2d, 0x6, 0x7fffffff, 0x6, 0x100, 0x1, 0x18800000, 0x6, 0x2208, 0x8, 0x781, 0x4, 0xca9, 0xffff9282, 0x2, 0x0, 0x1, 0x67b, 0x2, 0xffffffff, 0x81, 0x0, 0x8, 0x8, 0x80000001, 0x100, 0x1, 0x8001, 0x6, 0x79a30729, 0x5, 0x8, 0x7ff, 0xffff, 0x0, 0x4, 0x80000000, 0x5, 0x20, 0x9, 0x8, 0x80, 0x7, 0x5fe8, 0x18, 0x1, 0x262c, 0x0, 0x1, 0x8, 0x0, 0x2, 0x0, 0x8, 0x8, 0x6bc, 0x6, 0x4, 0x8, 0x0, 0x9, 0x3c91, 0xfffffffd, 0x800, 0x0, 0x9, 0x80, 0x3ad, 0xc4b, 0x1, 0xffff21d7, 0x0, 0x58d9, 0x1, 0xcb6, 0x80, 0x40, 0x1ff, 0x96, 0xe6d3, 0x0, 0x1, 0x5, 0xc70, 0x4, 0x4, 0x3, 0x97f, 0x0, 0x23, 0x0, 0x80, 0x400, 0x1, 0x7, 0x4, 0x2, 0x3, 0x6506, 0xf6, 0x7fff, 0x0, 0xbd24, 0x4, 0x49c, 0x4, 0x6, 0x2, 0xed, 0x81, 0x0, 0x9, 0xb7, 0x80000000, 0x2, 0x2, 0x20, 0x2, 0x200, 0xfffff800, 0x4, 0xfffffff7, 0x8, 0x1, 0x9, 0x2, 0x25f64927, 0x3, 0x3, 0xe7, 0x0, 0x7, 0x3f, 0x7d9, 0x9, 0x80000001, 0x1, 0xff, 0x3ff, 0x1000, 0x1, 0x7, 0x5, 0x8, 0x44, 0x1, 0x6, 0xd833, 0x2800000, 0x49, 0x3, 0x9, 0xffffffff, 0x8, 0x2, 0x401, 0x80000000, 0x7, 0x5, 0x80, 0x7fff, 0x0, 0x358, 0x491c, 0xffffff18, 0x8, 0x80, 0x7, 0x7, 0x0, 0x2, 0xfff, 0x4, 0x6, 0x8, 0x3, 0x2, 0x0, 0x8, 0x5, 0xfff, 0x1ff, 0xb7, 0xf8, 0xff, 0x101, 0x7fa1, 0x1ff, 0xffffffff, 0x10000, 0xffffffff, 0x3f, 0x9, 0x2, 0x3, 0xffffffff, 0x7f, 0x1, 0x8, 0x7, 0xfffffffd, 0x4, 0x6, 0x100, 0xce, 0x5, 0x7fff, 0x6, 0x4, 0x0, 0x0, 0x101, 0x3, 0x7, 0x6, 0x735, 0x81, 0xfffffff9, 0x8, 0xff, 0x2, 0x0, 0x5, 0x8, 0x80000001, 0x20, 0x809, 0x4, 0x8, 0x26c6, 0xa3, 0x0, 0x3ff, 0x6, 0x27a, 0x7, 0x1, 0x7f, 0x6, 0x8, 0x8000, 0x2, 0x7, 0x80000001, 0x9, 0x20, 0x3, 0x5, 0xffffffe0, 0x4, 0x8, 0xfffffffc, 0x20, 0x3, 0xffff, 0x3, 0x101, 0x0, 0x2, 0x8, 0xdab, 0x2, 0x401, 0xfffffffd, 0x1, 0x7, 0x0, 0x100, 0xb9e, 0xffffff80, 0x2, 0x1, 0x3, 0xff, 0x9, 0x5, 0x8d1, 0x7, 0x9, 0x0, 0x7f, 0x7, 0x576b, 0x8, 0x10000, 0x9, 0x9, 0x81, 0x80000000, 0x8, 0x8, 0xfffffffb, 0x0, 0x0, 0x6, 0x81, 0x6, 0x59, 0x5, 0x24, 0x0, 0xef87, 0x7ff, 0x1a0, 0x6, 0x3, 0x80000000, 0x9, 0x0, 0x1, 0x9, 0x1, 0x2, 0xffff, 0x66, 0xfffffffc, 0x9, 0x100, 0x8001, 0x3, 0x7, 0x5, 0x4, 0x4, 0x4, 0x2f09, 0x2, 0x401, 0x0, 0x0, 0x1ff, 0x3, 0x9, 0xffffffff, 0x0, 0x8, 0x0, 0x7, 0x1ff, 0xa11, 0x9, 0x2, 0x2, 0x1, 0x7, 0x0, 0x8, 0x8, 0x8, 0x2, 0x4, 0x10001, 0x8, 0xea15, 0x6, 0x5, 0x0, 0x6, 0x1, 0x80000000, 0x1ff, 0x9, 0x4, 0xfffffffd, 0x800, 0x7ff, 0x3, 0xafe, 0x3, 0x401, 0x0, 0xffffffff, 0x0, 0x9, 0x757, 0x490264ab, 0x5, 0x0, 0x3, 0x9, 0xac2, 0xf7, 0x10000, 0x4, 0x0, 0x9a, 0x81, 0x101, 0x40, 0xffff, 0x7, 0x4, 0x8, 0x66d3, 0x4, 0x8, 0xfff, 0x0, 0x7, 0x80000000, 0xff, 0x1f, 0x4, 0x7, 0x3f, 0x200, 0x1, 0x9, 0x8, 0x80000001, 0x1, 0x1, 0x0, 0xa7b7, 0x0, 0x5, 0xfff, 0xfff, 0x5, 0xffff0001, 0x7f, 0xca1, 0xfe000000, 0x8, 0x9000, 0x8, 0x7fffffff, 0x805bdef0, 0x5, 0x40, 0x9, 0x7ff, 0xfffff85a, 0x401, 0x33d, 0x2, 0x1, 0x20, 0xd7, 0x200, 0x8cc9, 0x6, 0x5, 0x40, 0x3, 0x0, 0x6, 0x8001, 0x8, 0x8, 0x7, 0x6, 0x5, 0x400, 0x8000, 0x0, 0xff, 0xffff93a0, 0x9, 0x6, 0x4, 0x5, 0x8, 0x400, 0x5, 0xd8a0, 0xfffffff8, 0x4, 0x10000, 0x9, 0xff, 0x0, 0x90, 0x7, 0xfffffc01, 0x3f, 0x3f, 0x5, 0x9, 0x3f, 0x1, 0x3, 0x9, 0x400, 0x1, 0x217, 0x3, 0x100, 0x2, 0x4, 0x5, 0x9c9, 0x2, 0x3, 0x40, 0x10000, 0x54, 0x1, 0x8000, 0xff, 0x1f, 0x3, 0x3, 0x7, 0x80, 0x8, 0x1ff, 0xe993, 0x2, 0x4, 0x9, 0x0, 0x8, 0x1, 0x64, 0x1000000, 0xd59f, 0x3, 0x7fffffff, 0x7, 0x0, 0x6, 0x1ff, 0x3, 0x80000001, 0x9, 0x9, 0x2, 0x3, 0x401, 0x20, 0x0, 0x8, 0x9, 0x76, 0x5, 0x3, 0xb6, 0x4, 0x4, 0x3f, 0xdff, 0x80000001, 0x8c, 0xe5, 0x5, 0xfffffffb, 0x2, 0xa4c1, 0x6, 0x7, 0xe06f, 0xefe, 0x0, 0x1, 0x1f, 0x0, 0x1f, 0x6bec, 0x3, 0x7ff, 0x2d4a, 0x8, 0x6, 0x40, 0x1, 0x8001, 0x4, 0xfffffffa, 0xffffffff, 0x2, 0x3, 0x20, 0x8, 0x3, 0x2, 0x8e, 0x0, 0x0, 0xed9, 0x9, 0x80000001, 0x6, 0x80, 0x0, 0x8, 0x4, 0xa47, 0x5, 0x10001, 0x1000, 0x3ff, 0x0, 0x1, 0x9000, 0x0, 0x3, 0xfffffff9, 0x101, 0x7ff, 0x1, 0x0, 0x6, 0x8, 0x9, 0x7c7, 0x1, 0x9, 0x9, 0xff, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x8f7, 0x300, 0x9f, 0xfffffff7, 0x80000001, 0xff, 0x1, 0x7, 0x8fd, 0x2, 0x7, 0x7fffffff, 0x57ea, 0xad, 0x0, 0x101, 0x2, 0xffffffff, 0x0, 0x2e, 0xb4, 0x81, 0x5, 0x8000, 0xeeb, 0x6, 0x2, 0x8de, 0x8, 0x3, 0x7ff, 0x7fffffff, 0x1, 0x101, 0x7, 0x40, 0x5, 0x8, 0xd4b, 0xff, 0x0, 0x8000, 0x0, 0x100, 0x0, 0x2, 0x3, 0x9, 0x4262, 0x1, 0x1, 0x8, 0x2ae, 0x800, 0x3, 0x101, 0x6a, 0x7ff, 0x4, 0x9, 0x1ff, 0x1, 0x0, 0x0, 0x8, 0x1ff, 0x2815, 0x20, 0x5, 0x9275, 0x7, 0x81, 0x2, 0x6, 0x2, 0x4, 0x9, 0x40, 0x4, 0x8, 0x2, 0x7f, 0x3, 0x7f, 0x6, 0x8], 0x5, 0x400, 0x3}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x400000) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0xfffffff8, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000280)={0xfffffffffffff4bf, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000080)={0x0, r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r7 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="cc030000", @ANYRES16=0x0, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=0x0, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=0x0, @ANYBLOB="0400028008000100", @ANYRES32=0x0, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08040100", @ANYRES32=0x0, @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}}, 0x0) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001480)={&(0x7f0000000700)={0xd70, 0x0, 0x20, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0xfffa, 0x80, 0x80, 0xfff}, {0x9, 0xff, 0x1, 0x8}, {0x8, 0x0, 0xfb, 0xb9c}, {0x3, 0x9, 0x9, 0x8001}, {0x8, 0x1, 0x4, 0x6}, {0xbd31, 0x20, 0x7, 0xfff}, {0x20, 0x68, 0x6, 0x2}, {0xfff, 0x0, 0x20}, {0x4, 0x1f, 0x6d, 0x1}, {0x8, 0x3b, 0x9d, 0x3}]}}}, {0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x81, 0x1f, 0x1}, {0xfffe, 0x7, 0x4, 0x7}, {0x4, 0x0, 0x0, 0x10000}, {0x2, 0x1, 0x8, 0xbcc8}, {0x7, 0x89, 0x86, 0x7fff}, {0x6, 0x0, 0x0, 0xc2db}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4cf7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000000}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1f8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff3d}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xc5}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1f}}, {0x8}}}]}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x401, 0x4, 0x8, 0x8}, {0xff7f, 0x20, 0x2, 0xb0e}, {0x7, 0xfa, 0x3f, 0x4}, {0xc3, 0x0, 0x8, 0x608}, {0x4a0, 0xfb, 0x79, 0x3}, {0x401, 0x7, 0x80, 0x7ae8590}, {0x6, 0x81, 0x1, 0xfffffffd}, {0x3738, 0xcc, 0xb0, 0x8}, {0xb3, 0x80, 0x6, 0x2}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x27cd}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x401}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x278, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1e47, 0x7f, 0x0, 0x8000}, {0x1000, 0x40, 0x7, 0x1}, {0x7ff, 0x2, 0x1, 0x7}, {0x598, 0x37, 0x1, 0x8}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}]}}, {{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xf397}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20}}, {0x8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}]}, 0xd70}}, 0x50) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x323402) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x323402) (async) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x3f, 0x7, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x3f, 0x7, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x400000) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0xfffffff8, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000280)={0xfffffffffffff4bf, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000080)={0x0, r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) r7 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="cc030000", @ANYRES16=0x0, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=0x0, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=0x0, @ANYBLOB="0400028008000100", @ANYRES32=0x0, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08040100", @ANYRES32=0x0, @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}}, 0x0) (async) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001480)={&(0x7f0000000700)={0xd70, 0x0, 0x20, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0xfffa, 0x80, 0x80, 0xfff}, {0x9, 0xff, 0x1, 0x8}, {0x8, 0x0, 0xfb, 0xb9c}, {0x3, 0x9, 0x9, 0x8001}, {0x8, 0x1, 0x4, 0x6}, {0xbd31, 0x20, 0x7, 0xfff}, {0x20, 0x68, 0x6, 0x2}, {0xfff, 0x0, 0x20}, {0x4, 0x1f, 0x6d, 0x1}, {0x8, 0x3b, 0x9d, 0x3}]}}}, {0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x81, 0x1f, 0x1}, {0xfffe, 0x7, 0x4, 0x7}, {0x4, 0x0, 0x0, 0x10000}, {0x2, 0x1, 0x8, 0xbcc8}, {0x7, 0x89, 0x86, 0x7fff}, {0x6, 0x0, 0x0, 0xc2db}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4cf7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000000}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1f8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff3d}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xc5}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1f}}, {0x8}}}]}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x401, 0x4, 0x8, 0x8}, {0xff7f, 0x20, 0x2, 0xb0e}, {0x7, 0xfa, 0x3f, 0x4}, {0xc3, 0x0, 0x8, 0x608}, {0x4a0, 0xfb, 0x79, 0x3}, {0x401, 0x7, 0x80, 0x7ae8590}, {0x6, 0x81, 0x1, 0xfffffffd}, {0x3738, 0xcc, 0xb0, 0x8}, {0xb3, 0x80, 0x6, 0x2}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x27cd}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x401}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x278, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1e47, 0x7f, 0x0, 0x8000}, {0x1000, 0x40, 0x7, 0x1}, {0x7ff, 0x2, 0x1, 0x7}, {0x598, 0x37, 0x1, 0x8}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}]}}, {{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xf397}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20}}, {0x8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}]}, 0xd70}}, 0x50) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x400102, 0x0) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x323402) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000001280)={0x7, 0x3, 0xfff}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 32) r4 = syz_open_dev$media(&(0x7f0000000080), 0x1, 0x105501) (rerun: 32) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000100), &(0x7f0000001200)}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000000)={&(0x7f0000000200)=[0x5, 0xffffffff, 0x1, 0x10001, 0xfffffffa, 0x4, 0x1, 0x8f40, 0x4, 0x80000000, 0xff, 0x7, 0x4, 0x4, 0x49894e9b, 0x2d, 0x80000001, 0x0, 0x57d, 0x0, 0x100, 0x6, 0x2, 0xff, 0x0, 0x2, 0x7, 0x6, 0x1, 0x2, 0x7, 0x40, 0x12, 0xfffffffe, 0x0, 0x2, 0x3, 0x6, 0x9, 0xab, 0x5, 0xfffffffb, 0x3, 0x4, 0x2, 0xfffff800, 0x9, 0xd2, 0x200, 0x5, 0x5, 0x20000000, 0x8, 0x200, 0x9, 0x1, 0x5, 0x0, 0x7, 0x8, 0x3fc379cc, 0x0, 0x983e, 0x543, 0x800, 0x4, 0x1, 0x0, 0x5, 0xfffffff8, 0x2, 0x1, 0x2, 0x4, 0x7fffffff, 0xc4, 0x1, 0xc11d, 0x66f205ec, 0x5, 0x4, 0x8001, 0x6, 0x7, 0x401, 0x1, 0x9, 0x2, 0x6, 0x7, 0x80000001, 0x2, 0x3, 0x1, 0x2e, 0x9, 0x4, 0x8, 0x6, 0x9, 0x7f, 0x7, 0x1, 0x1, 0x0, 0x4, 0x1, 0x4, 0x40, 0x0, 0x3, 0x4, 0x4, 0xc4, 0x4, 0x1, 0x9, 0xfffffff7, 0x7fffffff, 0x4a6a, 0x7ff, 0x8, 0x1, 0x7, 0x1, 0x7f, 0x8, 0x47f7, 0x4, 0xfffffc00, 0x101, 0x4, 0xf7ba, 0x5fe6, 0x7f, 0x3, 0x10001, 0x2, 0x4, 0x0, 0x1, 0x6, 0x2, 0x9, 0x7fff, 0x0, 0x8e3c, 0x0, 0x58, 0x80000001, 0x46f, 0x9, 0x76, 0x1f, 0x1000, 0x9f, 0x9, 0x7fff, 0x80000001, 0x7, 0x2113826b, 0xffff, 0x80, 0x10001, 0x6, 0x80000000, 0x7, 0x1, 0xfffffffc, 0x101, 0x3, 0x5, 0x8, 0x6, 0x10001, 0xffff8001, 0x2, 0x0, 0x3, 0xaaf, 0x8000, 0x5, 0x400, 0x8897, 0x7, 0x1, 0x0, 0x71, 0x80, 0xe68, 0x2, 0x6, 0x38, 0x80000000, 0x0, 0x4, 0x1, 0x3, 0x80, 0x9, 0x20, 0xffff, 0xa8d7, 0x1f, 0x8, 0x0, 0x401, 0x100, 0x7fffffff, 0x9c, 0x3, 0x0, 0x0, 0x4, 0x5, 0x5, 0x7, 0x5, 0xffffffff, 0x48, 0x2, 0x3, 0xab87, 0x3, 0x8, 0x9, 0xaf64, 0x19c, 0x3, 0x100, 0x201b, 0x1, 0x80, 0x2, 0x3, 0x8, 0x0, 0x9a9, 0x75, 0x4, 0x6, 0x269b, 0x3, 0x20, 0x8aeb, 0xac0, 0x401, 0x1, 0x1000, 0xa199, 0x4, 0x1ff, 0x200, 0x7, 0x200, 0x8c7, 0x1, 0x7ff, 0x3ae656fd, 0x0, 0xaa8, 0xffffff13, 0x8, 0x8001, 0x5, 0x0, 0x4, 0x1, 0x0, 0x3, 0x6, 0xffff, 0x18, 0x0, 0x2c00ad0a, 0x10001, 0x3, 0x7, 0x200, 0xffffffe1, 0x3, 0x8, 0x40, 0x6, 0x7, 0x1, 0x1, 0xfffffc00, 0x2, 0x9, 0x800, 0xe5, 0x22, 0xc35, 0xc5, 0x0, 0x3, 0x7ff, 0x3, 0x3, 0x0, 0x5, 0x3, 0x8001, 0x2, 0x3, 0x9, 0xf030, 0x1, 0x800, 0x0, 0x8000, 0x101, 0x6080, 0x3, 0x12, 0x800, 0x7f, 0x7, 0x8000, 0x8, 0xa2d, 0x6, 0x7fffffff, 0x6, 0x100, 0x1, 0x18800000, 0x6, 0x2208, 0x8, 0x781, 0x4, 0xca9, 0xffff9282, 0x2, 0x0, 0x1, 0x67b, 0x2, 0xffffffff, 0x81, 0x0, 0x8, 0x8, 0x80000001, 0x100, 0x1, 0x8001, 0x6, 0x79a30729, 0x5, 0x8, 0x7ff, 0xffff, 0x0, 0x4, 0x80000000, 0x5, 0x20, 0x9, 0x8, 0x80, 0x7, 0x5fe8, 0x18, 0x1, 0x262c, 0x0, 0x1, 0x8, 0x0, 0x2, 0x0, 0x8, 0x8, 0x6bc, 0x6, 0x4, 0x8, 0x0, 0x9, 0x3c91, 0xfffffffd, 0x800, 0x0, 0x9, 0x80, 0x3ad, 0xc4b, 0x1, 0xffff21d7, 0x0, 0x58d9, 0x1, 0xcb6, 0x80, 0x40, 0x1ff, 0x96, 0xe6d3, 0x0, 0x1, 0x5, 0xc70, 0x4, 0x4, 0x3, 0x97f, 0x0, 0x23, 0x0, 0x80, 0x400, 0x1, 0x7, 0x4, 0x2, 0x3, 0x6506, 0xf6, 0x7fff, 0x0, 0xbd24, 0x4, 0x49c, 0x4, 0x6, 0x2, 0xed, 0x81, 0x0, 0x9, 0xb7, 0x80000000, 0x2, 0x2, 0x20, 0x2, 0x200, 0xfffff800, 0x4, 0xfffffff7, 0x8, 0x1, 0x9, 0x2, 0x25f64927, 0x3, 0x3, 0xe7, 0x0, 0x7, 0x3f, 0x7d9, 0x9, 0x80000001, 0x1, 0xff, 0x3ff, 0x1000, 0x1, 0x7, 0x5, 0x8, 0x44, 0x1, 0x6, 0xd833, 0x2800000, 0x49, 0x3, 0x9, 0xffffffff, 0x8, 0x2, 0x401, 0x80000000, 0x7, 0x5, 0x80, 0x7fff, 0x0, 0x358, 0x491c, 0xffffff18, 0x8, 0x80, 0x7, 0x7, 0x0, 0x2, 0xfff, 0x4, 0x6, 0x8, 0x3, 0x2, 0x0, 0x8, 0x5, 0xfff, 0x1ff, 0xb7, 0xf8, 0xff, 0x101, 0x7fa1, 0x1ff, 0xffffffff, 0x10000, 0xffffffff, 0x3f, 0x9, 0x2, 0x3, 0xffffffff, 0x7f, 0x1, 0x8, 0x7, 0xfffffffd, 0x4, 0x6, 0x100, 0xce, 0x5, 0x7fff, 0x6, 0x4, 0x0, 0x0, 0x101, 0x3, 0x7, 0x6, 0x735, 0x81, 0xfffffff9, 0x8, 0xff, 0x2, 0x0, 0x5, 0x8, 0x80000001, 0x20, 0x809, 0x4, 0x8, 0x26c6, 0xa3, 0x0, 0x3ff, 0x6, 0x27a, 0x7, 0x1, 0x7f, 0x6, 0x8, 0x8000, 0x2, 0x7, 0x80000001, 0x9, 0x20, 0x3, 0x5, 0xffffffe0, 0x4, 0x8, 0xfffffffc, 0x20, 0x3, 0xffff, 0x3, 0x101, 0x0, 0x2, 0x8, 0xdab, 0x2, 0x401, 0xfffffffd, 0x1, 0x7, 0x0, 0x100, 0xb9e, 0xffffff80, 0x2, 0x1, 0x3, 0xff, 0x9, 0x5, 0x8d1, 0x7, 0x9, 0x0, 0x7f, 0x7, 0x576b, 0x8, 0x10000, 0x9, 0x9, 0x81, 0x80000000, 0x8, 0x8, 0xfffffffb, 0x0, 0x0, 0x6, 0x81, 0x6, 0x59, 0x5, 0x24, 0x0, 0xef87, 0x7ff, 0x1a0, 0x6, 0x3, 0x80000000, 0x9, 0x0, 0x1, 0x9, 0x1, 0x2, 0xffff, 0x66, 0xfffffffc, 0x9, 0x100, 0x8001, 0x3, 0x7, 0x5, 0x4, 0x4, 0x4, 0x2f09, 0x2, 0x401, 0x0, 0x0, 0x1ff, 0x3, 0x9, 0xffffffff, 0x0, 0x8, 0x0, 0x7, 0x1ff, 0xa11, 0x9, 0x2, 0x2, 0x1, 0x7, 0x0, 0x8, 0x8, 0x8, 0x2, 0x4, 0x10001, 0x8, 0xea15, 0x6, 0x5, 0x0, 0x6, 0x1, 0x80000000, 0x1ff, 0x9, 0x4, 0xfffffffd, 0x800, 0x7ff, 0x3, 0xafe, 0x3, 0x401, 0x0, 0xffffffff, 0x0, 0x9, 0x757, 0x490264ab, 0x5, 0x0, 0x3, 0x9, 0xac2, 0xf7, 0x10000, 0x4, 0x0, 0x9a, 0x81, 0x101, 0x40, 0xffff, 0x7, 0x4, 0x8, 0x66d3, 0x4, 0x8, 0xfff, 0x0, 0x7, 0x80000000, 0xff, 0x1f, 0x4, 0x7, 0x3f, 0x200, 0x1, 0x9, 0x8, 0x80000001, 0x1, 0x1, 0x0, 0xa7b7, 0x0, 0x5, 0xfff, 0xfff, 0x5, 0xffff0001, 0x7f, 0xca1, 0xfe000000, 0x8, 0x9000, 0x8, 0x7fffffff, 0x805bdef0, 0x5, 0x40, 0x9, 0x7ff, 0xfffff85a, 0x401, 0x33d, 0x2, 0x1, 0x20, 0xd7, 0x200, 0x8cc9, 0x6, 0x5, 0x40, 0x3, 0x0, 0x6, 0x8001, 0x8, 0x8, 0x7, 0x6, 0x5, 0x400, 0x8000, 0x0, 0xff, 0xffff93a0, 0x9, 0x6, 0x4, 0x5, 0x8, 0x400, 0x5, 0xd8a0, 0xfffffff8, 0x4, 0x10000, 0x9, 0xff, 0x0, 0x90, 0x7, 0xfffffc01, 0x3f, 0x3f, 0x5, 0x9, 0x3f, 0x1, 0x3, 0x9, 0x400, 0x1, 0x217, 0x3, 0x100, 0x2, 0x4, 0x5, 0x9c9, 0x2, 0x3, 0x40, 0x10000, 0x54, 0x1, 0x8000, 0xff, 0x1f, 0x3, 0x3, 0x7, 0x80, 0x8, 0x1ff, 0xe993, 0x2, 0x4, 0x9, 0x0, 0x8, 0x1, 0x64, 0x1000000, 0xd59f, 0x3, 0x7fffffff, 0x7, 0x0, 0x6, 0x1ff, 0x3, 0x80000001, 0x9, 0x9, 0x2, 0x3, 0x401, 0x20, 0x0, 0x8, 0x9, 0x76, 0x5, 0x3, 0xb6, 0x4, 0x4, 0x3f, 0xdff, 0x80000001, 0x8c, 0xe5, 0x5, 0xfffffffb, 0x2, 0xa4c1, 0x6, 0x7, 0xe06f, 0xefe, 0x0, 0x1, 0x1f, 0x0, 0x1f, 0x6bec, 0x3, 0x7ff, 0x2d4a, 0x8, 0x6, 0x40, 0x1, 0x8001, 0x4, 0xfffffffa, 0xffffffff, 0x2, 0x3, 0x20, 0x8, 0x3, 0x2, 0x8e, 0x0, 0x0, 0xed9, 0x9, 0x80000001, 0x6, 0x80, 0x0, 0x8, 0x4, 0xa47, 0x5, 0x10001, 0x1000, 0x3ff, 0x0, 0x1, 0x9000, 0x0, 0x3, 0xfffffff9, 0x101, 0x7ff, 0x1, 0x0, 0x6, 0x8, 0x9, 0x7c7, 0x1, 0x9, 0x9, 0xff, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x8f7, 0x300, 0x9f, 0xfffffff7, 0x80000001, 0xff, 0x1, 0x7, 0x8fd, 0x2, 0x7, 0x7fffffff, 0x57ea, 0xad, 0x0, 0x101, 0x2, 0xffffffff, 0x0, 0x2e, 0xb4, 0x81, 0x5, 0x8000, 0xeeb, 0x6, 0x2, 0x8de, 0x8, 0x3, 0x7ff, 0x7fffffff, 0x1, 0x101, 0x7, 0x40, 0x5, 0x8, 0xd4b, 0xff, 0x0, 0x8000, 0x0, 0x100, 0x0, 0x2, 0x3, 0x9, 0x4262, 0x1, 0x1, 0x8, 0x2ae, 0x800, 0x3, 0x101, 0x6a, 0x7ff, 0x4, 0x9, 0x1ff, 0x1, 0x0, 0x0, 0x8, 0x1ff, 0x2815, 0x20, 0x5, 0x9275, 0x7, 0x81, 0x2, 0x6, 0x2, 0x4, 0x9, 0x40, 0x4, 0x8, 0x2, 0x7f, 0x3, 0x7f, 0x6, 0x8], 0x5, 0x400, 0x3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000100)={0xffffffffd99ec829}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x400000) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0xfffffff8, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000280)={0xfffffffffffff4bf, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000080)={0x0, r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r7 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="cc030000", @ANYRES16=0x0, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=0x0, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=0x0, @ANYBLOB="0400028008000100", @ANYRES32=0x0, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08040100", @ANYRES32=0x0, @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}}, 0x0) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001480)={&(0x7f0000000700)={0xd70, 0x0, 0x20, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0xfffa, 0x80, 0x80, 0xfff}, {0x9, 0xff, 0x1, 0x8}, {0x8, 0x0, 0xfb, 0xb9c}, {0x3, 0x9, 0x9, 0x8001}, {0x8, 0x1, 0x4, 0x6}, {0xbd31, 0x20, 0x7, 0xfff}, {0x20, 0x68, 0x6, 0x2}, {0xfff, 0x0, 0x20}, {0x4, 0x1f, 0x6d, 0x1}, {0x8, 0x3b, 0x9d, 0x3}]}}}, {0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x81, 0x1f, 0x1}, {0xfffe, 0x7, 0x4, 0x7}, {0x4, 0x0, 0x0, 0x10000}, {0x2, 0x1, 0x8, 0xbcc8}, {0x7, 0x89, 0x86, 0x7fff}, {0x6, 0x0, 0x0, 0xc2db}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4cf7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000000}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1f8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff3d}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xc5}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1f}}, {0x8}}}]}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x401, 0x4, 0x8, 0x8}, {0xff7f, 0x20, 0x2, 0xb0e}, {0x7, 0xfa, 0x3f, 0x4}, {0xc3, 0x0, 0x8, 0x608}, {0x4a0, 0xfb, 0x79, 0x3}, {0x401, 0x7, 0x80, 0x7ae8590}, {0x6, 0x81, 0x1, 0xfffffffd}, {0x3738, 0xcc, 0xb0, 0x8}, {0xb3, 0x80, 0x6, 0x2}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x27cd}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x401}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x278, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1e47, 0x7f, 0x0, 0x8000}, {0x1000, 0x40, 0x7, 0x1}, {0x7ff, 0x2, 0x1, 0x7}, {0x598, 0x37, 0x1, 0x8}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}]}}, {{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xf397}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20}}, {0x8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}]}, 0xd70}}, 0x50) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x400000) (async) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000200)={0xffffffffffffffff}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0xfffffff8, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000280)={0xfffffffffffff4bf, 0x0, 0x10001}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000080)={0x0, r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="cc030000", @ANYRES16=0x0, @ANYBLOB="080027bd7000fddbdf250300000008000100", @ANYRES32=0x0, @ANYBLOB="f800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000600000008000600", @ANYRES32=0x0, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000000000008000100", @ANYRES32=0x0, @ANYBLOB="0400028008000100", @ANYRES32=0x0, @ANYBLOB="f000028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08040100", @ANYRES32=0x0, @ANYBLOB="f4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000200000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006a040000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="b000028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000000c000400000002ca08000000"], 0x3cc}}, 0x0) (async) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001480)={&(0x7f0000000700)={0xd70, 0x0, 0x20, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0xfffa, 0x80, 0x80, 0xfff}, {0x9, 0xff, 0x1, 0x8}, {0x8, 0x0, 0xfb, 0xb9c}, {0x3, 0x9, 0x9, 0x8001}, {0x8, 0x1, 0x4, 0x6}, {0xbd31, 0x20, 0x7, 0xfff}, {0x20, 0x68, 0x6, 0x2}, {0xfff, 0x0, 0x20}, {0x4, 0x1f, 0x6d, 0x1}, {0x8, 0x3b, 0x9d, 0x3}]}}}, {0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x81, 0x1f, 0x1}, {0xfffe, 0x7, 0x4, 0x7}, {0x4, 0x0, 0x0, 0x10000}, {0x2, 0x1, 0x8, 0xbcc8}, {0x7, 0x89, 0x86, 0x7fff}, {0x6, 0x0, 0x0, 0xc2db}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4cf7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000000}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1f8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff3d}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xc5}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1f}}, {0x8}}}]}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x401, 0x4, 0x8, 0x8}, {0xff7f, 0x20, 0x2, 0xb0e}, {0x7, 0xfa, 0x3f, 0x4}, {0xc3, 0x0, 0x8, 0x608}, {0x4a0, 0xfb, 0x79, 0x3}, {0x401, 0x7, 0x80, 0x7ae8590}, {0x6, 0x81, 0x1, 0xfffffffd}, {0x3738, 0xcc, 0xb0, 0x8}, {0xb3, 0x80, 0x6, 0x2}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x27cd}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x401}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x278, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1e47, 0x7f, 0x0, 0x8000}, {0x1000, 0x40, 0x7, 0x1}, {0x7ff, 0x2, 0x1, 0x7}, {0x598, 0x37, 0x1, 0x8}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}]}}, {{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xf397}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20}}, {0x8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}]}, 0xd70}}, 0x50) (async) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x2000c0) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0xfffffffffffffff7, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r2, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_ALLOC(r7, 0xc0106438, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000000)={0x7f, 0x3f, 0x7f}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:21 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x2000c0) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000100)={0xffffffffd99ec829}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000100)={0xffffffffd99ec829}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000200)={0x2c, r3}) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={r3, 0x8001}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000240)) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:21 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) getsockopt$netrom_NETROM_T1(0xffffffffffffffff, 0x103, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x5f9, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x582, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000000)={r6, 0x1eb}) 13:11:21 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0xfffffffffffffff7, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r2, 0x4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_SG_ALLOC(r7, 0xc0106438, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000000)={0x7f, 0x3f, 0x7f}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000100)={0xffffffffd99ec829}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:21 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000200)={0x2c, r3}) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={r3, 0x8001}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000240)) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000200)={0x2c, r3}) (async) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={r3, 0x8001}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000240)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) getsockopt$netrom_NETROM_T1(0xffffffffffffffff, 0x103, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x5f9, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x582, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) getsockopt$netrom_NETROM_T1(0xffffffffffffffff, 0x103, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x5f9, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x582}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000000)={r6, 0x1eb}) 13:11:22 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x2000c0) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = socket(0xa, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000003000)={&(0x7f0000000040), 0x10, 0x0, 0xffffffffffffff35}, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x4fe8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000200)={0x2c, r3}) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={r3, 0x8001}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000240)) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000200)={0x2c, r3}) (async) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={r3, 0x8001}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000240)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0xfffffffffffffff7, 0x0, 0x2}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r2, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_ALLOC(r7, 0xc0106438, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000000)={0x7f, 0x3f, 0x7f}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0xfffffffffffffff7, 0x0, 0x2}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000200)={r2, 0x4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_SG_ALLOC(r7, 0xc0106438, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000000)={0x7f, 0x3f, 0x7f}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000000)={r6, 0x1eb}) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xde16, 0x24000) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000000)={0x7f, r6}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x6, 0x4100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) getsockopt$netrom_NETROM_T1(0xffffffffffffffff, 0x103, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x5f9, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x582, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) getsockopt$netrom_NETROM_T1(0xffffffffffffffff, 0x103, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x5f9, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x582}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = socket(0xa, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000003000)={&(0x7f0000000040), 0x10, 0x0, 0xffffffffffffff35}, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x4fe8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 0: write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000000), 0x8) r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000040), r0) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) syz_genetlink_get_family_id$smc(&(0x7f0000000080), r0) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xde16, 0x24000) (async, rerun: 32) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000240)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000000)={0x7f, r6}) (async) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x6, 0x4100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:22 executing program 0: write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000000), 0x8) r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000040), r0) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) syz_genetlink_get_family_id$smc(&(0x7f0000000080), r0) write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000000), 0x8) (async) socket$netlink(0x10, 0x3, 0x2) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$team(&(0x7f0000000040), r0) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) syz_genetlink_get_family_id$smc(&(0x7f0000000080), r0) (async) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) 13:11:22 executing program 3: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000000)='+-.&*\x00') r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x4}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0xfffffffffffffda8}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x1f, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x4) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r5, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r6}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0xffffffffffffff79}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f00000003c0)={0x7d0, 0x0, 0x4, 0x70bd26, 0x25dfdbff, {}, [{{0x8}, {0x108, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfe}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x17c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x4, 0x0, 0x1, 0x3}, {0x7fff, 0xac, 0x3}, {0x80, 0x8, 0x4, 0x1}, {0x6, 0x0, 0x6, 0x80000000}]}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xec, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}]}}, {{0x8}, {0x1e4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x528}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x101}}}]}}, {{0x8, 0x1, r3}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x261c}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}]}}]}, 0x7d0}, 0x1, 0x0, 0x0, 0x20000092}, 0x4000080) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r9, 0xc01064b3, &(0x7f00000001c0)={r10}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r10}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r9, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = socket(0xa, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000003000)={&(0x7f0000000040), 0x10, 0x0, 0xffffffffffffff35}, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x4fe8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) socket(0xa, 0x5, 0x0) (async) sendmsg$rds(r2, &(0x7f0000003000)={&(0x7f0000000040), 0x10, 0x0, 0xffffffffffffff35}, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x4fe8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 0: write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000000), 0x8) (async) r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$team(&(0x7f0000000040), r0) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) syz_genetlink_get_family_id$smc(&(0x7f0000000080), r0) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xde16, 0x24000) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000240)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000000)={0x7f, r6}) (async) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x6, 0x4100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:22 executing program 3: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000000)='+-.&*\x00') r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x4}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0xfffffffffffffda8}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x1f, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x4) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) (async) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r5, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r6}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0xffffffffffffff79}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f00000003c0)={0x7d0, 0x0, 0x4, 0x70bd26, 0x25dfdbff, {}, [{{0x8}, {0x108, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfe}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x17c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x4, 0x0, 0x1, 0x3}, {0x7fff, 0xac, 0x3}, {0x80, 0x8, 0x4, 0x1}, {0x6, 0x0, 0x6, 0x80000000}]}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xec, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}]}}, {{0x8}, {0x1e4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x528}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x101}}}]}}, {{0x8, 0x1, r3}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x261c}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}]}}]}, 0x7d0}, 0x1, 0x0, 0x0, 0x20000092}, 0x4000080) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r9, 0xc01064b3, &(0x7f00000001c0)={r10}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r10}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r9, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 32) 13:11:22 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x200200) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_FREE(r4, 0x40206435, &(0x7f0000000080)={0x0, r5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) 13:11:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000240), 0xffffffffffffffff) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280), 0x4100, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x80000000, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x47, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r8, 0x40106437, &(0x7f0000000100)={r9, 0x3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000140)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f0000000400)) 13:11:22 executing program 3: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000000)='+-.&*\x00') (async) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, 0x0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x4}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0xfffffffffffffda8}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x1f, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x4) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) (async) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async, rerun: 32) r7 = socket$netlink(0x10, 0x3, 0x2) (rerun: 32) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r5, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x4}}, {{0x8, 0x1, r6}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0xffffffffffffff79}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async, rerun: 64) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f00000003c0)={0x7d0, 0x0, 0x4, 0x70bd26, 0x25dfdbff, {}, [{{0x8}, {0x108, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfe}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x17c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x4, 0x0, 0x1, 0x3}, {0x7fff, 0xac, 0x3}, {0x80, 0x8, 0x4, 0x1}, {0x6, 0x0, 0x6, 0x80000000}]}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xec, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}]}}, {{0x8}, {0x1e4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x528}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x101}}}]}}, {{0x8, 0x1, r3}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x261c}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}]}}]}, 0x7d0}, 0x1, 0x0, 0x0, 0x20000092}, 0x4000080) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r2}) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r9, 0xc01064b3, &(0x7f00000001c0)={r10}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r10}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r9, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_FREE(r4, 0x40206435, &(0x7f0000000080)={0x0, r5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x19b102) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x30, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r7}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000140)={0x6b, r7}) 13:11:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000240), 0xffffffffffffffff) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280), 0x4100, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x80000000, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x47, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r8, 0x40106437, &(0x7f0000000100)={r9, 0x3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000140)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f0000000400)) socket$netlink(0x10, 0x3, 0x2) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000240), 0xffffffffffffffff) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280), 0x4100, 0x0) (async) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x80000000, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x47, 0x0, 0x10000}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r8, 0x40106437, &(0x7f0000000100)={r9, 0x3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000140)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f0000000400)) (async) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async, rerun: 64) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) (rerun: 64) ioctl$DRM_IOCTL_AGP_FREE(r4, 0x40206435, &(0x7f0000000080)={0x0, r5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x200200) syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x200200) (async) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x1008, 0x3, 0x3ff, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x0, 0x4, 0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x1008, 0x3, 0x3ff, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x0, 0x4, 0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x1008, 0x3, 0x3ff}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x0, 0x4, 0x4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:22 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x19b102) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x30, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r7}) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000140)={0x6b, r7}) 13:11:22 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x200200) syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x200200) (async) 13:11:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000240), 0xffffffffffffffff) (async) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280), 0x4100, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x80000000, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x47, 0x0, 0x10000}) ioctl$DRM_IOCTL_AGP_UNBIND(r8, 0x40106437, &(0x7f0000000100)={r9, 0x3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000140)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f0000000400)) 13:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x14}}, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x60) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/cgroup\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000140)=0x13, 0x4) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x84080, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) mq_getsetattr(r3, &(0x7f0000000400)={0x51, 0x7, 0x1f, 0x29c8}, &(0x7f0000000440)) socketpair(0x5, 0x6, 0x10000, &(0x7f0000000380)={0xffffffffffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f0000000340), r4) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x341300) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f00000001c0)={{@local, 0x5f}, 0x100000001, 0x9, 0x2, 0x2, 0x6, 0x0, 0xb9a, 0x990e}) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x1008, 0x3, 0x3ff, 0x0, 0x0}) (async, rerun: 32) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x0, 0x4, 0x4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (rerun: 32) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 32) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async, rerun: 64) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x19b102) (rerun: 64) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000080)={0x30, 0x0, 0x10000}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r7}) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000140)={0x6b, r7}) 13:11:22 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r1}) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000140)={r6}) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x4) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x4) sendmsg$TEAM_CMD_NOOP(r7, &(0x7f00000006c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)=ANY=[@ANYBLOB="04020000", @ANYRES16=0x0, @ANYBLOB="08092cbd7000ffdbdf250000000008000100", @ANYRES32=0x0, @ANYBLOB="e80102803c00010024000100757365725f6c696e6b75700000000000007aa7ffe5010000000000000000000400040008000600"/60, @ANYRES32=0x0, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000001000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400ffff00003c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b757000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004003f00000008000600", @ANYRES32=r9, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r10, @ANYBLOB], 0x204}}, 0x20000084) write$khugepaged_scan(r3, &(0x7f0000000000), 0x8) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x14}}, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x60) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/cgroup\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000140)=0x13, 0x4) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x84080, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) mq_getsetattr(r3, &(0x7f0000000400)={0x51, 0x7, 0x1f, 0x29c8}, &(0x7f0000000440)) socketpair(0x5, 0x6, 0x10000, &(0x7f0000000380)={0xffffffffffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f0000000340), r4) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x341300) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f00000001c0)={{@local, 0x5f}, 0x100000001, 0x9, 0x2, 0x2, 0x6, 0x0, 0xb9a, 0x990e}) socket$netlink(0x10, 0x3, 0x2) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x14}}, 0x0) (async) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x60) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/cgroup\x00') (async) sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x50) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000140)=0x13, 0x4) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x84080, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) mq_getsetattr(r3, &(0x7f0000000400)={0x51, 0x7, 0x1f, 0x29c8}, &(0x7f0000000440)) (async) socketpair(0x5, 0x6, 0x10000, &(0x7f0000000380)) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000340), r4) (async) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) (async) syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x341300) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f00000001c0)={{@local, 0x5f}, 0x100000001, 0x9, 0x2, 0x2, 0x6, 0x0, 0xb9a, 0x990e}) (async) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x7, 0x3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x0, 0x8, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) sendmsg$rds(r2, &(0x7f0000000840)={&(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000200)=""/149, 0x95}, {&(0x7f00000002c0)=""/182, 0xb6}, {&(0x7f0000000380)=""/252, 0xfc}, {&(0x7f0000000480)=""/214, 0xd6}, {&(0x7f0000000580)=""/175, 0xaf}, {&(0x7f0000000640)=""/130, 0x82}, {&(0x7f0000000700)=""/165, 0xa5}, {&(0x7f0000000100)=""/91, 0x5b}], 0x8, 0x0, 0x0, 0x8000}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000000)=0x3) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x109800, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f00000008c0)={0x20, 0x0, 0x10000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000140)={r6}) (async) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x4) (async) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) (async) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x4) sendmsg$TEAM_CMD_NOOP(r7, &(0x7f00000006c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)=ANY=[@ANYBLOB="04020000", @ANYRES16=0x0, @ANYBLOB="08092cbd7000ffdbdf250000000008000100", @ANYRES32=0x0, @ANYBLOB="e80102803c00010024000100757365725f6c696e6b75700000000000007aa7ffe5010000000000000000000400040008000600"/60, @ANYRES32=0x0, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000001000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400ffff00003c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b757000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004003f00000008000600", @ANYRES32=r9, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r10, @ANYBLOB], 0x204}}, 0x20000084) write$khugepaged_scan(r3, &(0x7f0000000000), 0x8) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000000)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r5}) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r1}) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x7, 0x3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x0, 0x8, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x7, 0x3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x0, 0x8, 0x7fffffff}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x14}}, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x60) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/cgroup\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000140)=0x13, 0x4) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x84080, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) mq_getsetattr(r3, &(0x7f0000000400)={0x51, 0x7, 0x1f, 0x29c8}, &(0x7f0000000440)) socketpair(0x5, 0x6, 0x10000, &(0x7f0000000380)={0xffffffffffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f0000000340), r4) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x341300) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f00000001c0)={{@local, 0x5f}, 0x100000001, 0x9, 0x2, 0x2, 0x6, 0x0, 0xb9a, 0x990e}) socket$netlink(0x10, 0x3, 0x2) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x14}}, 0x0) (async) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x60) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/cgroup\x00') (async) sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x50) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000140)=0x13, 0x4) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x84080, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) mq_getsetattr(r3, &(0x7f0000000400)={0x51, 0x7, 0x1f, 0x29c8}, &(0x7f0000000440)) (async) socketpair(0x5, 0x6, 0x10000, &(0x7f0000000380)) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000340), r4) (async) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) (async) syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x341300) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f00000001c0)={{@local, 0x5f}, 0x100000001, 0x9, 0x2, 0x2, 0x6, 0x0, 0xb9a, 0x990e}) (async) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) (async, rerun: 32) sendmsg$rds(r2, &(0x7f0000000840)={&(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000200)=""/149, 0x95}, {&(0x7f00000002c0)=""/182, 0xb6}, {&(0x7f0000000380)=""/252, 0xfc}, {&(0x7f0000000480)=""/214, 0xd6}, {&(0x7f0000000580)=""/175, 0xaf}, {&(0x7f0000000640)=""/130, 0x82}, {&(0x7f0000000700)=""/165, 0xa5}, {&(0x7f0000000100)=""/91, 0x5b}], 0x8, 0x0, 0x0, 0x8000}, 0x10) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000000)=0x3) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x109800, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f00000008c0)={0x20, 0x0, 0x10000}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) (rerun: 32) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r1}) 13:11:22 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000140)={r6}) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x4) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) (async) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x4) sendmsg$TEAM_CMD_NOOP(r7, &(0x7f00000006c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)=ANY=[@ANYBLOB="04020000", @ANYRES16=0x0, @ANYBLOB="08092cbd7000ffdbdf250000000008000100", @ANYRES32=0x0, @ANYBLOB="e80102803c00010024000100757365725f6c696e6b75700000000000007aa7ffe5010000000000000000000400040008000600"/60, @ANYRES32=0x0, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000001000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400ffff00003c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b757000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004003f00000008000600", @ANYRES32=r9, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000200000008000600", @ANYRES32=r10, @ANYBLOB], 0x204}}, 0x20000084) (async) write$khugepaged_scan(r3, &(0x7f0000000000), 0x8) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) sendmsg$rds(r2, &(0x7f0000000840)={&(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000200)=""/149, 0x95}, {&(0x7f00000002c0)=""/182, 0xb6}, {&(0x7f0000000380)=""/252, 0xfc}, {&(0x7f0000000480)=""/214, 0xd6}, {&(0x7f0000000580)=""/175, 0xaf}, {&(0x7f0000000640)=""/130, 0x82}, {&(0x7f0000000700)=""/165, 0xa5}, {&(0x7f0000000100)=""/91, 0x5b}], 0x8, 0x0, 0x0, 0x8000}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000000)=0x3) (rerun: 32) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x109800, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f00000008c0)={0x20, 0x0, 0x10000}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:22 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x7, 0x3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x0, 0x8, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x7, 0x3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x0, 0x8, 0x7fffffff}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:22 executing program 0: ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1000, 0x4, 0xea7b}) 13:11:22 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$PPPIOCSMRRU(0xffffffffffffffff, 0x4004743b, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) 13:11:23 executing program 0: ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1000, 0x4, 0xea7b}) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1000, 0x4, 0xea7b}) (async) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r4, 0x400443c8, &(0x7f0000000000)={r5, 0x7fff}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) (async) 13:11:23 executing program 0: ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1000, 0x4, 0xea7b}) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1000, 0x4, 0xea7b}) (async) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$PPPIOCSMRRU(0xffffffffffffffff, 0x4004743b, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x800) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000340)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x5) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r3, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x4}}, {{0x8, 0x1, r4}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x70, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x42}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x70}, 0x1, 0x0, 0x0, 0x8801}, 0x4048004) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) bind$netrom(0xffffffffffffffff, &(0x7f00000002c0)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6}, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r8, 0xc00464b4, &(0x7f0000000040)={r7}) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async, rerun: 32) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)) (async, rerun: 32) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r4, 0x400443c8, &(0x7f0000000000)={r5, 0x7fff}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4000) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x1ff, 0xfff}) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x9, &(0x7f0000000200)=0x1) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x100) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x101881, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000140)={r4}) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r6) request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', r6) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$PPPIOCSMRRU(0xffffffffffffffff, 0x4004743b, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740)=0x30, 0x2) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000000)={0x0, 0x2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004081) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r4, 0x400443c8, &(0x7f0000000000)={r5, 0x7fff}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4000) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async, rerun: 64) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x1ff, 0xfff}) 13:11:23 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x800) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000340)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x5) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r5 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r3, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x4}}, {{0x8, 0x1, r4}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x70, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x42}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x70}, 0x1, 0x0, 0x0, 0x8801}, 0x4048004) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) bind$netrom(0xffffffffffffffff, &(0x7f00000002c0)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6}, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r8, 0xc00464b4, &(0x7f0000000040)={r7}) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x9, &(0x7f0000000200)=0x1) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x100) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x101881, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000140)={r4}) (async) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r6) request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', r6) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x1) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x6c}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r2, 0x7a9, &(0x7f0000000200)={{@hyper, 0x71f4}, 0x9, 0x1, 0x785, 0x3, 0x1, 0x7, 0x1, 0x6}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740)=0x30, 0x2) (async) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000000)={0x0, 0x2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004081) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x9, &(0x7f0000000200)=0x1) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x100) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x101881, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000140)={r4}) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r6) request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', r6) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000100)=0x9, &(0x7f0000000200)=0x1) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x100) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x101881, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000140)={r4}) (async) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) (async) keyctl$clear(0x7, r6) (async) request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', r6) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)={0x2, r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xc11, 0x4003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x1) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x6c}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r2, 0x7a9, &(0x7f0000000200)={{@hyper, 0x71f4}, 0x9, 0x1, 0x785, 0x3, 0x1, 0x7, 0x1, 0x6}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 64) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:23 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x800) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000340)) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 64) r2 = socket$netlink(0x10, 0x3, 0x5) (rerun: 64) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r3, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x4}}, {{0x8, 0x1, r4}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x70, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x42}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x70}, 0x1, 0x0, 0x0, 0x8801}, 0x4048004) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) bind$netrom(0xffffffffffffffff, &(0x7f00000002c0)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6}, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r8, 0xc00464b4, &(0x7f0000000040)={r7}) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 32) r3 = socket$bt_hidp(0x1f, 0x3, 0x6) (rerun: 32) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740)=0x30, 0x2) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000000)={0x0, 0x2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async, rerun: 64) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004081) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)={0x2, r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xc11, 0x4003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4000) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x1ff, 0xfff}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4000) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x1ff, 0xfff}) (async) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x1) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x6c}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r2, 0x7a9, &(0x7f0000000200)={{@hyper, 0x71f4}, 0x9, 0x1, 0x785, 0x3, 0x1, 0x7, 0x1, 0x6}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x1) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={0x0, 0x6c}) (async) pipe2$watch_queue(&(0x7f0000000100), 0x80) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r2, 0x7a9, &(0x7f0000000200)={{@hyper, 0x71f4}, 0x9, 0x1, 0x785, 0x3, 0x1, 0x7, 0x1, 0x6}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) accept$netrom(0xffffffffffffffff, &(0x7f0000000200)={{}, [@netrom, @remote, @default, @netrom, @remote, @default, @null, @default]}, &(0x7f0000000000)=0x48) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) r5 = accept4$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000100)=0x10, 0x80000) recvfrom$llc(r5, &(0x7f0000000280)=""/82, 0x52, 0x10042, &(0x7f0000000300)={0x1a, 0x310, 0x3, 0xab, 0x9, 0xdc, @multicast}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)={0x2, r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xc11, 0x4003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000080)={0x2, r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xc11, 0x4003, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:23 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000)=0x2, &(0x7f0000000040)=0x4) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7fff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x210200, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000280)={0x0, 0x27}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000200)={r6, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) accept$netrom(0xffffffffffffffff, &(0x7f0000000200)={{}, [@netrom, @remote, @default, @netrom, @remote, @default, @null, @default]}, &(0x7f0000000000)=0x48) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) r5 = accept4$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000100)=0x10, 0x80000) recvfrom$llc(r5, &(0x7f0000000280)=""/82, 0x52, 0x10042, &(0x7f0000000300)={0x1a, 0x310, 0x3, 0xab, 0x9, 0xdc, @multicast}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xb, 0x6, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) accept$ax25(r5, &(0x7f0000000280)={{0x3, @bcast}, [@null, @null, @netrom, @rose, @null, @rose, @null]}, &(0x7f0000000000)=0x48) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7fff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x210200, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000280)={0x0, 0x27}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000200)={r6, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7fff}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r1}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x210200, 0x0) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000280)={0x0, 0x27}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000200)={r6, 0x8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:23 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r5 = request_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000100)='((%\\]\'$-}:\x00', 0xfffffffffffffffd) keyctl$get_security(0x11, r5, &(0x7f0000000200)=""/15, 0xf) 13:11:23 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000)=0x2, &(0x7f0000000040)=0x4) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) bind$isdn_base(r4, &(0x7f0000000080)={0x22, 0x8, 0x9, 0x6}, 0x6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000040)={0x9}) 13:11:23 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7fff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r1}) (async) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x210200, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000280)={0x0, 0x27}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x1}) (rerun: 64) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000200)={r6, 0x8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xb, 0x6, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) accept$ax25(r5, &(0x7f0000000280)={{0x3, @bcast}, [@null, @null, @netrom, @rose, @null, @rose, @null]}, &(0x7f0000000000)=0x48) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) accept$netrom(0xffffffffffffffff, &(0x7f0000000200)={{}, [@netrom, @remote, @default, @netrom, @remote, @default, @null, @default]}, &(0x7f0000000000)=0x48) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) r5 = accept4$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000100)=0x10, 0x80000) recvfrom$llc(r5, &(0x7f0000000280)=""/82, 0x52, 0x10042, &(0x7f0000000300)={0x1a, 0x310, 0x3, 0xab, 0x9, 0xdc, @multicast}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) accept$netrom(0xffffffffffffffff, &(0x7f0000000200)={{}, [@netrom, @remote, @default, @netrom, @remote, @default, @null, @default]}, &(0x7f0000000000)=0x48) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) accept4$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000100)=0x10, 0x80000) (async) recvfrom$llc(r5, &(0x7f0000000280)=""/82, 0x52, 0x10042, &(0x7f0000000300)={0x1a, 0x310, 0x3, 0xab, 0x9, 0xdc, @multicast}, 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:23 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000)=0x2, &(0x7f0000000040)=0x4) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000)=0x2, &(0x7f0000000040)=0x4) (async) 13:11:23 executing program 2: sched_rr_get_interval(0x0, &(0x7f0000000000)) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8000003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x100, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) sched_rr_get_interval(0x0, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3, 0x4, 0x58e7}) 13:11:23 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 32) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) r5 = request_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000100)='((%\\]\'$-}:\x00', 0xfffffffffffffffd) keyctl$get_security(0x11, r5, &(0x7f0000000200)=""/15, 0xf) 13:11:23 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) bind$isdn_base(r4, &(0x7f0000000080)={0x22, 0x8, 0x9, 0x6}, 0x6) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000040)={0x9}) 13:11:23 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xb, 0x6, 0x5a2}) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async, rerun: 32) accept$ax25(r5, &(0x7f0000000280)={{0x3, @bcast}, [@null, @null, @netrom, @rose, @null, @rose, @null]}, &(0x7f0000000000)=0x48) (rerun: 32) 13:11:23 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0xfffffffffffffffc, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r2) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:23 executing program 2: sched_rr_get_interval(0x0, &(0x7f0000000000)) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8000003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x100, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) sched_rr_get_interval(0x0, &(0x7f0000000100)) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3, 0x4, 0x58e7}) 13:11:23 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4c400) syz_open_dev$dri(&(0x7f0000000000), 0xbce, 0x8340) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) bind$isdn_base(r4, &(0x7f0000000080)={0x22, 0x8, 0x9, 0x6}, 0x6) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (rerun: 32) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r5, 0x40106439, &(0x7f0000000040)={0x9}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0xfffffffffffffffc, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r2) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000000)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:24 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4c400) syz_open_dev$dri(&(0x7f0000000000), 0xbce, 0x8340) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 2: sched_rr_get_interval(0x0, &(0x7f0000000000)) (async) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x8000003, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x100, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) sched_rr_get_interval(0x0, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3, 0x4, 0x58e7}) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) r5 = request_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000100)='((%\\]\'$-}:\x00', 0xfffffffffffffffd) keyctl$get_security(0x11, r5, &(0x7f0000000200)=""/15, 0xf) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) request_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000100)='((%\\]\'$-}:\x00', 0xfffffffffffffffd) (async) keyctl$get_security(0x11, r5, &(0x7f0000000200)=""/15, 0xf) (async) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x4c400) (async) syz_open_dev$dri(&(0x7f0000000000), 0xbce, 0x8340) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000140)=0xab0, &(0x7f0000000200)=0x2) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x9, 0x509000) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100)=0x1, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) setsockopt$bt_BT_RCVMTU(r6, 0x112, 0xd, &(0x7f0000000240)=0xfffb, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0xfffffffffffffffc, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r2) (async) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r6 = mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000)=0xffffffffffffffff, 0x4) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 0: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000480)={0x0, 0x8, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000000)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}]}) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x1872, 0x6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x27, 0xfffffffa, 0x4000400}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000140)=0xab0, &(0x7f0000000200)=0x2) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x9, 0x509000) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100)=0x1, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) setsockopt$bt_BT_RCVMTU(r6, 0x112, 0xd, &(0x7f0000000240)=0xfffb, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = socket(0x1e, 0x5, 0x0) sendmsg$rds(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40010}, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000240)={r2}) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async, rerun: 64) r6 = mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) (rerun: 64) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) 13:11:24 executing program 0: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000040)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000480)={0x0, 0x8, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000000)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}]}) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x1872, 0x6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x27, 0xfffffffa, 0x4000400}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000)=0xffffffffffffffff, 0x4) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000140)=0xab0, &(0x7f0000000200)=0x2) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x9, 0x509000) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100)=0x1, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) setsockopt$bt_BT_RCVMTU(r6, 0x112, 0xd, &(0x7f0000000240)=0xfffb, 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = socket(0x1e, 0x5, 0x0) sendmsg$rds(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40010}, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000240)={r2}) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r6 = mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) (async) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) (async) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) (async) 13:11:24 executing program 0: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000480)={0x0, 0x8, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000000)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}]}) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000040)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000480)={0x0, 0x8, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000000)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}]}) (async) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x1872, 0x6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x27, 0xfffffffa, 0x4000400}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r5 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000002c0)=0xfffffffe, 0x4) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, &(0x7f0000000340)) getsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000080)=0x6, &(0x7f0000000100)=0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x448000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) openat$md(0xffffffffffffff9c, &(0x7f0000000080), 0x2400, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000080)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = socket(0x1e, 0x5, 0x0) sendmsg$rds(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40010}, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000240)={r2}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x448000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) openat$md(0xffffffffffffff9c, &(0x7f0000000080), 0x2400, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r5 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000002c0)=0xfffffffe, 0x4) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, &(0x7f0000000340)) getsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000080)=0x6, &(0x7f0000000100)=0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000000)={r1}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) socket$bt_bnep(0x1f, 0x3, 0x4) (async) setsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000002c0)=0xfffffffe, 0x4) (async) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, &(0x7f0000000340)) (async) getsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000080)=0x6, &(0x7f0000000100)=0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:24 executing program 0: getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000100)=0x489d, &(0x7f0000000140)=0x2) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x548, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x5c6}) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x200000000000, 0x84201) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x511780) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x5, 0x59f, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000100)={0x6, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000200)={0xffffffffffffffff, r3}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x448000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) openat$md(0xffffffffffffff9c, &(0x7f0000000080), 0x2400, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x448000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) openat$md(0xffffffffffffff9c, &(0x7f0000000080), 0x2400, 0x0) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r5 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000002c0)=0xfffffffe, 0x4) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, &(0x7f0000000340)) getsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000080)=0x6, &(0x7f0000000100)=0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000000)={r1}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) socket$bt_bnep(0x1f, 0x3, 0x4) (async) setsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000002c0)=0xfffffffe, 0x4) (async) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, &(0x7f0000000340)) (async) getsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000080)=0x6, &(0x7f0000000100)=0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x200000000000, 0x84201) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x511780) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x5, 0x59f, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000100)={0x6, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000200)={0xffffffffffffffff, r3}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f0000000080), 0x200000000000, 0x84201) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x511780) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x5, 0x59f}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000100)={0x6, 0x0, 0x2}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000200)={0xffffffffffffffff, r3}) (async) syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x5a000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 0: getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000100)=0x489d, &(0x7f0000000140)=0x2) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x548, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x5c6}) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000300)) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) setresuid(0xffffffffffffffff, r4, 0x0) setresuid(r3, r4, 0x0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r5, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r5, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8014}, 0x81) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000003c0)={{0x80000000, 0x0, 0x1, [0xf9429ab]}, {0x80000000, 0x0, 0x2, [0xcd74, 0x41]}, 0x2, [0x3, 0x8]}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000004c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCDISCONN(0xffffffffffffffff, 0x7439) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x7, 0x4, 0x100, 0x5, 0x884, 0x1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xa, &(0x7f0000000200)=@raw=[@btf_id={0x18, 0xa, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @ldst={0x1, 0x3, 0x2, 0xb, 0x7, 0x40, 0x10}, @generic={0x9, 0x2, 0x1, 0xfff, 0xfffffff7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x3ff}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffe}], &(0x7f0000000000)='GPL\x00', 0x40, 0x5a, &(0x7f0000000280)=""/90, 0x0, 0x14, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x2, 0xd, 0xc417, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[r5, 0xffffffffffffffff, 0x1, r6, 0x1]}, 0x80) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x10800) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r3}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x80, r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x7, 0x0) setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000100)=0x40, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000140)={0xfffffffffffffff8, r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000300)) (async) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) setresuid(0xffffffffffffffff, r4, 0x0) setresuid(r3, r4, 0x0) (async) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r5, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) (async) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r5, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8014}, 0x81) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000003c0)={{0x80000000, 0x0, 0x1, [0xf9429ab]}, {0x80000000, 0x0, 0x2, [0xcd74, 0x41]}, 0x2, [0x3, 0x8]}) 13:11:24 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x200000000000, 0x84201) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x511780) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x5, 0x59f, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000100)={0x6, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000200)={0xffffffffffffffff, r3}) (async) r4 = syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x5a000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 0: getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000100)=0x489d, &(0x7f0000000140)=0x2) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x548, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x5c6}) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000100)=0x489d, &(0x7f0000000140)=0x2) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x548, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000040)={r2, 0x5c6}) (async) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000004c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCDISCONN(0xffffffffffffffff, 0x7439) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x7, 0x4, 0x100, 0x5, 0x884, 0x1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xa, &(0x7f0000000200)=@raw=[@btf_id={0x18, 0xa, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @ldst={0x1, 0x3, 0x2, 0xb, 0x7, 0x40, 0x10}, @generic={0x9, 0x2, 0x1, 0xfff, 0xfffffff7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x3ff}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffe}], &(0x7f0000000000)='GPL\x00', 0x40, 0x5a, &(0x7f0000000280)=""/90, 0x0, 0x14, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x2, 0xd, 0xc417, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[r5, 0xffffffffffffffff, 0x1, r6, 0x1]}, 0x80) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000004c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$PPPIOCDISCONN(0xffffffffffffffff, 0x7439) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) pipe2$watch_queue(&(0x7f0000000500), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x7, 0x4, 0x100, 0x5, 0x884, 0x1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xa, &(0x7f0000000200)=@raw=[@btf_id={0x18, 0xa, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @ldst={0x1, 0x3, 0x2, 0xb, 0x7, 0x40, 0x10}, @generic={0x9, 0x2, 0x1, 0xfff, 0xfffffff7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x3ff}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffe}], &(0x7f0000000000)='GPL\x00', 0x40, 0x5a, &(0x7f0000000280)=""/90, 0x0, 0x14, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x2, 0xd, 0xc417, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[r5, 0xffffffffffffffff, 0x1, r6, 0x1]}, 0x80) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x10800) (async, rerun: 64) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r3}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x80, r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x7, 0x0) (async) setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000100)=0x40, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000140)={0xfffffffffffffff8, r3}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (rerun: 64) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000300)) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) setresuid(0xffffffffffffffff, r4, 0x0) setresuid(r3, r4, 0x0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r5, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r5, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8014}, 0x81) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r1}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000003c0)={{0x80000000, 0x0, 0x1, [0xf9429ab]}, {0x80000000, 0x0, 0x2, [0xcd74, 0x41]}, 0x2, [0x3, 0x8]}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000300)) (async) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)) (async) setresuid(0xffffffffffffffff, r4, 0x0) (async) setresuid(r3, r4, 0x0) (async) syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) (async) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r5, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) (async) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r5, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8014}, 0x81) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r1}) (async) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000003c0)={{0x80000000, 0x0, 0x1, [0xf9429ab]}, {0x80000000, 0x0, 0x2, [0xcd74, 0x41]}, 0x2, [0x3, 0x8]}) (async) 13:11:24 executing program 1: r0 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r0) keyctl$read(0xb, r0, &(0x7f0000000000)=""/25, 0x19) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x5a000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x5a000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x7fffffffffffffff, 0x525400) syz_open_dev$dri(&(0x7f0000000000), 0xff, 0x470f42) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000004c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCDISCONN(0xffffffffffffffff, 0x7439) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) pipe2$watch_queue(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x7, 0x4, 0x100, 0x5, 0x884, 0x1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xa, &(0x7f0000000200)=@raw=[@btf_id={0x18, 0xa, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @ldst={0x1, 0x3, 0x2, 0xb, 0x7, 0x40, 0x10}, @generic={0x9, 0x2, 0x1, 0xfff, 0xfffffff7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x3ff}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffe}], &(0x7f0000000000)='GPL\x00', 0x40, 0x5a, &(0x7f0000000280)=""/90, 0x0, 0x14, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x2, 0xd, 0xc417, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000300)=[r5, 0xffffffffffffffff, 0x1, r6, 0x1]}, 0x80) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x3, 0x10800) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r3}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f0000000080)={0x80, r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x7, 0x0) (async) setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000100)=0x40, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000140)={0xfffffffffffffff8, r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xe75c, 0xff, 0x1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SIOCAX25CTLCON(r5, 0x89e8, &(0x7f0000000200)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, 0xc, 0x100, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @default, @bcast]}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xe, &(0x7f0000000000)='#@-{#).-^-\\##\x00'}, 0x30) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:24 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x7fffffffffffffff, 0x525400) syz_open_dev$dri(&(0x7f0000000000), 0xff, 0x470f42) syz_open_dev$dri(&(0x7f00000000c0), 0x7fffffffffffffff, 0x525400) (async) syz_open_dev$dri(&(0x7f0000000000), 0xff, 0x470f42) (async) 13:11:24 executing program 1: r0 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r0) keyctl$read(0xb, r0, &(0x7f0000000000)=""/25, 0x19) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_UNBIND(r3, 0x40106437, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xe75c, 0xff, 0x1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SIOCAX25CTLCON(r5, 0x89e8, &(0x7f0000000200)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, 0xc, 0x100, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @default, @bcast]}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xe75c, 0xff, 0x1}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$SIOCAX25CTLCON(r5, 0x89e8, &(0x7f0000000200)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, 0xc, 0x100, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @default, @bcast]}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xe, &(0x7f0000000000)='#@-{#).-^-\\##\x00'}, 0x30) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xe, &(0x7f0000000000)='#@-{#).-^-\\##\x00'}, 0x30) (async) syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:24 executing program 1: r0 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r0) keyctl$read(0xb, r0, &(0x7f0000000000)=""/25, 0x19) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) (async) keyctl$clear(0x7, r0) (async) keyctl$read(0xb, r0, &(0x7f0000000000)=""/25, 0x19) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:24 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x7fffffffffffffff, 0x525400) syz_open_dev$dri(&(0x7f0000000000), 0xff, 0x470f42) syz_open_dev$dri(&(0x7f00000000c0), 0x7fffffffffffffff, 0x525400) (async) syz_open_dev$dri(&(0x7f0000000000), 0xff, 0x470f42) (async) 13:11:24 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_UNBIND(r3, 0x40106437, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:24 executing program 5: r0 = getpid() ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000001280)={0x1f, 0x0, 0xd3e65e7ab8819b70}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f00000012c0)={0x1, r1}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)='&\x00'}, 0x30) ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000001200)) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000140)={&(0x7f0000000200)=[0x3f, 0x2, 0x0, 0xffffff3e, 0xffff, 0x0, 0x7, 0x1, 0x0, 0xa35, 0x4, 0x9, 0x40, 0x6, 0x3, 0x1, 0x100, 0xffffffff, 0x1f, 0x5, 0x559, 0x40, 0x20, 0x7, 0x1, 0x6, 0x4, 0x10000, 0x80000001, 0x1, 0xfffffffc, 0x2, 0x81, 0x1, 0x7, 0x1ff, 0x9, 0x10000, 0x6, 0x4, 0xc937, 0xfffffffa, 0x1, 0xe6, 0x8, 0x7ff, 0x7, 0x5, 0x57da, 0xe72, 0x48c, 0x2, 0x80, 0xfffffff8, 0x4, 0x1c00000, 0x1, 0xfff, 0x1, 0x4, 0x0, 0x8, 0x0, 0xe4, 0x1000, 0x9, 0x7, 0x0, 0xf3, 0xc3, 0x9000, 0x7, 0x3, 0x1, 0x0, 0x7fff, 0xc0, 0xd4, 0x9, 0x3, 0x1, 0x4, 0x100, 0x6, 0x1000, 0x9, 0x8, 0x6, 0x9, 0x56, 0x200, 0x6, 0x1, 0x2, 0x2, 0x5b, 0x8, 0x1, 0x168, 0x1f2, 0x8, 0x1f, 0x1, 0x400, 0x5581, 0xf, 0x4, 0x7fff, 0x8, 0x5, 0x5, 0x80000001, 0x26, 0x0, 0x9, 0x80, 0x4, 0x80000000, 0x10001, 0x1ab, 0x80000000, 0x8001, 0x6, 0x81, 0x40, 0x9, 0x8, 0x6, 0x4, 0x8, 0x6, 0x1, 0x5, 0xde2, 0xffff, 0x9, 0x77, 0x101, 0x9, 0x5, 0x9, 0x8, 0x100, 0x2, 0x3, 0x7, 0x9, 0xbac5, 0x4, 0x200, 0x2, 0x6, 0xff, 0x9, 0x2, 0xd2a76e00, 0x3, 0x20, 0xffff, 0x4, 0xd834aed, 0x7, 0x400, 0x0, 0x800, 0xf3e4, 0x6, 0x10, 0x2, 0x8, 0x2, 0x7, 0x7, 0x8, 0x9, 0x7f, 0x3, 0x5cc7d25, 0x8, 0xfffffff7, 0x7, 0x4, 0x7fffffff, 0x4, 0x2, 0xfffffff7, 0x3, 0x9, 0x2, 0xffffff01, 0x2, 0x9, 0x1f, 0x0, 0x7, 0x400, 0x8, 0x1, 0x23, 0x4, 0x3, 0x0, 0xc7, 0x800, 0x74e0, 0x294, 0x5, 0x5, 0x8, 0x6, 0x1, 0x2e3, 0x3ff, 0x3, 0x9, 0x101, 0xf739, 0x200, 0x7bb, 0x7f, 0x3, 0x80000000, 0x20, 0x5, 0x5, 0x0, 0x1, 0x2, 0x1, 0xffffffff, 0x2f, 0x6, 0x0, 0x8, 0x7, 0x800, 0x0, 0x1, 0x4, 0x3d6, 0x7, 0x5, 0x101, 0x2, 0x9, 0x1000, 0x2, 0xffff, 0x6, 0x8d7, 0x1000, 0x4, 0x5, 0x0, 0x7f, 0x1000, 0x7, 0xffff8000, 0x7, 0x1, 0xffff0000, 0xa, 0x57, 0x80000000, 0x7900, 0x100, 0x1, 0x10001, 0x42a5, 0x84000001, 0x0, 0x8, 0x400, 0x7d, 0x6, 0x4, 0x6, 0x1e000000, 0x0, 0x1, 0xfc, 0x7fffffff, 0x5, 0x1, 0x2, 0x6, 0x81, 0x800, 0xffff3f03, 0x1, 0xff, 0x200, 0x52b0, 0xffffebc2, 0x800, 0x101, 0x9, 0x3ff, 0x7, 0x80, 0x6, 0x7, 0x1f, 0xfffff2b5, 0x2, 0x101, 0x0, 0x7d, 0x7fffffff, 0x9, 0x7, 0x0, 0xd1, 0x3318, 0x20, 0x5, 0x2, 0x2, 0x80000000, 0x7, 0x9a72, 0x7, 0x9d73, 0x8, 0x5, 0x5, 0x9, 0xfffffc00, 0x40, 0x7, 0x8000, 0x84d3, 0xffffffff, 0xf522, 0xc0, 0x8, 0x0, 0x55, 0x1, 0x2f1c, 0x7, 0x1, 0x8, 0xffffffff, 0x4a9, 0x5, 0x8001, 0x80000000, 0x6e1, 0x9, 0x8, 0x1, 0x10000, 0x20, 0x40, 0x2, 0xfffffbff, 0x10000, 0x7fffffff, 0x2, 0xfffffffe, 0x0, 0x100, 0x7, 0x100, 0x6, 0x0, 0x1, 0x401, 0x9, 0x6, 0x1d, 0x4, 0x8000, 0x3, 0x7, 0x3, 0x7, 0x1f, 0x3, 0x1ff, 0x10000, 0x7f, 0x3, 0x2, 0x3ff, 0x3, 0x7, 0x9, 0x7f, 0x101, 0x4, 0x5, 0xfffffeff, 0x7fffffff, 0x1, 0x4, 0x1, 0x3, 0x20, 0xb8, 0x4289, 0xd292, 0x7, 0x94, 0x7, 0x3, 0x3, 0x2, 0xfffffffb, 0x4, 0x7fff, 0x0, 0x2, 0x400, 0x4, 0x5, 0xfd6, 0x3, 0x7fffffff, 0x2, 0x401, 0x100, 0x6, 0x193, 0x8, 0x63, 0x1f, 0x27c, 0x8000, 0x12f5, 0xc58, 0x80, 0x2e3c, 0x1, 0xffffffff, 0x2, 0x172, 0x6d, 0x861, 0x8001, 0x8, 0x0, 0x3, 0x2, 0x1, 0xfff, 0x10001, 0x7ff, 0x8, 0x630, 0x6, 0x0, 0x6, 0x9, 0x203, 0x8be, 0x6, 0x10000, 0xffffffff, 0x5, 0x800, 0xa6c6, 0x0, 0xffff, 0x1, 0x122, 0x81, 0x8001, 0x4, 0x9, 0x1, 0x0, 0x8, 0x1, 0x101, 0x1f7c05dd, 0x9, 0x0, 0x7, 0x3, 0x1e1, 0x4, 0x80, 0xff, 0x7, 0xfffffffa, 0x8, 0x3, 0x5, 0x6, 0x200, 0x10000, 0x81, 0x8001, 0x7fffffff, 0x1000, 0xc0, 0x0, 0x3, 0x40000000, 0x3c, 0x8, 0x6, 0x3f, 0x5, 0x6d, 0x2, 0x0, 0x4, 0x80000000, 0x1, 0x80000001, 0x1ff, 0x7ff, 0x1, 0x1, 0xd4, 0x7f, 0x5, 0x0, 0x0, 0x6, 0x0, 0x7f, 0xd39, 0xffff, 0x400006, 0x80000001, 0x3, 0x401, 0x0, 0xfffffffd, 0x4, 0x4, 0x7a, 0x1f, 0x5, 0x0, 0x3, 0x9, 0x7f, 0x7, 0x7, 0x31, 0x8, 0x3f, 0x6, 0xffffffe0, 0x100, 0x6, 0x0, 0x1, 0x1000, 0x40, 0x3, 0x8, 0x800, 0x5, 0x81, 0x10000, 0x8, 0x3cbb64ea, 0xffffffff, 0x5, 0x7f, 0x5, 0x75f, 0x100, 0x100, 0x9, 0x66c, 0x0, 0x800, 0x15d, 0xffff, 0xfffffbff, 0xb6, 0xffffffc1, 0x3, 0x0, 0xffffffff, 0x2, 0x6, 0xff, 0x8, 0xee0, 0x8000, 0x8, 0x9, 0x2, 0x3, 0x5, 0x0, 0x8, 0xbb70, 0x1cdf, 0x101, 0x4, 0x10000, 0x7599, 0x7ff, 0x6, 0x0, 0x3, 0x0, 0x5, 0x3f, 0x8, 0x1, 0x1, 0x800, 0x8, 0x1, 0x14, 0x5, 0x80000001, 0x8000, 0x3, 0x4, 0x7ff, 0x4, 0x3, 0x8, 0xffff, 0xe09, 0x1f, 0x1f, 0x4, 0xfffff800, 0x78, 0xfffffffd, 0x8, 0x5, 0x6, 0x7fffffff, 0x2, 0x1, 0x401, 0x1, 0x3, 0x3ff, 0x0, 0x3, 0x81, 0x0, 0x0, 0x200, 0xfa, 0x0, 0x0, 0x6, 0x80, 0xa5, 0xfffffc00, 0x4, 0x9, 0x3, 0xfff, 0x80, 0x8000, 0x8, 0x544, 0x2, 0x5, 0x5, 0x1ff, 0x7fffffff, 0x7fff, 0x4, 0x2, 0x1, 0x6, 0x7fffffff, 0x420, 0x5, 0x4c, 0x20000009, 0x8, 0x13d, 0x4a0, 0x5, 0x1, 0x2, 0x2e, 0x500, 0x2, 0x1, 0x5, 0x43bd9cee, 0x6, 0x90a7, 0x4, 0x80000000, 0x2e5b5a09, 0xffffffff, 0xffff, 0x0, 0x79e, 0x2, 0x1, 0x0, 0x75, 0x0, 0xb75, 0x94a4, 0xbf0f, 0xffffff80, 0x5, 0x800, 0x4, 0x4, 0xffffff7f, 0x7, 0x2, 0x61585da6, 0x36cc0000, 0x8, 0xc15c, 0x1, 0x7fff, 0x81, 0x201ff, 0x1, 0xfffffff7, 0x10000, 0x0, 0x5, 0xdf1f, 0x1, 0x4, 0x3, 0x400, 0xea71, 0x800, 0x37, 0x6, 0x0, 0xfd3, 0x20, 0x5, 0x6, 0x4, 0x6, 0x1, 0xce7, 0x4, 0x8796, 0x6, 0x8, 0xffffffff, 0x6, 0x1000, 0xffff, 0x7ff, 0x9, 0x6, 0xffffff81, 0x4, 0x81, 0x7, 0x77c9, 0x9, 0x5, 0x5, 0xfffffff8, 0x7ff, 0x5, 0x1, 0x8000, 0x34, 0x80, 0x7, 0xfffffffc, 0x101, 0x588, 0x1, 0x800, 0x8, 0x7ff, 0xffffffff, 0x37, 0xfffc0000, 0x6c, 0x800, 0x100, 0x2, 0x1, 0xffff, 0x1, 0x4, 0x3f, 0x20, 0x1ff, 0x401, 0x101, 0xfffffffc, 0x8, 0x0, 0x1, 0x2, 0x7, 0x0, 0x672a, 0x9, 0x10000, 0xffff, 0x200008, 0x5, 0x6, 0xfffffffc, 0x100, 0x4, 0x7d6, 0x10001, 0x78a, 0x366, 0x2, 0x1f, 0x0, 0x8, 0x8001, 0xec, 0x7fff, 0xf4c, 0x3, 0x2, 0x8, 0x4, 0x2ce, 0x4, 0x7, 0x0, 0x1f, 0x3, 0x4, 0x4, 0x2, 0x2, 0x5, 0x6, 0x10, 0x6, 0x1, 0x7f, 0x9, 0x5, 0x4, 0x4, 0x6, 0x0, 0x8000, 0xd3b, 0x7fff, 0x3, 0x9, 0x2, 0x8, 0x3, 0x7, 0xd780, 0x65, 0x6, 0xffffffff, 0x9, 0x0, 0x7, 0x41b, 0xd5e, 0x8, 0x5, 0x10001, 0x7fffffff, 0x1f, 0x39, 0x6, 0x81, 0x7, 0x3, 0x8000, 0x5, 0x3ff, 0xffff, 0x1ff, 0x3b3, 0x9, 0x80, 0x0, 0x4, 0x5e87, 0x4, 0x7, 0x1000, 0x101, 0x6, 0x7, 0x80000000, 0x9, 0x7fffffff, 0x1, 0x5, 0x4, 0x8, 0x5, 0x0, 0x8, 0x6, 0xb67, 0x100, 0xff, 0x5, 0x200, 0x6, 0x2, 0x20, 0x4, 0x7f, 0xfff, 0x5, 0xc1, 0x2, 0xc1, 0x80000001, 0x8001, 0x10001, 0x5, 0xfffffff8, 0xffff, 0x8, 0x1, 0xc1c, 0x6c3, 0x2, 0x5, 0x4, 0xfffffff8, 0x40, 0x1f, 0x434, 0x6, 0x3ff, 0x3, 0x1, 0x5, 0xffff0ccb, 0x9565, 0xa5, 0x6, 0x0, 0x3, 0x8, 0x2, 0x2, 0x6, 0x8, 0x4, 0x2, 0x80000000, 0x200, 0x2, 0xfffffff9, 0xffffffff, 0x6, 0x4, 0x42, 0x2, 0x2f4, 0x1, 0xff, 0x8001, 0x8, 0x5, 0xfa, 0x800, 0x20, 0xba01, 0x5, 0x2, 0x8, 0x100, 0xd4c, 0x101, 0x81, 0x0, 0x1ff, 0x9, 0x3, 0x2, 0x5, 0xff, 0x9, 0x10000, 0x481, 0x8001, 0x6, 0x9, 0x401, 0xd985, 0x1000, 0x0, 0x200, 0x0, 0xffff, 0x3, 0x1, 0x3, 0x40, 0x0, 0x1, 0x9, 0x0, 0x493b3802, 0xffffb36b, 0x5, 0x7fff, 0x200, 0x7f, 0xe8, 0x2a, 0x0, 0x2, 0x3ff, 0x40, 0xfffffff9], 0x4, 0x400, 0x7}) getpid() r5 = syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x80000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x10005a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) setsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000001300)=0x1, 0x1) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000001240)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:24 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xe75c, 0xff, 0x1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$SIOCAX25CTLCON(r5, 0x89e8, &(0x7f0000000200)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, 0xc, 0x100, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @default, @bcast]}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xe, &(0x7f0000000000)='#@-{#).-^-\\##\x00'}, 0x30) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 0: r0 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, r0) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000080)=0x6, 0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7fe, 0x5, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000200)={0xc}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x1ff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f0000000240), 0x400, 0x800) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$PPPIOCGDEBUG(r6, 0x80047441, &(0x7f0000000100)) 13:11:25 executing program 5: r0 = getpid() ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000001280)={0x1f, 0x0, 0xd3e65e7ab8819b70}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f00000012c0)={0x1, r1}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)='&\x00'}, 0x30) ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000001200)) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000140)={&(0x7f0000000200)=[0x3f, 0x2, 0x0, 0xffffff3e, 0xffff, 0x0, 0x7, 0x1, 0x0, 0xa35, 0x4, 0x9, 0x40, 0x6, 0x3, 0x1, 0x100, 0xffffffff, 0x1f, 0x5, 0x559, 0x40, 0x20, 0x7, 0x1, 0x6, 0x4, 0x10000, 0x80000001, 0x1, 0xfffffffc, 0x2, 0x81, 0x1, 0x7, 0x1ff, 0x9, 0x10000, 0x6, 0x4, 0xc937, 0xfffffffa, 0x1, 0xe6, 0x8, 0x7ff, 0x7, 0x5, 0x57da, 0xe72, 0x48c, 0x2, 0x80, 0xfffffff8, 0x4, 0x1c00000, 0x1, 0xfff, 0x1, 0x4, 0x0, 0x8, 0x0, 0xe4, 0x1000, 0x9, 0x7, 0x0, 0xf3, 0xc3, 0x9000, 0x7, 0x3, 0x1, 0x0, 0x7fff, 0xc0, 0xd4, 0x9, 0x3, 0x1, 0x4, 0x100, 0x6, 0x1000, 0x9, 0x8, 0x6, 0x9, 0x56, 0x200, 0x6, 0x1, 0x2, 0x2, 0x5b, 0x8, 0x1, 0x168, 0x1f2, 0x8, 0x1f, 0x1, 0x400, 0x5581, 0xf, 0x4, 0x7fff, 0x8, 0x5, 0x5, 0x80000001, 0x26, 0x0, 0x9, 0x80, 0x4, 0x80000000, 0x10001, 0x1ab, 0x80000000, 0x8001, 0x6, 0x81, 0x40, 0x9, 0x8, 0x6, 0x4, 0x8, 0x6, 0x1, 0x5, 0xde2, 0xffff, 0x9, 0x77, 0x101, 0x9, 0x5, 0x9, 0x8, 0x100, 0x2, 0x3, 0x7, 0x9, 0xbac5, 0x4, 0x200, 0x2, 0x6, 0xff, 0x9, 0x2, 0xd2a76e00, 0x3, 0x20, 0xffff, 0x4, 0xd834aed, 0x7, 0x400, 0x0, 0x800, 0xf3e4, 0x6, 0x10, 0x2, 0x8, 0x2, 0x7, 0x7, 0x8, 0x9, 0x7f, 0x3, 0x5cc7d25, 0x8, 0xfffffff7, 0x7, 0x4, 0x7fffffff, 0x4, 0x2, 0xfffffff7, 0x3, 0x9, 0x2, 0xffffff01, 0x2, 0x9, 0x1f, 0x0, 0x7, 0x400, 0x8, 0x1, 0x23, 0x4, 0x3, 0x0, 0xc7, 0x800, 0x74e0, 0x294, 0x5, 0x5, 0x8, 0x6, 0x1, 0x2e3, 0x3ff, 0x3, 0x9, 0x101, 0xf739, 0x200, 0x7bb, 0x7f, 0x3, 0x80000000, 0x20, 0x5, 0x5, 0x0, 0x1, 0x2, 0x1, 0xffffffff, 0x2f, 0x6, 0x0, 0x8, 0x7, 0x800, 0x0, 0x1, 0x4, 0x3d6, 0x7, 0x5, 0x101, 0x2, 0x9, 0x1000, 0x2, 0xffff, 0x6, 0x8d7, 0x1000, 0x4, 0x5, 0x0, 0x7f, 0x1000, 0x7, 0xffff8000, 0x7, 0x1, 0xffff0000, 0xa, 0x57, 0x80000000, 0x7900, 0x100, 0x1, 0x10001, 0x42a5, 0x84000001, 0x0, 0x8, 0x400, 0x7d, 0x6, 0x4, 0x6, 0x1e000000, 0x0, 0x1, 0xfc, 0x7fffffff, 0x5, 0x1, 0x2, 0x6, 0x81, 0x800, 0xffff3f03, 0x1, 0xff, 0x200, 0x52b0, 0xffffebc2, 0x800, 0x101, 0x9, 0x3ff, 0x7, 0x80, 0x6, 0x7, 0x1f, 0xfffff2b5, 0x2, 0x101, 0x0, 0x7d, 0x7fffffff, 0x9, 0x7, 0x0, 0xd1, 0x3318, 0x20, 0x5, 0x2, 0x2, 0x80000000, 0x7, 0x9a72, 0x7, 0x9d73, 0x8, 0x5, 0x5, 0x9, 0xfffffc00, 0x40, 0x7, 0x8000, 0x84d3, 0xffffffff, 0xf522, 0xc0, 0x8, 0x0, 0x55, 0x1, 0x2f1c, 0x7, 0x1, 0x8, 0xffffffff, 0x4a9, 0x5, 0x8001, 0x80000000, 0x6e1, 0x9, 0x8, 0x1, 0x10000, 0x20, 0x40, 0x2, 0xfffffbff, 0x10000, 0x7fffffff, 0x2, 0xfffffffe, 0x0, 0x100, 0x7, 0x100, 0x6, 0x0, 0x1, 0x401, 0x9, 0x6, 0x1d, 0x4, 0x8000, 0x3, 0x7, 0x3, 0x7, 0x1f, 0x3, 0x1ff, 0x10000, 0x7f, 0x3, 0x2, 0x3ff, 0x3, 0x7, 0x9, 0x7f, 0x101, 0x4, 0x5, 0xfffffeff, 0x7fffffff, 0x1, 0x4, 0x1, 0x3, 0x20, 0xb8, 0x4289, 0xd292, 0x7, 0x94, 0x7, 0x3, 0x3, 0x2, 0xfffffffb, 0x4, 0x7fff, 0x0, 0x2, 0x400, 0x4, 0x5, 0xfd6, 0x3, 0x7fffffff, 0x2, 0x401, 0x100, 0x6, 0x193, 0x8, 0x63, 0x1f, 0x27c, 0x8000, 0x12f5, 0xc58, 0x80, 0x2e3c, 0x1, 0xffffffff, 0x2, 0x172, 0x6d, 0x861, 0x8001, 0x8, 0x0, 0x3, 0x2, 0x1, 0xfff, 0x10001, 0x7ff, 0x8, 0x630, 0x6, 0x0, 0x6, 0x9, 0x203, 0x8be, 0x6, 0x10000, 0xffffffff, 0x5, 0x800, 0xa6c6, 0x0, 0xffff, 0x1, 0x122, 0x81, 0x8001, 0x4, 0x9, 0x1, 0x0, 0x8, 0x1, 0x101, 0x1f7c05dd, 0x9, 0x0, 0x7, 0x3, 0x1e1, 0x4, 0x80, 0xff, 0x7, 0xfffffffa, 0x8, 0x3, 0x5, 0x6, 0x200, 0x10000, 0x81, 0x8001, 0x7fffffff, 0x1000, 0xc0, 0x0, 0x3, 0x40000000, 0x3c, 0x8, 0x6, 0x3f, 0x5, 0x6d, 0x2, 0x0, 0x4, 0x80000000, 0x1, 0x80000001, 0x1ff, 0x7ff, 0x1, 0x1, 0xd4, 0x7f, 0x5, 0x0, 0x0, 0x6, 0x0, 0x7f, 0xd39, 0xffff, 0x400006, 0x80000001, 0x3, 0x401, 0x0, 0xfffffffd, 0x4, 0x4, 0x7a, 0x1f, 0x5, 0x0, 0x3, 0x9, 0x7f, 0x7, 0x7, 0x31, 0x8, 0x3f, 0x6, 0xffffffe0, 0x100, 0x6, 0x0, 0x1, 0x1000, 0x40, 0x3, 0x8, 0x800, 0x5, 0x81, 0x10000, 0x8, 0x3cbb64ea, 0xffffffff, 0x5, 0x7f, 0x5, 0x75f, 0x100, 0x100, 0x9, 0x66c, 0x0, 0x800, 0x15d, 0xffff, 0xfffffbff, 0xb6, 0xffffffc1, 0x3, 0x0, 0xffffffff, 0x2, 0x6, 0xff, 0x8, 0xee0, 0x8000, 0x8, 0x9, 0x2, 0x3, 0x5, 0x0, 0x8, 0xbb70, 0x1cdf, 0x101, 0x4, 0x10000, 0x7599, 0x7ff, 0x6, 0x0, 0x3, 0x0, 0x5, 0x3f, 0x8, 0x1, 0x1, 0x800, 0x8, 0x1, 0x14, 0x5, 0x80000001, 0x8000, 0x3, 0x4, 0x7ff, 0x4, 0x3, 0x8, 0xffff, 0xe09, 0x1f, 0x1f, 0x4, 0xfffff800, 0x78, 0xfffffffd, 0x8, 0x5, 0x6, 0x7fffffff, 0x2, 0x1, 0x401, 0x1, 0x3, 0x3ff, 0x0, 0x3, 0x81, 0x0, 0x0, 0x200, 0xfa, 0x0, 0x0, 0x6, 0x80, 0xa5, 0xfffffc00, 0x4, 0x9, 0x3, 0xfff, 0x80, 0x8000, 0x8, 0x544, 0x2, 0x5, 0x5, 0x1ff, 0x7fffffff, 0x7fff, 0x4, 0x2, 0x1, 0x6, 0x7fffffff, 0x420, 0x5, 0x4c, 0x20000009, 0x8, 0x13d, 0x4a0, 0x5, 0x1, 0x2, 0x2e, 0x500, 0x2, 0x1, 0x5, 0x43bd9cee, 0x6, 0x90a7, 0x4, 0x80000000, 0x2e5b5a09, 0xffffffff, 0xffff, 0x0, 0x79e, 0x2, 0x1, 0x0, 0x75, 0x0, 0xb75, 0x94a4, 0xbf0f, 0xffffff80, 0x5, 0x800, 0x4, 0x4, 0xffffff7f, 0x7, 0x2, 0x61585da6, 0x36cc0000, 0x8, 0xc15c, 0x1, 0x7fff, 0x81, 0x201ff, 0x1, 0xfffffff7, 0x10000, 0x0, 0x5, 0xdf1f, 0x1, 0x4, 0x3, 0x400, 0xea71, 0x800, 0x37, 0x6, 0x0, 0xfd3, 0x20, 0x5, 0x6, 0x4, 0x6, 0x1, 0xce7, 0x4, 0x8796, 0x6, 0x8, 0xffffffff, 0x6, 0x1000, 0xffff, 0x7ff, 0x9, 0x6, 0xffffff81, 0x4, 0x81, 0x7, 0x77c9, 0x9, 0x5, 0x5, 0xfffffff8, 0x7ff, 0x5, 0x1, 0x8000, 0x34, 0x80, 0x7, 0xfffffffc, 0x101, 0x588, 0x1, 0x800, 0x8, 0x7ff, 0xffffffff, 0x37, 0xfffc0000, 0x6c, 0x800, 0x100, 0x2, 0x1, 0xffff, 0x1, 0x4, 0x3f, 0x20, 0x1ff, 0x401, 0x101, 0xfffffffc, 0x8, 0x0, 0x1, 0x2, 0x7, 0x0, 0x672a, 0x9, 0x10000, 0xffff, 0x200008, 0x5, 0x6, 0xfffffffc, 0x100, 0x4, 0x7d6, 0x10001, 0x78a, 0x366, 0x2, 0x1f, 0x0, 0x8, 0x8001, 0xec, 0x7fff, 0xf4c, 0x3, 0x2, 0x8, 0x4, 0x2ce, 0x4, 0x7, 0x0, 0x1f, 0x3, 0x4, 0x4, 0x2, 0x2, 0x5, 0x6, 0x10, 0x6, 0x1, 0x7f, 0x9, 0x5, 0x4, 0x4, 0x6, 0x0, 0x8000, 0xd3b, 0x7fff, 0x3, 0x9, 0x2, 0x8, 0x3, 0x7, 0xd780, 0x65, 0x6, 0xffffffff, 0x9, 0x0, 0x7, 0x41b, 0xd5e, 0x8, 0x5, 0x10001, 0x7fffffff, 0x1f, 0x39, 0x6, 0x81, 0x7, 0x3, 0x8000, 0x5, 0x3ff, 0xffff, 0x1ff, 0x3b3, 0x9, 0x80, 0x0, 0x4, 0x5e87, 0x4, 0x7, 0x1000, 0x101, 0x6, 0x7, 0x80000000, 0x9, 0x7fffffff, 0x1, 0x5, 0x4, 0x8, 0x5, 0x0, 0x8, 0x6, 0xb67, 0x100, 0xff, 0x5, 0x200, 0x6, 0x2, 0x20, 0x4, 0x7f, 0xfff, 0x5, 0xc1, 0x2, 0xc1, 0x80000001, 0x8001, 0x10001, 0x5, 0xfffffff8, 0xffff, 0x8, 0x1, 0xc1c, 0x6c3, 0x2, 0x5, 0x4, 0xfffffff8, 0x40, 0x1f, 0x434, 0x6, 0x3ff, 0x3, 0x1, 0x5, 0xffff0ccb, 0x9565, 0xa5, 0x6, 0x0, 0x3, 0x8, 0x2, 0x2, 0x6, 0x8, 0x4, 0x2, 0x80000000, 0x200, 0x2, 0xfffffff9, 0xffffffff, 0x6, 0x4, 0x42, 0x2, 0x2f4, 0x1, 0xff, 0x8001, 0x8, 0x5, 0xfa, 0x800, 0x20, 0xba01, 0x5, 0x2, 0x8, 0x100, 0xd4c, 0x101, 0x81, 0x0, 0x1ff, 0x9, 0x3, 0x2, 0x5, 0xff, 0x9, 0x10000, 0x481, 0x8001, 0x6, 0x9, 0x401, 0xd985, 0x1000, 0x0, 0x200, 0x0, 0xffff, 0x3, 0x1, 0x3, 0x40, 0x0, 0x1, 0x9, 0x0, 0x493b3802, 0xffffb36b, 0x5, 0x7fff, 0x200, 0x7f, 0xe8, 0x2a, 0x0, 0x2, 0x3ff, 0x40, 0xfffffff9], 0x4, 0x400, 0x7}) getpid() r5 = syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x80000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x10005a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) setsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000001300)=0x1, 0x1) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000001240)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) getpid() (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000001280)={0x1f, 0x0, 0xd3e65e7ab8819b70}) (async) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f00000012c0)={0x1, r1}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)='&\x00'}, 0x30) (async) ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000001200)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000140)={&(0x7f0000000200)=[0x3f, 0x2, 0x0, 0xffffff3e, 0xffff, 0x0, 0x7, 0x1, 0x0, 0xa35, 0x4, 0x9, 0x40, 0x6, 0x3, 0x1, 0x100, 0xffffffff, 0x1f, 0x5, 0x559, 0x40, 0x20, 0x7, 0x1, 0x6, 0x4, 0x10000, 0x80000001, 0x1, 0xfffffffc, 0x2, 0x81, 0x1, 0x7, 0x1ff, 0x9, 0x10000, 0x6, 0x4, 0xc937, 0xfffffffa, 0x1, 0xe6, 0x8, 0x7ff, 0x7, 0x5, 0x57da, 0xe72, 0x48c, 0x2, 0x80, 0xfffffff8, 0x4, 0x1c00000, 0x1, 0xfff, 0x1, 0x4, 0x0, 0x8, 0x0, 0xe4, 0x1000, 0x9, 0x7, 0x0, 0xf3, 0xc3, 0x9000, 0x7, 0x3, 0x1, 0x0, 0x7fff, 0xc0, 0xd4, 0x9, 0x3, 0x1, 0x4, 0x100, 0x6, 0x1000, 0x9, 0x8, 0x6, 0x9, 0x56, 0x200, 0x6, 0x1, 0x2, 0x2, 0x5b, 0x8, 0x1, 0x168, 0x1f2, 0x8, 0x1f, 0x1, 0x400, 0x5581, 0xf, 0x4, 0x7fff, 0x8, 0x5, 0x5, 0x80000001, 0x26, 0x0, 0x9, 0x80, 0x4, 0x80000000, 0x10001, 0x1ab, 0x80000000, 0x8001, 0x6, 0x81, 0x40, 0x9, 0x8, 0x6, 0x4, 0x8, 0x6, 0x1, 0x5, 0xde2, 0xffff, 0x9, 0x77, 0x101, 0x9, 0x5, 0x9, 0x8, 0x100, 0x2, 0x3, 0x7, 0x9, 0xbac5, 0x4, 0x200, 0x2, 0x6, 0xff, 0x9, 0x2, 0xd2a76e00, 0x3, 0x20, 0xffff, 0x4, 0xd834aed, 0x7, 0x400, 0x0, 0x800, 0xf3e4, 0x6, 0x10, 0x2, 0x8, 0x2, 0x7, 0x7, 0x8, 0x9, 0x7f, 0x3, 0x5cc7d25, 0x8, 0xfffffff7, 0x7, 0x4, 0x7fffffff, 0x4, 0x2, 0xfffffff7, 0x3, 0x9, 0x2, 0xffffff01, 0x2, 0x9, 0x1f, 0x0, 0x7, 0x400, 0x8, 0x1, 0x23, 0x4, 0x3, 0x0, 0xc7, 0x800, 0x74e0, 0x294, 0x5, 0x5, 0x8, 0x6, 0x1, 0x2e3, 0x3ff, 0x3, 0x9, 0x101, 0xf739, 0x200, 0x7bb, 0x7f, 0x3, 0x80000000, 0x20, 0x5, 0x5, 0x0, 0x1, 0x2, 0x1, 0xffffffff, 0x2f, 0x6, 0x0, 0x8, 0x7, 0x800, 0x0, 0x1, 0x4, 0x3d6, 0x7, 0x5, 0x101, 0x2, 0x9, 0x1000, 0x2, 0xffff, 0x6, 0x8d7, 0x1000, 0x4, 0x5, 0x0, 0x7f, 0x1000, 0x7, 0xffff8000, 0x7, 0x1, 0xffff0000, 0xa, 0x57, 0x80000000, 0x7900, 0x100, 0x1, 0x10001, 0x42a5, 0x84000001, 0x0, 0x8, 0x400, 0x7d, 0x6, 0x4, 0x6, 0x1e000000, 0x0, 0x1, 0xfc, 0x7fffffff, 0x5, 0x1, 0x2, 0x6, 0x81, 0x800, 0xffff3f03, 0x1, 0xff, 0x200, 0x52b0, 0xffffebc2, 0x800, 0x101, 0x9, 0x3ff, 0x7, 0x80, 0x6, 0x7, 0x1f, 0xfffff2b5, 0x2, 0x101, 0x0, 0x7d, 0x7fffffff, 0x9, 0x7, 0x0, 0xd1, 0x3318, 0x20, 0x5, 0x2, 0x2, 0x80000000, 0x7, 0x9a72, 0x7, 0x9d73, 0x8, 0x5, 0x5, 0x9, 0xfffffc00, 0x40, 0x7, 0x8000, 0x84d3, 0xffffffff, 0xf522, 0xc0, 0x8, 0x0, 0x55, 0x1, 0x2f1c, 0x7, 0x1, 0x8, 0xffffffff, 0x4a9, 0x5, 0x8001, 0x80000000, 0x6e1, 0x9, 0x8, 0x1, 0x10000, 0x20, 0x40, 0x2, 0xfffffbff, 0x10000, 0x7fffffff, 0x2, 0xfffffffe, 0x0, 0x100, 0x7, 0x100, 0x6, 0x0, 0x1, 0x401, 0x9, 0x6, 0x1d, 0x4, 0x8000, 0x3, 0x7, 0x3, 0x7, 0x1f, 0x3, 0x1ff, 0x10000, 0x7f, 0x3, 0x2, 0x3ff, 0x3, 0x7, 0x9, 0x7f, 0x101, 0x4, 0x5, 0xfffffeff, 0x7fffffff, 0x1, 0x4, 0x1, 0x3, 0x20, 0xb8, 0x4289, 0xd292, 0x7, 0x94, 0x7, 0x3, 0x3, 0x2, 0xfffffffb, 0x4, 0x7fff, 0x0, 0x2, 0x400, 0x4, 0x5, 0xfd6, 0x3, 0x7fffffff, 0x2, 0x401, 0x100, 0x6, 0x193, 0x8, 0x63, 0x1f, 0x27c, 0x8000, 0x12f5, 0xc58, 0x80, 0x2e3c, 0x1, 0xffffffff, 0x2, 0x172, 0x6d, 0x861, 0x8001, 0x8, 0x0, 0x3, 0x2, 0x1, 0xfff, 0x10001, 0x7ff, 0x8, 0x630, 0x6, 0x0, 0x6, 0x9, 0x203, 0x8be, 0x6, 0x10000, 0xffffffff, 0x5, 0x800, 0xa6c6, 0x0, 0xffff, 0x1, 0x122, 0x81, 0x8001, 0x4, 0x9, 0x1, 0x0, 0x8, 0x1, 0x101, 0x1f7c05dd, 0x9, 0x0, 0x7, 0x3, 0x1e1, 0x4, 0x80, 0xff, 0x7, 0xfffffffa, 0x8, 0x3, 0x5, 0x6, 0x200, 0x10000, 0x81, 0x8001, 0x7fffffff, 0x1000, 0xc0, 0x0, 0x3, 0x40000000, 0x3c, 0x8, 0x6, 0x3f, 0x5, 0x6d, 0x2, 0x0, 0x4, 0x80000000, 0x1, 0x80000001, 0x1ff, 0x7ff, 0x1, 0x1, 0xd4, 0x7f, 0x5, 0x0, 0x0, 0x6, 0x0, 0x7f, 0xd39, 0xffff, 0x400006, 0x80000001, 0x3, 0x401, 0x0, 0xfffffffd, 0x4, 0x4, 0x7a, 0x1f, 0x5, 0x0, 0x3, 0x9, 0x7f, 0x7, 0x7, 0x31, 0x8, 0x3f, 0x6, 0xffffffe0, 0x100, 0x6, 0x0, 0x1, 0x1000, 0x40, 0x3, 0x8, 0x800, 0x5, 0x81, 0x10000, 0x8, 0x3cbb64ea, 0xffffffff, 0x5, 0x7f, 0x5, 0x75f, 0x100, 0x100, 0x9, 0x66c, 0x0, 0x800, 0x15d, 0xffff, 0xfffffbff, 0xb6, 0xffffffc1, 0x3, 0x0, 0xffffffff, 0x2, 0x6, 0xff, 0x8, 0xee0, 0x8000, 0x8, 0x9, 0x2, 0x3, 0x5, 0x0, 0x8, 0xbb70, 0x1cdf, 0x101, 0x4, 0x10000, 0x7599, 0x7ff, 0x6, 0x0, 0x3, 0x0, 0x5, 0x3f, 0x8, 0x1, 0x1, 0x800, 0x8, 0x1, 0x14, 0x5, 0x80000001, 0x8000, 0x3, 0x4, 0x7ff, 0x4, 0x3, 0x8, 0xffff, 0xe09, 0x1f, 0x1f, 0x4, 0xfffff800, 0x78, 0xfffffffd, 0x8, 0x5, 0x6, 0x7fffffff, 0x2, 0x1, 0x401, 0x1, 0x3, 0x3ff, 0x0, 0x3, 0x81, 0x0, 0x0, 0x200, 0xfa, 0x0, 0x0, 0x6, 0x80, 0xa5, 0xfffffc00, 0x4, 0x9, 0x3, 0xfff, 0x80, 0x8000, 0x8, 0x544, 0x2, 0x5, 0x5, 0x1ff, 0x7fffffff, 0x7fff, 0x4, 0x2, 0x1, 0x6, 0x7fffffff, 0x420, 0x5, 0x4c, 0x20000009, 0x8, 0x13d, 0x4a0, 0x5, 0x1, 0x2, 0x2e, 0x500, 0x2, 0x1, 0x5, 0x43bd9cee, 0x6, 0x90a7, 0x4, 0x80000000, 0x2e5b5a09, 0xffffffff, 0xffff, 0x0, 0x79e, 0x2, 0x1, 0x0, 0x75, 0x0, 0xb75, 0x94a4, 0xbf0f, 0xffffff80, 0x5, 0x800, 0x4, 0x4, 0xffffff7f, 0x7, 0x2, 0x61585da6, 0x36cc0000, 0x8, 0xc15c, 0x1, 0x7fff, 0x81, 0x201ff, 0x1, 0xfffffff7, 0x10000, 0x0, 0x5, 0xdf1f, 0x1, 0x4, 0x3, 0x400, 0xea71, 0x800, 0x37, 0x6, 0x0, 0xfd3, 0x20, 0x5, 0x6, 0x4, 0x6, 0x1, 0xce7, 0x4, 0x8796, 0x6, 0x8, 0xffffffff, 0x6, 0x1000, 0xffff, 0x7ff, 0x9, 0x6, 0xffffff81, 0x4, 0x81, 0x7, 0x77c9, 0x9, 0x5, 0x5, 0xfffffff8, 0x7ff, 0x5, 0x1, 0x8000, 0x34, 0x80, 0x7, 0xfffffffc, 0x101, 0x588, 0x1, 0x800, 0x8, 0x7ff, 0xffffffff, 0x37, 0xfffc0000, 0x6c, 0x800, 0x100, 0x2, 0x1, 0xffff, 0x1, 0x4, 0x3f, 0x20, 0x1ff, 0x401, 0x101, 0xfffffffc, 0x8, 0x0, 0x1, 0x2, 0x7, 0x0, 0x672a, 0x9, 0x10000, 0xffff, 0x200008, 0x5, 0x6, 0xfffffffc, 0x100, 0x4, 0x7d6, 0x10001, 0x78a, 0x366, 0x2, 0x1f, 0x0, 0x8, 0x8001, 0xec, 0x7fff, 0xf4c, 0x3, 0x2, 0x8, 0x4, 0x2ce, 0x4, 0x7, 0x0, 0x1f, 0x3, 0x4, 0x4, 0x2, 0x2, 0x5, 0x6, 0x10, 0x6, 0x1, 0x7f, 0x9, 0x5, 0x4, 0x4, 0x6, 0x0, 0x8000, 0xd3b, 0x7fff, 0x3, 0x9, 0x2, 0x8, 0x3, 0x7, 0xd780, 0x65, 0x6, 0xffffffff, 0x9, 0x0, 0x7, 0x41b, 0xd5e, 0x8, 0x5, 0x10001, 0x7fffffff, 0x1f, 0x39, 0x6, 0x81, 0x7, 0x3, 0x8000, 0x5, 0x3ff, 0xffff, 0x1ff, 0x3b3, 0x9, 0x80, 0x0, 0x4, 0x5e87, 0x4, 0x7, 0x1000, 0x101, 0x6, 0x7, 0x80000000, 0x9, 0x7fffffff, 0x1, 0x5, 0x4, 0x8, 0x5, 0x0, 0x8, 0x6, 0xb67, 0x100, 0xff, 0x5, 0x200, 0x6, 0x2, 0x20, 0x4, 0x7f, 0xfff, 0x5, 0xc1, 0x2, 0xc1, 0x80000001, 0x8001, 0x10001, 0x5, 0xfffffff8, 0xffff, 0x8, 0x1, 0xc1c, 0x6c3, 0x2, 0x5, 0x4, 0xfffffff8, 0x40, 0x1f, 0x434, 0x6, 0x3ff, 0x3, 0x1, 0x5, 0xffff0ccb, 0x9565, 0xa5, 0x6, 0x0, 0x3, 0x8, 0x2, 0x2, 0x6, 0x8, 0x4, 0x2, 0x80000000, 0x200, 0x2, 0xfffffff9, 0xffffffff, 0x6, 0x4, 0x42, 0x2, 0x2f4, 0x1, 0xff, 0x8001, 0x8, 0x5, 0xfa, 0x800, 0x20, 0xba01, 0x5, 0x2, 0x8, 0x100, 0xd4c, 0x101, 0x81, 0x0, 0x1ff, 0x9, 0x3, 0x2, 0x5, 0xff, 0x9, 0x10000, 0x481, 0x8001, 0x6, 0x9, 0x401, 0xd985, 0x1000, 0x0, 0x200, 0x0, 0xffff, 0x3, 0x1, 0x3, 0x40, 0x0, 0x1, 0x9, 0x0, 0x493b3802, 0xffffb36b, 0x5, 0x7fff, 0x200, 0x7f, 0xe8, 0x2a, 0x0, 0x2, 0x3ff, 0x40, 0xfffffff9], 0x4, 0x400, 0x7}) (async) getpid() (async) syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x80000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x10005a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) setsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000001300)=0x1, 0x1) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000001240)={r8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_UNBIND(r3, 0x40106437, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:25 executing program 0: r0 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, r0) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) add_key$keyring(&(0x7f0000000080), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) (async) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, r0) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000080)=0x6, 0x4) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) (async) socket$netlink(0x10, 0x3, 0x2) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000080)=0x6, 0x4) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000080)={0x0, 0x100000000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x3, 0x2, 0x200}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x32, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x143000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r4 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x10, 0x800) getpeername$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x10) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7fe, 0x5, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000200)={0xc}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x1ff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) (async) syz_open_dev$dri(&(0x7f0000000240), 0x400, 0x800) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$PPPIOCGDEBUG(r6, 0x80047441, &(0x7f0000000100)) 13:11:25 executing program 5: r0 = getpid() ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000001280)={0x1f, 0x0, 0xd3e65e7ab8819b70}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f00000012c0)={0x1, r1}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)='&\x00'}, 0x30) (async) ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000001200)) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 64) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000000140)={&(0x7f0000000200)=[0x3f, 0x2, 0x0, 0xffffff3e, 0xffff, 0x0, 0x7, 0x1, 0x0, 0xa35, 0x4, 0x9, 0x40, 0x6, 0x3, 0x1, 0x100, 0xffffffff, 0x1f, 0x5, 0x559, 0x40, 0x20, 0x7, 0x1, 0x6, 0x4, 0x10000, 0x80000001, 0x1, 0xfffffffc, 0x2, 0x81, 0x1, 0x7, 0x1ff, 0x9, 0x10000, 0x6, 0x4, 0xc937, 0xfffffffa, 0x1, 0xe6, 0x8, 0x7ff, 0x7, 0x5, 0x57da, 0xe72, 0x48c, 0x2, 0x80, 0xfffffff8, 0x4, 0x1c00000, 0x1, 0xfff, 0x1, 0x4, 0x0, 0x8, 0x0, 0xe4, 0x1000, 0x9, 0x7, 0x0, 0xf3, 0xc3, 0x9000, 0x7, 0x3, 0x1, 0x0, 0x7fff, 0xc0, 0xd4, 0x9, 0x3, 0x1, 0x4, 0x100, 0x6, 0x1000, 0x9, 0x8, 0x6, 0x9, 0x56, 0x200, 0x6, 0x1, 0x2, 0x2, 0x5b, 0x8, 0x1, 0x168, 0x1f2, 0x8, 0x1f, 0x1, 0x400, 0x5581, 0xf, 0x4, 0x7fff, 0x8, 0x5, 0x5, 0x80000001, 0x26, 0x0, 0x9, 0x80, 0x4, 0x80000000, 0x10001, 0x1ab, 0x80000000, 0x8001, 0x6, 0x81, 0x40, 0x9, 0x8, 0x6, 0x4, 0x8, 0x6, 0x1, 0x5, 0xde2, 0xffff, 0x9, 0x77, 0x101, 0x9, 0x5, 0x9, 0x8, 0x100, 0x2, 0x3, 0x7, 0x9, 0xbac5, 0x4, 0x200, 0x2, 0x6, 0xff, 0x9, 0x2, 0xd2a76e00, 0x3, 0x20, 0xffff, 0x4, 0xd834aed, 0x7, 0x400, 0x0, 0x800, 0xf3e4, 0x6, 0x10, 0x2, 0x8, 0x2, 0x7, 0x7, 0x8, 0x9, 0x7f, 0x3, 0x5cc7d25, 0x8, 0xfffffff7, 0x7, 0x4, 0x7fffffff, 0x4, 0x2, 0xfffffff7, 0x3, 0x9, 0x2, 0xffffff01, 0x2, 0x9, 0x1f, 0x0, 0x7, 0x400, 0x8, 0x1, 0x23, 0x4, 0x3, 0x0, 0xc7, 0x800, 0x74e0, 0x294, 0x5, 0x5, 0x8, 0x6, 0x1, 0x2e3, 0x3ff, 0x3, 0x9, 0x101, 0xf739, 0x200, 0x7bb, 0x7f, 0x3, 0x80000000, 0x20, 0x5, 0x5, 0x0, 0x1, 0x2, 0x1, 0xffffffff, 0x2f, 0x6, 0x0, 0x8, 0x7, 0x800, 0x0, 0x1, 0x4, 0x3d6, 0x7, 0x5, 0x101, 0x2, 0x9, 0x1000, 0x2, 0xffff, 0x6, 0x8d7, 0x1000, 0x4, 0x5, 0x0, 0x7f, 0x1000, 0x7, 0xffff8000, 0x7, 0x1, 0xffff0000, 0xa, 0x57, 0x80000000, 0x7900, 0x100, 0x1, 0x10001, 0x42a5, 0x84000001, 0x0, 0x8, 0x400, 0x7d, 0x6, 0x4, 0x6, 0x1e000000, 0x0, 0x1, 0xfc, 0x7fffffff, 0x5, 0x1, 0x2, 0x6, 0x81, 0x800, 0xffff3f03, 0x1, 0xff, 0x200, 0x52b0, 0xffffebc2, 0x800, 0x101, 0x9, 0x3ff, 0x7, 0x80, 0x6, 0x7, 0x1f, 0xfffff2b5, 0x2, 0x101, 0x0, 0x7d, 0x7fffffff, 0x9, 0x7, 0x0, 0xd1, 0x3318, 0x20, 0x5, 0x2, 0x2, 0x80000000, 0x7, 0x9a72, 0x7, 0x9d73, 0x8, 0x5, 0x5, 0x9, 0xfffffc00, 0x40, 0x7, 0x8000, 0x84d3, 0xffffffff, 0xf522, 0xc0, 0x8, 0x0, 0x55, 0x1, 0x2f1c, 0x7, 0x1, 0x8, 0xffffffff, 0x4a9, 0x5, 0x8001, 0x80000000, 0x6e1, 0x9, 0x8, 0x1, 0x10000, 0x20, 0x40, 0x2, 0xfffffbff, 0x10000, 0x7fffffff, 0x2, 0xfffffffe, 0x0, 0x100, 0x7, 0x100, 0x6, 0x0, 0x1, 0x401, 0x9, 0x6, 0x1d, 0x4, 0x8000, 0x3, 0x7, 0x3, 0x7, 0x1f, 0x3, 0x1ff, 0x10000, 0x7f, 0x3, 0x2, 0x3ff, 0x3, 0x7, 0x9, 0x7f, 0x101, 0x4, 0x5, 0xfffffeff, 0x7fffffff, 0x1, 0x4, 0x1, 0x3, 0x20, 0xb8, 0x4289, 0xd292, 0x7, 0x94, 0x7, 0x3, 0x3, 0x2, 0xfffffffb, 0x4, 0x7fff, 0x0, 0x2, 0x400, 0x4, 0x5, 0xfd6, 0x3, 0x7fffffff, 0x2, 0x401, 0x100, 0x6, 0x193, 0x8, 0x63, 0x1f, 0x27c, 0x8000, 0x12f5, 0xc58, 0x80, 0x2e3c, 0x1, 0xffffffff, 0x2, 0x172, 0x6d, 0x861, 0x8001, 0x8, 0x0, 0x3, 0x2, 0x1, 0xfff, 0x10001, 0x7ff, 0x8, 0x630, 0x6, 0x0, 0x6, 0x9, 0x203, 0x8be, 0x6, 0x10000, 0xffffffff, 0x5, 0x800, 0xa6c6, 0x0, 0xffff, 0x1, 0x122, 0x81, 0x8001, 0x4, 0x9, 0x1, 0x0, 0x8, 0x1, 0x101, 0x1f7c05dd, 0x9, 0x0, 0x7, 0x3, 0x1e1, 0x4, 0x80, 0xff, 0x7, 0xfffffffa, 0x8, 0x3, 0x5, 0x6, 0x200, 0x10000, 0x81, 0x8001, 0x7fffffff, 0x1000, 0xc0, 0x0, 0x3, 0x40000000, 0x3c, 0x8, 0x6, 0x3f, 0x5, 0x6d, 0x2, 0x0, 0x4, 0x80000000, 0x1, 0x80000001, 0x1ff, 0x7ff, 0x1, 0x1, 0xd4, 0x7f, 0x5, 0x0, 0x0, 0x6, 0x0, 0x7f, 0xd39, 0xffff, 0x400006, 0x80000001, 0x3, 0x401, 0x0, 0xfffffffd, 0x4, 0x4, 0x7a, 0x1f, 0x5, 0x0, 0x3, 0x9, 0x7f, 0x7, 0x7, 0x31, 0x8, 0x3f, 0x6, 0xffffffe0, 0x100, 0x6, 0x0, 0x1, 0x1000, 0x40, 0x3, 0x8, 0x800, 0x5, 0x81, 0x10000, 0x8, 0x3cbb64ea, 0xffffffff, 0x5, 0x7f, 0x5, 0x75f, 0x100, 0x100, 0x9, 0x66c, 0x0, 0x800, 0x15d, 0xffff, 0xfffffbff, 0xb6, 0xffffffc1, 0x3, 0x0, 0xffffffff, 0x2, 0x6, 0xff, 0x8, 0xee0, 0x8000, 0x8, 0x9, 0x2, 0x3, 0x5, 0x0, 0x8, 0xbb70, 0x1cdf, 0x101, 0x4, 0x10000, 0x7599, 0x7ff, 0x6, 0x0, 0x3, 0x0, 0x5, 0x3f, 0x8, 0x1, 0x1, 0x800, 0x8, 0x1, 0x14, 0x5, 0x80000001, 0x8000, 0x3, 0x4, 0x7ff, 0x4, 0x3, 0x8, 0xffff, 0xe09, 0x1f, 0x1f, 0x4, 0xfffff800, 0x78, 0xfffffffd, 0x8, 0x5, 0x6, 0x7fffffff, 0x2, 0x1, 0x401, 0x1, 0x3, 0x3ff, 0x0, 0x3, 0x81, 0x0, 0x0, 0x200, 0xfa, 0x0, 0x0, 0x6, 0x80, 0xa5, 0xfffffc00, 0x4, 0x9, 0x3, 0xfff, 0x80, 0x8000, 0x8, 0x544, 0x2, 0x5, 0x5, 0x1ff, 0x7fffffff, 0x7fff, 0x4, 0x2, 0x1, 0x6, 0x7fffffff, 0x420, 0x5, 0x4c, 0x20000009, 0x8, 0x13d, 0x4a0, 0x5, 0x1, 0x2, 0x2e, 0x500, 0x2, 0x1, 0x5, 0x43bd9cee, 0x6, 0x90a7, 0x4, 0x80000000, 0x2e5b5a09, 0xffffffff, 0xffff, 0x0, 0x79e, 0x2, 0x1, 0x0, 0x75, 0x0, 0xb75, 0x94a4, 0xbf0f, 0xffffff80, 0x5, 0x800, 0x4, 0x4, 0xffffff7f, 0x7, 0x2, 0x61585da6, 0x36cc0000, 0x8, 0xc15c, 0x1, 0x7fff, 0x81, 0x201ff, 0x1, 0xfffffff7, 0x10000, 0x0, 0x5, 0xdf1f, 0x1, 0x4, 0x3, 0x400, 0xea71, 0x800, 0x37, 0x6, 0x0, 0xfd3, 0x20, 0x5, 0x6, 0x4, 0x6, 0x1, 0xce7, 0x4, 0x8796, 0x6, 0x8, 0xffffffff, 0x6, 0x1000, 0xffff, 0x7ff, 0x9, 0x6, 0xffffff81, 0x4, 0x81, 0x7, 0x77c9, 0x9, 0x5, 0x5, 0xfffffff8, 0x7ff, 0x5, 0x1, 0x8000, 0x34, 0x80, 0x7, 0xfffffffc, 0x101, 0x588, 0x1, 0x800, 0x8, 0x7ff, 0xffffffff, 0x37, 0xfffc0000, 0x6c, 0x800, 0x100, 0x2, 0x1, 0xffff, 0x1, 0x4, 0x3f, 0x20, 0x1ff, 0x401, 0x101, 0xfffffffc, 0x8, 0x0, 0x1, 0x2, 0x7, 0x0, 0x672a, 0x9, 0x10000, 0xffff, 0x200008, 0x5, 0x6, 0xfffffffc, 0x100, 0x4, 0x7d6, 0x10001, 0x78a, 0x366, 0x2, 0x1f, 0x0, 0x8, 0x8001, 0xec, 0x7fff, 0xf4c, 0x3, 0x2, 0x8, 0x4, 0x2ce, 0x4, 0x7, 0x0, 0x1f, 0x3, 0x4, 0x4, 0x2, 0x2, 0x5, 0x6, 0x10, 0x6, 0x1, 0x7f, 0x9, 0x5, 0x4, 0x4, 0x6, 0x0, 0x8000, 0xd3b, 0x7fff, 0x3, 0x9, 0x2, 0x8, 0x3, 0x7, 0xd780, 0x65, 0x6, 0xffffffff, 0x9, 0x0, 0x7, 0x41b, 0xd5e, 0x8, 0x5, 0x10001, 0x7fffffff, 0x1f, 0x39, 0x6, 0x81, 0x7, 0x3, 0x8000, 0x5, 0x3ff, 0xffff, 0x1ff, 0x3b3, 0x9, 0x80, 0x0, 0x4, 0x5e87, 0x4, 0x7, 0x1000, 0x101, 0x6, 0x7, 0x80000000, 0x9, 0x7fffffff, 0x1, 0x5, 0x4, 0x8, 0x5, 0x0, 0x8, 0x6, 0xb67, 0x100, 0xff, 0x5, 0x200, 0x6, 0x2, 0x20, 0x4, 0x7f, 0xfff, 0x5, 0xc1, 0x2, 0xc1, 0x80000001, 0x8001, 0x10001, 0x5, 0xfffffff8, 0xffff, 0x8, 0x1, 0xc1c, 0x6c3, 0x2, 0x5, 0x4, 0xfffffff8, 0x40, 0x1f, 0x434, 0x6, 0x3ff, 0x3, 0x1, 0x5, 0xffff0ccb, 0x9565, 0xa5, 0x6, 0x0, 0x3, 0x8, 0x2, 0x2, 0x6, 0x8, 0x4, 0x2, 0x80000000, 0x200, 0x2, 0xfffffff9, 0xffffffff, 0x6, 0x4, 0x42, 0x2, 0x2f4, 0x1, 0xff, 0x8001, 0x8, 0x5, 0xfa, 0x800, 0x20, 0xba01, 0x5, 0x2, 0x8, 0x100, 0xd4c, 0x101, 0x81, 0x0, 0x1ff, 0x9, 0x3, 0x2, 0x5, 0xff, 0x9, 0x10000, 0x481, 0x8001, 0x6, 0x9, 0x401, 0xd985, 0x1000, 0x0, 0x200, 0x0, 0xffff, 0x3, 0x1, 0x3, 0x40, 0x0, 0x1, 0x9, 0x0, 0x493b3802, 0xffffb36b, 0x5, 0x7fff, 0x200, 0x7f, 0xe8, 0x2a, 0x0, 0x2, 0x3ff, 0x40, 0xfffffff9], 0x4, 0x400, 0x7}) (async) getpid() r5 = syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x80000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x10005a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r6}) (async, rerun: 64) setsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000001300)=0x1, 0x1) (async, rerun: 64) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000001240)={r8}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (rerun: 32) 13:11:25 executing program 0: r0 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, r0) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) add_key$keyring(&(0x7f0000000080), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) (async) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, r0) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r1 = socket$netlink(0x10, 0x3, 0x2) (rerun: 64) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async, rerun: 32) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000080)=0x6, 0x4) (async, rerun: 32) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 32) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000080)={0x0, 0x100000000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x3, 0x2, 0x200}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x32, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x143000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async, rerun: 64) r4 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x10, 0x800) getpeername$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x10) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x7fe, 0x5, 0x5a2}) (async, rerun: 32) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x80) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000200)={0xc}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x1ff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) (async, rerun: 32) syz_open_dev$dri(&(0x7f0000000240), 0x400, 0x800) (rerun: 32) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$PPPIOCGDEBUG(r6, 0x80047441, &(0x7f0000000100)) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x400005, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:25 executing program 0: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000540)={&(0x7f0000000100)={{@hyper, 0x1}, {@hyper, 0x81}, 0x400, "8f2367c369b4a437f227500559ce2c676322ce2f96fd4a19c4e3bc6a1545aef459d886169333158d240e79973ba98a9357652174a70eb765c9048b8a2d5918dfa724c7e32131ba37e82cfc4a43f1f8a03ea503a9a23f197ba4959e6c6aa1489a4304a2fc49ac8b3659e8bf78b080be5154d7b0f8836ab2169f6948f37ea13d92320d23184956774b23f34500eb419575ed2c55bc923fe0b56d7963493872121eb783fd4f2cbd77939426794b7c3323f61c62439f023d5bbe479f7c79b6ee4651150c859372b9330e322814dcc012b5afa86adaebcd7078134ea7203edb7704df639c746b05f7b53a7e605f2ff1e2bdf10fd9444200f838d117394774f101b94b46e4b9792d84afc87857e064921a7db101ca397a05bcee78e9c7f433fcf5068bca0d1d47f95951089e0cf065dc7bb4a49a762debe5f6b0c7d93997b726cc516a1822dd4dbd5c171df92ce98b3508118902eefc20c131e0f4fe524ddf2f7b77b81060e276af1fec8e0bb8428f58030724c7967c910782e897b7ccfb47cac7321c6bc406f87524c4830de7cdf6b888d5454986634c937fc51dea49a6731b50eb7a303a86e6c87ab06ac95cf8d2b24c14f096edb39c50233fe13e790fbd024a6bc45ff24bbd8cb5a1020d0399c7ebae0ecf14773a2ca671eb5911b74d8d24691d053e8b450bcddc31c646e599a326f2483ab98eb3afe0cac87754003289ead3d9974797e28dd570c65c0f4b37e04903eb0397c0757851c2487a3223abbe9a455bd8104dc572bafd18801bb1c3ce60201bb854deff83c1d0c4d19895564b70342167fc29919b516d3cd7d489495848ab4ed1ac28a7c25fdddc1a1372554702fa26a1ad69b166d46669d31c4e58a7ad5be3dbdbde8f7874fa39b072c82257d407f861fc4ead10c41d0f0ca5306337f0555a89828d38ad062c898d879872fb50d1687c6a1069857d4db6ae4ae694ea6413f02a1f33e32825e1f654ff67c86274fbe657f539e9fc48dc5999cafdf1c03ec19bbf9b0feacf273fcb406c55f71768284040dc388f84821ebc0e4c57b838ceb9df0b329347d84bad929e40a92fd1153811ffbdb6dedf6c585d5c9ecd4bafbc0dcaf6fa8b36e4cb302e0efc8cc4edcf905401101c53e73284d07aa247006cd150f40343ea3992e2321167273cef9e4665ff7e55c949047a770a4232f8c5482e2e263041406c9293893e53101bfe3a5a02f694b665a1d5470fa65472f3d6e7627fac276be6e4b622c2de539a1081549db4e7ade9f92589d1c502d7bd622dfed389ac92d8293a920674e4e8453de78a0442c072ac5fdaf60a1d4a83b97124a703615a6b6b67302bb75e42b50097c5c365dccc008a01aa9348116f020c41f721667c1faeee72caf07e31731065c644bc8770dd0684a1085ff3ecc2d8283a4cafa03e6e8ac740852303483ca658f2cad389b9330f"}, 0x418, 0x9dc}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x6, 0x0}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000040)={r3, 0x9}) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x400005, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x100, 0xff, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000200)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) socketpair(0x2, 0x6, 0x4, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netrom_NETROM_T1(r6, 0x103, 0x1, &(0x7f0000000080)=0x9, 0x4) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000080)={0x0, 0x100000000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x3, 0x2, 0x200}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000080)={0x0, 0x100000000}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x3, 0x2, 0x200}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async, rerun: 64) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x400005, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:25 executing program 0: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000540)={&(0x7f0000000100)={{@hyper, 0x1}, {@hyper, 0x81}, 0x400, "8f2367c369b4a437f227500559ce2c676322ce2f96fd4a19c4e3bc6a1545aef459d886169333158d240e79973ba98a9357652174a70eb765c9048b8a2d5918dfa724c7e32131ba37e82cfc4a43f1f8a03ea503a9a23f197ba4959e6c6aa1489a4304a2fc49ac8b3659e8bf78b080be5154d7b0f8836ab2169f6948f37ea13d92320d23184956774b23f34500eb419575ed2c55bc923fe0b56d7963493872121eb783fd4f2cbd77939426794b7c3323f61c62439f023d5bbe479f7c79b6ee4651150c859372b9330e322814dcc012b5afa86adaebcd7078134ea7203edb7704df639c746b05f7b53a7e605f2ff1e2bdf10fd9444200f838d117394774f101b94b46e4b9792d84afc87857e064921a7db101ca397a05bcee78e9c7f433fcf5068bca0d1d47f95951089e0cf065dc7bb4a49a762debe5f6b0c7d93997b726cc516a1822dd4dbd5c171df92ce98b3508118902eefc20c131e0f4fe524ddf2f7b77b81060e276af1fec8e0bb8428f58030724c7967c910782e897b7ccfb47cac7321c6bc406f87524c4830de7cdf6b888d5454986634c937fc51dea49a6731b50eb7a303a86e6c87ab06ac95cf8d2b24c14f096edb39c50233fe13e790fbd024a6bc45ff24bbd8cb5a1020d0399c7ebae0ecf14773a2ca671eb5911b74d8d24691d053e8b450bcddc31c646e599a326f2483ab98eb3afe0cac87754003289ead3d9974797e28dd570c65c0f4b37e04903eb0397c0757851c2487a3223abbe9a455bd8104dc572bafd18801bb1c3ce60201bb854deff83c1d0c4d19895564b70342167fc29919b516d3cd7d489495848ab4ed1ac28a7c25fdddc1a1372554702fa26a1ad69b166d46669d31c4e58a7ad5be3dbdbde8f7874fa39b072c82257d407f861fc4ead10c41d0f0ca5306337f0555a89828d38ad062c898d879872fb50d1687c6a1069857d4db6ae4ae694ea6413f02a1f33e32825e1f654ff67c86274fbe657f539e9fc48dc5999cafdf1c03ec19bbf9b0feacf273fcb406c55f71768284040dc388f84821ebc0e4c57b838ceb9df0b329347d84bad929e40a92fd1153811ffbdb6dedf6c585d5c9ecd4bafbc0dcaf6fa8b36e4cb302e0efc8cc4edcf905401101c53e73284d07aa247006cd150f40343ea3992e2321167273cef9e4665ff7e55c949047a770a4232f8c5482e2e263041406c9293893e53101bfe3a5a02f694b665a1d5470fa65472f3d6e7627fac276be6e4b622c2de539a1081549db4e7ade9f92589d1c502d7bd622dfed389ac92d8293a920674e4e8453de78a0442c072ac5fdaf60a1d4a83b97124a703615a6b6b67302bb75e42b50097c5c365dccc008a01aa9348116f020c41f721667c1faeee72caf07e31731065c644bc8770dd0684a1085ff3ecc2d8283a4cafa03e6e8ac740852303483ca658f2cad389b9330f"}, 0x418, 0x9dc}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x6, 0x0}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000040)={r3, 0x9}) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000540)={&(0x7f0000000100)={{@hyper, 0x1}, {@hyper, 0x81}, 0x400, "8f2367c369b4a437f227500559ce2c676322ce2f96fd4a19c4e3bc6a1545aef459d886169333158d240e79973ba98a9357652174a70eb765c9048b8a2d5918dfa724c7e32131ba37e82cfc4a43f1f8a03ea503a9a23f197ba4959e6c6aa1489a4304a2fc49ac8b3659e8bf78b080be5154d7b0f8836ab2169f6948f37ea13d92320d23184956774b23f34500eb419575ed2c55bc923fe0b56d7963493872121eb783fd4f2cbd77939426794b7c3323f61c62439f023d5bbe479f7c79b6ee4651150c859372b9330e322814dcc012b5afa86adaebcd7078134ea7203edb7704df639c746b05f7b53a7e605f2ff1e2bdf10fd9444200f838d117394774f101b94b46e4b9792d84afc87857e064921a7db101ca397a05bcee78e9c7f433fcf5068bca0d1d47f95951089e0cf065dc7bb4a49a762debe5f6b0c7d93997b726cc516a1822dd4dbd5c171df92ce98b3508118902eefc20c131e0f4fe524ddf2f7b77b81060e276af1fec8e0bb8428f58030724c7967c910782e897b7ccfb47cac7321c6bc406f87524c4830de7cdf6b888d5454986634c937fc51dea49a6731b50eb7a303a86e6c87ab06ac95cf8d2b24c14f096edb39c50233fe13e790fbd024a6bc45ff24bbd8cb5a1020d0399c7ebae0ecf14773a2ca671eb5911b74d8d24691d053e8b450bcddc31c646e599a326f2483ab98eb3afe0cac87754003289ead3d9974797e28dd570c65c0f4b37e04903eb0397c0757851c2487a3223abbe9a455bd8104dc572bafd18801bb1c3ce60201bb854deff83c1d0c4d19895564b70342167fc29919b516d3cd7d489495848ab4ed1ac28a7c25fdddc1a1372554702fa26a1ad69b166d46669d31c4e58a7ad5be3dbdbde8f7874fa39b072c82257d407f861fc4ead10c41d0f0ca5306337f0555a89828d38ad062c898d879872fb50d1687c6a1069857d4db6ae4ae694ea6413f02a1f33e32825e1f654ff67c86274fbe657f539e9fc48dc5999cafdf1c03ec19bbf9b0feacf273fcb406c55f71768284040dc388f84821ebc0e4c57b838ceb9df0b329347d84bad929e40a92fd1153811ffbdb6dedf6c585d5c9ecd4bafbc0dcaf6fa8b36e4cb302e0efc8cc4edcf905401101c53e73284d07aa247006cd150f40343ea3992e2321167273cef9e4665ff7e55c949047a770a4232f8c5482e2e263041406c9293893e53101bfe3a5a02f694b665a1d5470fa65472f3d6e7627fac276be6e4b622c2de539a1081549db4e7ade9f92589d1c502d7bd622dfed389ac92d8293a920674e4e8453de78a0442c072ac5fdaf60a1d4a83b97124a703615a6b6b67302bb75e42b50097c5c365dccc008a01aa9348116f020c41f721667c1faeee72caf07e31731065c644bc8770dd0684a1085ff3ecc2d8283a4cafa03e6e8ac740852303483ca658f2cad389b9330f"}, 0x418, 0x9dc}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x6}) (async) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000040)={r3, 0x9}) (async) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x32, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x143000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r4 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x10, 0x800) getpeername$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x10) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x32, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x143000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x10, 0x800) (async) getpeername$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x10) (async) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100), 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xa, 0x1, 0xfffffffe, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x9, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x1, 0x7fffffff, 0x8001}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) r5 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) connect$netlink(r5, &(0x7f0000000000)=@unspec, 0xc) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0xeaff, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x6, 0x0, 0x1}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000100)={0x1767}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000080)={r6}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x40000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r1}) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f0000000140)=0x1, 0x4) 13:11:25 executing program 0: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000540)={&(0x7f0000000100)={{@hyper, 0x1}, {@hyper, 0x81}, 0x400, "8f2367c369b4a437f227500559ce2c676322ce2f96fd4a19c4e3bc6a1545aef459d886169333158d240e79973ba98a9357652174a70eb765c9048b8a2d5918dfa724c7e32131ba37e82cfc4a43f1f8a03ea503a9a23f197ba4959e6c6aa1489a4304a2fc49ac8b3659e8bf78b080be5154d7b0f8836ab2169f6948f37ea13d92320d23184956774b23f34500eb419575ed2c55bc923fe0b56d7963493872121eb783fd4f2cbd77939426794b7c3323f61c62439f023d5bbe479f7c79b6ee4651150c859372b9330e322814dcc012b5afa86adaebcd7078134ea7203edb7704df639c746b05f7b53a7e605f2ff1e2bdf10fd9444200f838d117394774f101b94b46e4b9792d84afc87857e064921a7db101ca397a05bcee78e9c7f433fcf5068bca0d1d47f95951089e0cf065dc7bb4a49a762debe5f6b0c7d93997b726cc516a1822dd4dbd5c171df92ce98b3508118902eefc20c131e0f4fe524ddf2f7b77b81060e276af1fec8e0bb8428f58030724c7967c910782e897b7ccfb47cac7321c6bc406f87524c4830de7cdf6b888d5454986634c937fc51dea49a6731b50eb7a303a86e6c87ab06ac95cf8d2b24c14f096edb39c50233fe13e790fbd024a6bc45ff24bbd8cb5a1020d0399c7ebae0ecf14773a2ca671eb5911b74d8d24691d053e8b450bcddc31c646e599a326f2483ab98eb3afe0cac87754003289ead3d9974797e28dd570c65c0f4b37e04903eb0397c0757851c2487a3223abbe9a455bd8104dc572bafd18801bb1c3ce60201bb854deff83c1d0c4d19895564b70342167fc29919b516d3cd7d489495848ab4ed1ac28a7c25fdddc1a1372554702fa26a1ad69b166d46669d31c4e58a7ad5be3dbdbde8f7874fa39b072c82257d407f861fc4ead10c41d0f0ca5306337f0555a89828d38ad062c898d879872fb50d1687c6a1069857d4db6ae4ae694ea6413f02a1f33e32825e1f654ff67c86274fbe657f539e9fc48dc5999cafdf1c03ec19bbf9b0feacf273fcb406c55f71768284040dc388f84821ebc0e4c57b838ceb9df0b329347d84bad929e40a92fd1153811ffbdb6dedf6c585d5c9ecd4bafbc0dcaf6fa8b36e4cb302e0efc8cc4edcf905401101c53e73284d07aa247006cd150f40343ea3992e2321167273cef9e4665ff7e55c949047a770a4232f8c5482e2e263041406c9293893e53101bfe3a5a02f694b665a1d5470fa65472f3d6e7627fac276be6e4b622c2de539a1081549db4e7ade9f92589d1c502d7bd622dfed389ac92d8293a920674e4e8453de78a0442c072ac5fdaf60a1d4a83b97124a703615a6b6b67302bb75e42b50097c5c365dccc008a01aa9348116f020c41f721667c1faeee72caf07e31731065c644bc8770dd0684a1085ff3ecc2d8283a4cafa03e6e8ac740852303483ca658f2cad389b9330f"}, 0x418, 0x9dc}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000080)={0x6, 0x0}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000040)={r3, 0x9}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) r5 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) connect$netlink(r5, &(0x7f0000000000)=@unspec, 0xc) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x100, 0xff, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000200)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) socketpair(0x2, 0x6, 0x4, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netrom_NETROM_T1(r6, 0x103, 0x1, &(0x7f0000000080)=0x9, 0x4) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x100, 0xff, 0x3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000200)={r4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) socketpair(0x2, 0x6, 0x4, &(0x7f0000000000)) (async) setsockopt$netrom_NETROM_T1(r6, 0x103, 0x1, &(0x7f0000000080)=0x9, 0x4) (async) 13:11:25 executing program 2: r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x4}}, {{0x8, 0x1, r1}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r4, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)={0x94, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4800}, 0x48040) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r10, 0xc00464b4, &(0x7f0000000040)={r9}) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0xeaff, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x6, 0x0, 0x1}) (async) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000100)={0x1767}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000080)={r6}) (async) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) (async) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x40000) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r1}) (async) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f0000000140)=0x1, 0x4) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100), 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xa, 0x1, 0xfffffffe, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x9, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x1, 0x7fffffff, 0x8001}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100), 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xa, 0x1, 0xfffffffe}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x9, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x1, 0x7fffffff, 0x8001}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) (async) 13:11:25 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r1}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x800004, r1}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) r5 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) connect$netlink(r5, &(0x7f0000000000)=@unspec, 0xc) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r1}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x800004, r1}) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0xeaff, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x6, 0x0, 0x1}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000100)={0x1767}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000080)={r6}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x40000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r1}) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f0000000140)=0x1, 0x4) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000000), 0xeaff, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x6, 0x0, 0x1}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_SG_FREE(r4, 0x40106439, &(0x7f0000000100)={0x1767}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000080)={r6}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), 0xffffffffffffffff) (async) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x40000) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000001c0)={r8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000040)={r1}) (async) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f0000000140)=0x1, 0x4) (async) 13:11:25 executing program 2: r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r2 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x4}}, {{0x8, 0x1, r1}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r4, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async, rerun: 32) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)={0x94, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4800}, 0x48040) (rerun: 32) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) (async) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r10, 0xc00464b4, &(0x7f0000000040)={r9}) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x100, 0xff, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000200)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) socketpair(0x2, 0x6, 0x4, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netrom_NETROM_T1(r6, 0x103, 0x1, &(0x7f0000000080)=0x9, 0x4) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000100), 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xa, 0x1, 0xfffffffe, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x9, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x1, 0x7fffffff, 0x8001}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r1}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x800004, r1}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r1}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x800004, r1}) (async) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000000)) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) accept$ax25(r6, &(0x7f0000000100)={{0x3, @null}, [@netrom, @rose, @rose, @bcast, @default, @netrom, @remote, @null]}, &(0x7f0000000200)=0x48) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r5, 0x114, 0x3, &(0x7f00000000c0), 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$SNDRV_PCM_IOCTL_RESET(0xffffffffffffffff, 0x4141, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40106439, &(0x7f0000000000)={0xfed, r6}) 13:11:25 executing program 2: r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x4}}, {{0x8, 0x1, r1}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r4, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)={0x94, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4800}, 0x48040) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) r10 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r10, 0xc00464b4, &(0x7f0000000040)={r9}) syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)) (async) socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r0, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x4}}, {{0x8, 0x1, r1}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)) (async) socket$netlink(0x10, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x3cc, r4, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r5}, {0xf0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x46a}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x0, 0x2, 0xca, 0x8}]}}}]}}]}, 0x3cc}}, 0x0) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)={0x94, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4800}, 0x48040) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f00000001c0)={r11}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r10, 0xc00464b4, &(0x7f0000000040)={r9}) (async) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000000)) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) accept$ax25(r6, &(0x7f0000000100)={{0x3, @null}, [@netrom, @rose, @rose, @bcast, @default, @netrom, @remote, @null]}, &(0x7f0000000200)=0x48) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000000)) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) (async) accept$ax25(r6, &(0x7f0000000100)={{0x3, @null}, [@netrom, @rose, @rose, @bcast, @default, @netrom, @remote, @null]}, &(0x7f0000000200)=0x48) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000000)=0x8) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 0: ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000000)={0x7fffffff, 0x1}) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000000)=0xf, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r5, 0x114, 0x3, &(0x7f00000000c0), 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$SNDRV_PCM_IOCTL_RESET(0xffffffffffffffff, 0x4141, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40106439, &(0x7f0000000000)={0xfed, r6}) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000000)=0x8) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:25 executing program 0: ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000000)={0x7fffffff, 0x1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000000)) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) accept$ax25(r6, &(0x7f0000000100)={{0x3, @null}, [@netrom, @rose, @rose, @bcast, @default, @netrom, @remote, @null]}, &(0x7f0000000200)=0x48) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000000)) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) (async) accept$ax25(r6, &(0x7f0000000100)={{0x3, @null}, [@netrom, @rose, @rose, @bcast, @default, @netrom, @remote, @null]}, &(0x7f0000000200)=0x48) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) (async) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000000)) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) accept$ax25(r6, &(0x7f0000000100)={{0x3, @null}, [@netrom, @rose, @rose, @bcast, @default, @netrom, @remote, @null]}, &(0x7f0000000200)=0x48) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000000)=0xf, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000000)=0x8) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000000)=0x8) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:25 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r5, 0x114, 0x3, &(0x7f00000000c0), 0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$SNDRV_PCM_IOCTL_RESET(0xffffffffffffffff, 0x4141, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40106439, &(0x7f0000000000)={0xfed, r6}) 13:11:25 executing program 0: ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000000)={0x7fffffff, 0x1}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:25 executing program 5: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000480)={0x0, 0x8, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x7, 0x0, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000000)=[{}, {}], 0x2, 0x0, &(0x7f0000000400)=[{}, {}]}) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r6 = mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xb, 0x6, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) accept$ax25(r5, &(0x7f0000000280)={{0x3, @bcast}, [@null, @null, @netrom, @rose, @null, @rose, @null]}, &(0x7f0000000000)=0x48) 13:11:25 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000000)=0xf, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 13:11:25 executing program 4: setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0xa00, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x18000000, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:25 executing program 0: syz_open_dev$dri(&(0x7f0000000040), 0xffffffffffffffff, 0x204200) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000)={0x3, 0x4, 0xffff, 0x8}, 0x8) 13:11:25 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r6 = mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) 13:11:25 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$SIOCAX25CTLCON(0xffffffffffffffff, 0x89e8, &(0x7f0000000300)={@bcast, @default, @bcast, 0x4, 0x7f, 0x8, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(0xffffffffffffffff, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000200)="f556832477d650c1c3f73351feed48efa07bc6fc1696ab2defc02aeced6b25cef0f6ff83c026c6487af735291564e3521310eb088589e1c86e10a5cacf5716b686125bd3b8cbf9d59809781c4bb398db276a18caf21d3b3c9ab416aaa34330e868346754e0edd600116dc842bb8e7bd30923572a626eb54cc5e7b070a0443865f241530b93ca26821949e97e96b427abadcbc88487f09adee234369628b73a09ad1e26848de33de97aca9d091e165da67d5ae3d5f01353f119154c6eb14c41c44938d4c96a6705db0571b1dbf7381726c2", 0xd1}) 13:11:25 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x7fff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000100)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000240), 0x210200, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000280)={0x0, 0x27}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000080)={0x0, 0x2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000200)={r6, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) r6 = mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) mq_timedreceive(r6, &(0x7f0000000280)=""/56, 0x38, 0x2, &(0x7f00000002c0)={0x0, 0x3938700}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0xffffffffffffffff, 0x400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000000)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 4: setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0xa00, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x18000000, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0xa00, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x18000000}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:26 executing program 0: syz_open_dev$dri(&(0x7f0000000040), 0xffffffffffffffff, 0x204200) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async, rerun: 64) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async, rerun: 64) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000)={0x3, 0x4, 0xffff, 0x8}, 0x8) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$SIOCAX25CTLCON(0xffffffffffffffff, 0x89e8, &(0x7f0000000300)={@bcast, @default, @bcast, 0x4, 0x7f, 0x8, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(0xffffffffffffffff, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000200)="f556832477d650c1c3f73351feed48efa07bc6fc1696ab2defc02aeced6b25cef0f6ff83c026c6487af735291564e3521310eb088589e1c86e10a5cacf5716b686125bd3b8cbf9d59809781c4bb398db276a18caf21d3b3c9ab416aaa34330e868346754e0edd600116dc842bb8e7bd30923572a626eb54cc5e7b070a0443865f241530b93ca26821949e97e96b427abadcbc88487f09adee234369628b73a09ad1e26848de33de97aca9d091e165da67d5ae3d5f01353f119154c6eb14c41c44938d4c96a6705db0571b1dbf7381726c2", 0xd1}) 13:11:26 executing program 5: setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0xa00, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x18000000, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0xffffffffffffffff, 0x400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000000)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000100)={0xffffffffd99ec829}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0xffffffffffffffff, 0x400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000000)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f0000000080), 0xffffffffffffffff, 0x400) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000000)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:26 executing program 4: setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0xa00, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x18000000, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0xa00, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x18000000}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000200)={0x80000000, &(0x7f0000000080), &(0x7f0000000100)=[{{0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f0000000240)={{0x80000000, 0x0, 0x6, [0x3, 0x5]}, {r3, 0x0, 0x3, [0x8, 0x80]}, 0x10000000, [0x8, 0xca3c]}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$SIOCAX25CTLCON(0xffffffffffffffff, 0x89e8, &(0x7f0000000300)={@bcast, @default, @bcast, 0x4, 0x7f, 0x8, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(0xffffffffffffffff, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000200)="f556832477d650c1c3f73351feed48efa07bc6fc1696ab2defc02aeced6b25cef0f6ff83c026c6487af735291564e3521310eb088589e1c86e10a5cacf5716b686125bd3b8cbf9d59809781c4bb398db276a18caf21d3b3c9ab416aaa34330e868346754e0edd600116dc842bb8e7bd30923572a626eb54cc5e7b070a0443865f241530b93ca26821949e97e96b427abadcbc88487f09adee234369628b73a09ad1e26848de33de97aca9d091e165da67d5ae3d5f01353f119154c6eb14c41c44938d4c96a6705db0571b1dbf7381726c2", 0xd1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x40) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$SIOCAX25CTLCON(0xffffffffffffffff, 0x89e8, &(0x7f0000000300)={@bcast, @default, @bcast, 0x4, 0x7f, 0x8, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(0xffffffffffffffff, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000200)="f556832477d650c1c3f73351feed48efa07bc6fc1696ab2defc02aeced6b25cef0f6ff83c026c6487af735291564e3521310eb088589e1c86e10a5cacf5716b686125bd3b8cbf9d59809781c4bb398db276a18caf21d3b3c9ab416aaa34330e868346754e0edd600116dc842bb8e7bd30923572a626eb54cc5e7b070a0443865f241530b93ca26821949e97e96b427abadcbc88487f09adee234369628b73a09ad1e26848de33de97aca9d091e165da67d5ae3d5f01353f119154c6eb14c41c44938d4c96a6705db0571b1dbf7381726c2", 0xd1}) (async) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000140)) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000300)={0x81, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000340)={0x8, r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000240)={r4, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x3ff, 0xfffffffe, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) pipe2$watch_queue(&(0x7f0000000140), 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x2, 0x0, 0xca14, 0x0, 0x0}) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000380), 0x1) r8 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r8, 0x10e, 0x1, &(0x7f0000000040)=0x2, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000002c0)={r7}) 13:11:26 executing program 0: syz_open_dev$dri(&(0x7f0000000040), 0xffffffffffffffff, 0x204200) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000)={0x3, 0x4, 0xffff, 0x8}, 0x8) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x200000, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f0000000000)={0x3219}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000300)={0x81, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000340)={0x8, r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000240)={r4, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x3ff, 0xfffffffe, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) pipe2$watch_queue(&(0x7f0000000140), 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x2, 0x0, 0xca14, 0x0, 0x0}) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000380), 0x1) r8 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r8, 0x10e, 0x1, &(0x7f0000000040)=0x2, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000002c0)={r7}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000300)={0x81, 0x0, 0x2}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000340)={0x8, r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000200), 0x80) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) (async) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000240)={r4, 0x4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x3ff, 0xfffffffe, 0x9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x2, 0x0, 0xca14}) (async) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000380), 0x1) (async) socket$netlink(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r8, 0x10e, 0x1, &(0x7f0000000040)=0x2, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000002c0)={r7}) (async) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000080)='rxrpc_skb\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x2c, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='block_bio_complete\x00', r7}, 0x10) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x200000, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f0000000000)={0x3219}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (rerun: 32) 13:11:26 executing program 0: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0xfffffff8, 0x401}, 0x6b}, 0x10) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000080)='rxrpc_skb\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x2c, 0x0, 0x0}) (async) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='block_bio_complete\x00', r7}, 0x10) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x200000, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f0000000000)={0x3219}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 0: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0xfffffff8, 0x401}, 0x6b}, 0x10) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000300)={0x81, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000340)={0x8, r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000240)={r4, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x3ff, 0xfffffffe, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) pipe2$watch_queue(&(0x7f0000000140), 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x2, 0x0, 0xca14, 0x0, 0x0}) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000380), 0x1) r8 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r8, 0x10e, 0x1, &(0x7f0000000040)=0x2, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000002c0)={r7}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000300)={0x81, 0x0, 0x2}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f0000000340)={0x8, r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000200), 0x80) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) (async) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000240)={r4, 0x4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x3ff, 0xfffffffe, 0x9}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x2, 0x0, 0xca14}) (async) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000380), 0x1) (async) socket$netlink(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r8, 0x10e, 0x1, &(0x7f0000000040)=0x2, 0x4) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000002c0)={r7}) (async) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000300)={0x6e3d600d, 0x81, 0x9a5}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000080)='rxrpc_skb\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x2c, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='block_bio_complete\x00', r7}, 0x10) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000080)={0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r5}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000000)={0xff, r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000000)={0x0, r4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 0: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0xfffffff8, 0x401}, 0x6b}, 0x10) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0xfffffff8, 0x401}, 0x6b}, 0x10) (async) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) 13:11:26 executing program 4: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000100)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8, 0x2, 0x8, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast]}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000000)={r4}) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x44013) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001}) pipe2$watch_queue(&(0x7f0000000700), 0x80) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) (async) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000000)={0x0, r4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 0: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r1, 0x7b3, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) accept4$ax25(r0, &(0x7f0000000000)={{}, [@netrom, @bcast, @remote, @remote, @null, @default, @bcast, @netrom]}, &(0x7f0000000080)=0x48, 0x0) 13:11:26 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 1) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x4, 0xfffffffe, 0x80000001}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 0: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r1, 0x7b3, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) accept4$ax25(r0, &(0x7f0000000000)={{}, [@netrom, @bcast, @remote, @remote, @null, @default, @bcast, @netrom]}, &(0x7f0000000080)=0x48, 0x0) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r1, 0x7b3, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) accept4$ax25(r0, &(0x7f0000000000)={{}, [@netrom, @bcast, @remote, @remote, @null, @default, @bcast, @netrom]}, &(0x7f0000000080)=0x48, 0x0) (async) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r4}) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000000)={0x0, r4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x44013) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x44013) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2778.331476] FAULT_INJECTION: forcing a failure. [ 2778.331476] name failslab, interval 1, probability 0, space 0, times 0 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000001c0)={r3}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2778.376305] CPU: 0 PID: 30273 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2778.384205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2778.393564] Call Trace: [ 2778.396157] dump_stack+0x1b2/0x281 [ 2778.399791] should_fail.cold+0x10a/0x149 [ 2778.403940] should_failslab+0xd6/0x130 [ 2778.407918] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2778.412597] __vgem_gem_create+0x44/0xe0 [ 2778.416661] vgem_gem_dumb_create+0xc6/0x260 [ 2778.421073] drm_mode_create_dumb_ioctl+0x221/0x2b0 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2778.426091] ? __drm_printfn_debug+0x70/0x70 [ 2778.430500] drm_ioctl_kernel+0x14c/0x200 [ 2778.434651] drm_ioctl+0x42e/0x890 [ 2778.438196] ? __drm_printfn_debug+0x70/0x70 [ 2778.442606] ? drm_getstats+0x20/0x20 [ 2778.446411] ? fsnotify+0x974/0x11b0 [ 2778.450124] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2778.455045] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2778.460059] ? SyS_write+0x1b7/0x210 [ 2778.463775] ? drm_getstats+0x20/0x20 [ 2778.467573] do_vfs_ioctl+0x75a/0xff0 [ 2778.471376] ? lock_acquire+0x170/0x3f0 13:11:26 executing program 0: pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r1, 0x7b3, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) accept4$ax25(r0, &(0x7f0000000000)={{}, [@netrom, @bcast, @remote, @remote, @null, @default, @bcast, @netrom]}, &(0x7f0000000080)=0x48, 0x0) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r1, 0x7b3, &(0x7f0000000100)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r0) (async) accept4$ax25(r0, &(0x7f0000000000)={{}, [@netrom, @bcast, @remote, @remote, @null, @default, @bcast, @netrom]}, &(0x7f0000000080)=0x48, 0x0) (async) [ 2778.475347] ? ioctl_preallocate+0x1a0/0x1a0 [ 2778.479753] ? __fget+0x265/0x3e0 [ 2778.483208] ? do_vfs_ioctl+0xff0/0xff0 [ 2778.487183] ? security_file_ioctl+0x83/0xb0 [ 2778.491592] SyS_ioctl+0x7f/0xb0 [ 2778.494958] ? do_vfs_ioctl+0xff0/0xff0 [ 2778.498961] do_syscall_64+0x1d5/0x640 [ 2778.502867] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2778.508055] RIP: 0033:0x7f252f53e109 [ 2778.511765] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2778.519468] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 13:11:26 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x44013) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r2, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x44013) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000001c0)={r6}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000040)={r4}) (async) 13:11:26 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffff7, 0x20a3c1) r0 = socket(0x23, 0x1, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x15, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) bind$netlink(r3, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbff, 0x2}, 0xc) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r2, 0x1, 0x70bd25, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}}, 0x0) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000080)={0x40, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x5, r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x0, 0xff7dde55, 0x1ff}) 13:11:26 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2778.526752] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2778.534120] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 [ 2778.541393] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2778.548661] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 13:11:26 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:26 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000080)={0x40, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x5, r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x0, 0xff7dde55, 0x1ff}) 13:11:26 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffff7, 0x20a3c1) r0 = socket(0x23, 0x1, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x15, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) bind$netlink(r3, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbff, 0x2}, 0xc) (async) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r2, 0x1, 0x70bd25, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}}, 0x0) 13:11:26 executing program 5: syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffff7, 0x20a3c1) r0 = socket(0x23, 0x1, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x15, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) bind$netlink(r3, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbff, 0x2}, 0xc) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r2, 0x1, 0x70bd25, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}}, 0x0) 13:11:27 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0xe}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2778.646992] FAULT_INJECTION: forcing a failure. [ 2778.646992] name failslab, interval 1, probability 0, space 0, times 0 [ 2778.703821] CPU: 0 PID: 30331 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2778.711723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2778.721079] Call Trace: [ 2778.723669] dump_stack+0x1b2/0x281 [ 2778.727299] should_fail.cold+0x10a/0x149 [ 2778.731443] should_failslab+0xd6/0x130 [ 2778.735416] kmem_cache_alloc+0x28e/0x3c0 [ 2778.739563] __d_alloc+0x2a/0xa20 [ 2778.743202] __shmem_file_setup.part.0+0xcb/0x3c0 [ 2778.748053] ? fs_reclaim_release+0xd0/0x110 13:11:27 executing program 2: syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2778.752465] ? shmem_create+0x30/0x30 [ 2778.756266] ? __vgem_gem_create+0x44/0xe0 [ 2778.760502] shmem_file_setup+0x4b/0x60 [ 2778.764475] drm_gem_object_init+0x36/0xa0 [ 2778.768713] __vgem_gem_create+0x6a/0xe0 [ 2778.772778] vgem_gem_dumb_create+0xc6/0x260 [ 2778.777188] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2778.782219] ? __drm_printfn_debug+0x70/0x70 [ 2778.786632] drm_ioctl_kernel+0x14c/0x200 [ 2778.790790] drm_ioctl+0x42e/0x890 [ 2778.794331] ? __drm_printfn_debug+0x70/0x70 [ 2778.798736] ? drm_getstats+0x20/0x20 [ 2778.802543] ? fsnotify+0x974/0x11b0 [ 2778.806255] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2778.811185] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2778.816213] ? SyS_write+0x1b7/0x210 [ 2778.819929] ? drm_getstats+0x20/0x20 [ 2778.823727] do_vfs_ioctl+0x75a/0xff0 [ 2778.827524] ? lock_acquire+0x170/0x3f0 [ 2778.831494] ? ioctl_preallocate+0x1a0/0x1a0 [ 2778.835901] ? __fget+0x265/0x3e0 [ 2778.839443] ? do_vfs_ioctl+0xff0/0xff0 [ 2778.843414] ? security_file_ioctl+0x83/0xb0 [ 2778.847820] SyS_ioctl+0x7f/0xb0 [ 2778.851181] ? do_vfs_ioctl+0xff0/0xff0 [ 2778.855163] do_syscall_64+0x1d5/0x640 [ 2778.859309] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2778.864544] RIP: 0033:0x7f252f53e109 [ 2778.868394] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2778.876093] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2778.883347] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2778.890606] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 13:11:27 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 3) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:27 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:27 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0xe}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0xe}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:27 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:27 executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0xfffffffffffffff7, 0x20a3c1) r0 = socket(0x23, 0x1, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x15, 0x4) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) (async) r3 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001600)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000ec0)={0x14}, 0x14}}, 0x0) (async) bind$netlink(r3, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbff, 0x2}, 0xc) (async, rerun: 32) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x20, r2, 0x1, 0x70bd25, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}}, 0x0) (rerun: 32) 13:11:27 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000080)={0x40, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x5, r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x0, 0xff7dde55, 0x1ff}) [ 2778.897862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2778.905117] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 13:11:27 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r3}) (fail_nth: 1) 13:11:27 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000700), 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x27, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000100)={0x629, r7}) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000000)={0x0, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:27 executing program 2: mq_open(0x0, 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2778.995792] FAULT_INJECTION: forcing a failure. [ 2778.995792] name failslab, interval 1, probability 0, space 0, times 0 [ 2779.020938] CPU: 1 PID: 30377 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2779.028847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2779.038290] Call Trace: [ 2779.040879] dump_stack+0x1b2/0x281 [ 2779.044508] should_fail.cold+0x10a/0x149 [ 2779.048658] should_failslab+0xd6/0x130 [ 2779.052631] kmem_cache_alloc+0x28e/0x3c0 [ 2779.056777] ? shmem_destroy_callback+0xa0/0xa0 [ 2779.061442] shmem_alloc_inode+0x18/0x40 [ 2779.065502] ? shmem_destroy_callback+0xa0/0xa0 [ 2779.070165] alloc_inode+0x5d/0x170 [ 2779.073792] new_inode+0x1d/0xf0 [ 2779.077158] shmem_get_inode+0x8b/0x890 [ 2779.081132] __shmem_file_setup.part.0+0x104/0x3c0 [ 2779.086058] ? fs_reclaim_release+0xd0/0x110 [ 2779.090462] ? shmem_create+0x30/0x30 13:11:27 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000700), 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x27, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000100)={0x629, r7}) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000000)={0x0, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) pipe2$watch_queue(&(0x7f0000000200), 0x80) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x27, 0x0, 0x2}) (async) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000100)={0x629, r7}) (async) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000000)={0x0, 0x7fffffff}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:27 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x27, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000100)={0x629, r7}) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000000)={0x0, 0x7fffffff}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2779.094265] ? __vgem_gem_create+0x44/0xe0 [ 2779.098505] shmem_file_setup+0x4b/0x60 [ 2779.102481] drm_gem_object_init+0x36/0xa0 [ 2779.106717] __vgem_gem_create+0x6a/0xe0 [ 2779.110781] vgem_gem_dumb_create+0xc6/0x260 [ 2779.115190] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2779.120210] ? __drm_printfn_debug+0x70/0x70 [ 2779.124608] drm_ioctl_kernel+0x14c/0x200 [ 2779.128746] drm_ioctl+0x42e/0x890 [ 2779.132280] ? __drm_printfn_debug+0x70/0x70 [ 2779.136676] ? drm_getstats+0x20/0x20 [ 2779.140470] ? fsnotify+0x974/0x11b0 13:11:27 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000001c0)={r2}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f0000000700), 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r6) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x27, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000100)={0x629, r7}) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000000)={0x0, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) [ 2779.144175] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2779.149086] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2779.154081] ? SyS_write+0x1b7/0x210 [ 2779.157774] ? drm_getstats+0x20/0x20 [ 2779.161657] do_vfs_ioctl+0x75a/0xff0 [ 2779.165438] ? lock_acquire+0x170/0x3f0 [ 2779.169389] ? ioctl_preallocate+0x1a0/0x1a0 [ 2779.173784] ? __fget+0x265/0x3e0 [ 2779.177222] ? do_vfs_ioctl+0xff0/0xff0 [ 2779.181183] ? security_file_ioctl+0x83/0xb0 [ 2779.185592] SyS_ioctl+0x7f/0xb0 [ 2779.188957] ? do_vfs_ioctl+0xff0/0xff0 [ 2779.192930] do_syscall_64+0x1d5/0x640 [ 2779.196999] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2779.202182] RIP: 0033:0x7f252f53e109 [ 2779.205882] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2779.213591] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2779.220852] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2779.228102] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 [ 2779.235361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 13:11:27 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:27 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (fail_nth: 1) 13:11:27 executing program 2: mq_open(0x0, 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:27 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x200200) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) ioctl$PPPIOCDISCONN(r0, 0x7439) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x68400, 0x0) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000080)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x238500, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000180)) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000001c0)={0x7fff, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000200)={r5, 0x7fffffffffffffff}) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000140)) 13:11:27 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000000)) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={0x0, 0xe}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:27 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2c5, 0x0, 0x10000}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000040)={0x5, r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$IMGETDEVINFO(r4, 0x80044944, &(0x7f0000000100)={0x401}) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x10940, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000200)={0x0, r6}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r8}) [ 2779.242630] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 13:11:27 executing program 2: mq_open(0x0, 0x40, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:27 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2c5, 0x0, 0x10000}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000040)={0x5, r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$IMGETDEVINFO(r4, 0x80044944, &(0x7f0000000100)={0x401}) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x10940, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000200)={0x0, r6}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r8}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2c5, 0x0, 0x10000}) (async) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000040)={0x5, r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$IMGETDEVINFO(r4, 0x80044944, &(0x7f0000000100)={0x401}) (async) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x10940, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd}) (async) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) (async) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000200)={0x0, r6}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r8}) (async) 13:11:27 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0xffffffff, 0x5a3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:27 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r5, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000100)="6221496bbf8bb801d693071b685549d85076b8128552dca3bcb4d839e6de563b537157d0618e2ef95e9063ecae7897592b2e336fc04f7132821ad430995e1095d93476731e270720def62afc0bbc639a1492", 0x52}) 13:11:27 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x200200) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) ioctl$PPPIOCDISCONN(r0, 0x7439) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x68400, 0x0) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000080)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x238500, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000180)) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000001c0)={0x7fff, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000200)={r5, 0x7fffffffffffffff}) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000140)) syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x200200) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) (async) ioctl$PPPIOCDISCONN(r0, 0x7439) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x68400, 0x0) (async) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000080)) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x238500, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000180)) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000001c0)={0x7fff, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000200)={r5, 0x7fffffffffffffff}) (async) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000140)) (async) [ 2779.349415] FAULT_INJECTION: forcing a failure. [ 2779.349415] name failslab, interval 1, probability 0, space 0, times 0 [ 2779.400746] CPU: 0 PID: 30432 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2779.408651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2779.417999] Call Trace: [ 2779.420586] dump_stack+0x1b2/0x281 [ 2779.424227] should_fail.cold+0x10a/0x149 [ 2779.428379] should_failslab+0xd6/0x130 [ 2779.432362] kmem_cache_alloc+0x28e/0x3c0 [ 2779.436515] get_empty_filp+0x86/0x3f0 [ 2779.440397] alloc_file+0x23/0x440 [ 2779.443923] __shmem_file_setup.part.0+0x198/0x3c0 13:11:27 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x0, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2779.448926] ? fs_reclaim_release+0xd0/0x110 [ 2779.453332] ? shmem_create+0x30/0x30 [ 2779.457136] ? __vgem_gem_create+0x44/0xe0 [ 2779.461371] shmem_file_setup+0x4b/0x60 [ 2779.465343] drm_gem_object_init+0x36/0xa0 [ 2779.469576] __vgem_gem_create+0x6a/0xe0 [ 2779.473636] vgem_gem_dumb_create+0xc6/0x260 [ 2779.478046] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2779.483063] ? __drm_printfn_debug+0x70/0x70 [ 2779.487470] drm_ioctl_kernel+0x14c/0x200 [ 2779.491618] drm_ioctl+0x42e/0x890 [ 2779.495157] ? __drm_printfn_debug+0x70/0x70 [ 2779.499560] ? drm_getstats+0x20/0x20 [ 2779.503362] ? fsnotify+0x974/0x11b0 [ 2779.507070] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2779.512082] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2779.517087] ? SyS_write+0x1b7/0x210 [ 2779.520789] ? drm_getstats+0x20/0x20 [ 2779.524569] do_vfs_ioctl+0x75a/0xff0 [ 2779.528367] ? lock_acquire+0x170/0x3f0 [ 2779.532326] ? ioctl_preallocate+0x1a0/0x1a0 [ 2779.536714] ? __fget+0x265/0x3e0 [ 2779.540144] ? do_vfs_ioctl+0xff0/0xff0 [ 2779.544100] ? security_file_ioctl+0x83/0xb0 [ 2779.548485] SyS_ioctl+0x7f/0xb0 [ 2779.551827] ? do_vfs_ioctl+0xff0/0xff0 [ 2779.555786] do_syscall_64+0x1d5/0x640 [ 2779.559658] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2779.564830] RIP: 0033:0x7f252f53e109 [ 2779.568521] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2779.576217] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2779.583471] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2779.590718] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 13:11:27 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 5) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:27 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x0, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:27 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x200200) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) ioctl$PPPIOCDISCONN(r0, 0x7439) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x68400, 0x0) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000080)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x238500, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000180)) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000001c0)={0x7fff, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000200)={r5, 0x7fffffffffffffff}) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000140)) syz_open_dev$dri(&(0x7f00000000c0), 0x2, 0x200200) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) (async) ioctl$PPPIOCDISCONN(r0, 0x7439) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x68400, 0x0) (async) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000080)) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x238500, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r3) (async) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000180)) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000001c0)={0x7fff, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000200)={r5, 0x7fffffffffffffff}) (async) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000140)) (async) 13:11:27 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async, rerun: 32) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0xffffffff, 0x5a3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:27 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r5, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000100)="6221496bbf8bb801d693071b685549d85076b8128552dca3bcb4d839e6de563b537157d0618e2ef95e9063ecae7897592b2e336fc04f7132821ad430995e1095d93476731e270720def62afc0bbc639a1492", 0x52}) 13:11:27 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2c5, 0x0, 0x10000}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000040)={0x5, r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r3}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$IMGETDEVINFO(r4, 0x80044944, &(0x7f0000000100)={0x401}) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x10940, 0x0) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0xcd, 0x0}) ioctl$DRM_IOCTL_SG_FREE(0xffffffffffffffff, 0x40106439, &(0x7f00000005c0)={0x9, r6}) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000200)={0x0, r6}) (async) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r8}) [ 2779.598077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2779.605329] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 13:11:28 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000000), 0x80) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) getsockname$llc(r5, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000140)=0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r4}) syz_open_dev$sndpcmc(&(0x7f0000000240), 0x8001, 0x200002) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r5, 0x800443d3, &(0x7f0000000200)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x8, 0xb8, 0xdd}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x0, 0x5, 0x5a3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r6}) 13:11:28 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000000040)={&(0x7f0000000780)=[0x9, 0x20, 0xffffffff, 0xfffffb41, 0x7, 0x9, 0x800, 0x1ff, 0x1, 0x796d, 0x80, 0x7f79, 0x4, 0xbd, 0x8, 0x5, 0xfff, 0x7e0b, 0x80000001, 0x10001, 0xfe4, 0x9, 0x2, 0x4, 0x8000, 0x3, 0x0, 0x9, 0x6, 0x20, 0x7, 0x3, 0x0, 0x7, 0xffffffff, 0x6, 0x7, 0x9, 0x5e3, 0x7, 0x80000001, 0x0, 0xc76, 0x5c4, 0xff, 0x0, 0x8b, 0x7, 0x6, 0x7f, 0x1, 0x5, 0x7f, 0x7, 0x7, 0x8001, 0x81d0, 0x5, 0x3, 0xbc63, 0x9, 0x9, 0x3ff, 0x5, 0x9, 0x1, 0x3f, 0x0, 0x6, 0x68, 0x20, 0x272, 0x0, 0x8, 0x3f, 0x2000, 0x7fff, 0x1000, 0xf4, 0x10001, 0xfffffffa, 0x8001, 0x40, 0x18feab0d, 0x5, 0x7, 0xffffff15, 0x45d0, 0x1ff, 0x2, 0x3f, 0xffffffff, 0xfffffff9, 0x9, 0x9, 0x7c, 0xfff, 0x0, 0x1, 0x7, 0x81, 0x8, 0x6, 0x1, 0x5, 0x3, 0xff, 0x3, 0x5, 0x8, 0x6, 0x9, 0xfa0b, 0x0, 0xf97, 0x299a, 0x0, 0x6, 0x6, 0x7, 0x4, 0x400, 0x1f, 0x800, 0x95, 0xffff, 0x275c, 0x2, 0x2, 0xab, 0x6472, 0x8001, 0x7, 0x7, 0x1000, 0x0, 0xff, 0x3, 0x6e, 0x401, 0x6, 0x5, 0x401, 0x7, 0x0, 0x3, 0x3f, 0x7, 0x0, 0x8, 0x8, 0x5, 0x773, 0x1, 0x0, 0x9, 0x5, 0x4, 0xa7, 0xfffffeff, 0x37, 0x6, 0x7, 0x200, 0x4, 0x1, 0xa6, 0x800, 0x1000, 0xe408, 0x0, 0x0, 0x1, 0x6, 0x5, 0x8, 0x2, 0x5, 0x1000, 0x2, 0x1, 0x6, 0x95, 0x1, 0x80, 0x92, 0x8, 0xca, 0x4a, 0x401, 0x3f, 0x92, 0x0, 0x6, 0xfff, 0x7, 0x3, 0xffff, 0x80, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x6, 0xfffffbff, 0xffffffff, 0x80, 0x2, 0x7, 0x4, 0x9, 0x4, 0x7f, 0xffff, 0x0, 0x9, 0x8, 0x1, 0xffffffff, 0x1f, 0x1, 0x200, 0x4, 0xeac, 0x2, 0x7fffffff, 0x0, 0x80, 0x5, 0xba1, 0x1ff, 0x9, 0x5, 0x2, 0x8, 0x7, 0x10000, 0x80000000, 0x4, 0x7, 0x3, 0x4, 0x953, 0x1, 0x5, 0x8, 0x7, 0xffffffc0, 0x5, 0x2, 0x2, 0x5, 0xcdf, 0x5, 0xffffffff, 0x1f, 0x6, 0x7, 0xfffffffe, 0x0, 0x101, 0x7ff, 0x2, 0x6, 0x0, 0x8, 0x4, 0x7, 0x7, 0x6, 0xfffffff7, 0x9, 0x7f, 0x10000, 0x3f, 0x26d9, 0x9, 0x40, 0x9e, 0x1000, 0x800, 0x8, 0x7f, 0x2, 0x0, 0x87e3, 0x3, 0x4000000, 0x7c7a, 0xb10c, 0xff, 0x5, 0x1, 0x2f, 0x97b, 0x7, 0x3, 0x6, 0x800, 0x1, 0x1, 0x0, 0x7, 0x6, 0x7, 0x80000000, 0x101, 0x5, 0x3f, 0xffff, 0x3, 0x4, 0x2a8e, 0xffff, 0x1000, 0x3, 0x2b, 0x180000, 0x0, 0x10001, 0xfffffe19, 0x7fff, 0x0, 0x733f, 0x0, 0xfe2, 0x2, 0x1, 0x7, 0x5, 0x2, 0xfffffd01, 0x39d, 0x5, 0x8, 0x1, 0x0, 0x4, 0x2, 0xfe, 0x6c6, 0x7fff, 0x9, 0xffff06db, 0x53, 0xffb, 0x100, 0x6, 0x7fff, 0x7fffffff, 0x1, 0x844, 0x0, 0x6, 0xfb, 0x74, 0xffffffff, 0x1, 0x7ff, 0x8, 0x401, 0x9, 0x3, 0x0, 0xd19, 0x6, 0x401, 0x800, 0x9, 0xbea1, 0x4, 0x7, 0x9, 0x1, 0x7fff, 0x5, 0x6, 0x3ff00000, 0x800, 0x7ff, 0x2, 0x1, 0x1, 0x7, 0x34a9, 0x9968, 0x7, 0x3f, 0x3f, 0x5, 0x80000001, 0x1f8, 0x100, 0x9, 0x6, 0x7348, 0x7, 0x4a34, 0x7, 0xfffffffa, 0x7, 0x4, 0x9, 0xb41, 0x7, 0x2, 0x6, 0x101, 0x3, 0xffffffff, 0x1, 0x5, 0xa000, 0x4c6, 0x3, 0x1f, 0x2, 0x7f, 0x8, 0xfffff000, 0x6, 0x6b0, 0x1, 0x2, 0xba, 0x520, 0x7fffffff, 0x3, 0xffff, 0x0, 0x7, 0x78, 0x3cde, 0x3000000, 0x7ff, 0x5, 0x7, 0x6c43, 0x50, 0x9, 0x7, 0x10001, 0x1408, 0x0, 0x7ff, 0x1000, 0x7, 0xc9b3, 0x4, 0x8, 0xe, 0x7f, 0xf6a, 0x7, 0x81, 0x9, 0x1, 0x8001, 0xea, 0x9, 0x20, 0x3, 0x31a1, 0xc92, 0x82c, 0x7, 0x6, 0x1e2, 0x3, 0x18d, 0x80, 0x7, 0x4, 0x1, 0x7fffffff, 0x1000, 0x10000, 0x2, 0x8, 0x9, 0x4, 0x5, 0x1000, 0x9, 0x1, 0x3, 0x6f77, 0x6, 0x7, 0x3, 0x1f, 0x20, 0xc9, 0x4, 0x10000, 0x74b, 0x8000, 0x6, 0x9, 0x6, 0x6, 0xfff, 0x1, 0xffff, 0x8, 0x6, 0xfffff421, 0x3, 0x3, 0x1f, 0x2, 0x7ff, 0x1, 0x1, 0xfffff49e, 0x9ce3, 0x2, 0x4, 0x10001, 0x7ff, 0x9, 0x5, 0x6, 0x676b908, 0x8000, 0x7, 0x2, 0x0, 0x721, 0x3, 0x4c, 0x4, 0x9, 0x5, 0xff, 0x1ff, 0x9, 0x4, 0x8000, 0x6, 0xffffffb4, 0x80, 0x7fff, 0x7bf, 0x1f, 0x2, 0x0, 0x5, 0x0, 0x7, 0x4, 0x6, 0x9, 0x1000, 0x3, 0x1, 0x742a71dc, 0x9c24, 0xcae5, 0x3f, 0xfffffffb, 0x3, 0xffffffff, 0xd44, 0x3, 0x81, 0x9, 0x5, 0x2, 0x4, 0xffffffe0, 0x5, 0x7ff, 0x401, 0x1, 0xdf, 0x3, 0x1ff, 0x47, 0x7f, 0xffffffff, 0x3, 0x1ff, 0x7, 0x3ff, 0x1, 0x9, 0x7f, 0x8, 0xffff, 0x10000, 0xff, 0xfffffec1, 0x0, 0xffff8000, 0x4, 0x7c9, 0x6, 0x8, 0x0, 0x80000001, 0x5, 0x36, 0x4, 0xc67e, 0x0, 0x5, 0x97c, 0x6, 0x100, 0x4, 0x1, 0x36, 0x5, 0x14, 0x4, 0x80, 0x4, 0x5, 0x8001, 0x16b0000, 0x802, 0x401, 0x10000, 0xab, 0x4a, 0x7f, 0x0, 0x2, 0x7fff, 0x9, 0x1, 0x8001, 0xffff, 0x8, 0x5, 0x5f, 0x6, 0xf2, 0x8, 0x8001, 0x3, 0x8000, 0x3, 0x0, 0x6, 0x1, 0x40, 0x1, 0xfffffffc, 0x5, 0x0, 0x1, 0x4, 0x6ba, 0x77, 0x6, 0x3, 0xffff8001, 0x4, 0xbd, 0x6, 0x6, 0xf4, 0xffffffff, 0x3ff, 0xf0c2, 0x3ed, 0x3, 0x2, 0x4, 0x1, 0x7fff, 0xbff, 0x9, 0x7, 0x1, 0x0, 0xffffffff, 0x8, 0x5, 0x9, 0x1, 0x2, 0x2, 0x9, 0x200, 0x8, 0x1, 0x7, 0x9, 0x5c6, 0x10000, 0x20, 0x7, 0x7, 0x1, 0x6, 0x5, 0x7fff, 0x7, 0x3ff, 0x1, 0x23, 0x0, 0x4f, 0x48000000, 0x7, 0x7, 0x0, 0x9, 0xffff, 0x1, 0x7, 0x4, 0x2, 0x0, 0xffff, 0x1, 0x9, 0x2, 0x1, 0x80000001, 0xea, 0x3, 0x5, 0xc9e, 0xfffffff8, 0x401, 0x0, 0xae68, 0x200, 0x6, 0x4, 0xde, 0xfe0a, 0x7fff, 0x9, 0xfffffff9, 0x2, 0x4, 0x7, 0xfffffc00, 0x1, 0x1, 0x5, 0x8, 0x9, 0x9, 0x0, 0x7, 0xffffffe0, 0x1, 0x3f, 0x7, 0x7d, 0xa9, 0x1f, 0x4, 0x0, 0x3, 0x8, 0xd3080000, 0x3, 0x1c, 0x4, 0xef4a, 0x0, 0x2, 0xf1, 0x1, 0x8, 0xfffffffd, 0x8000, 0xffffffff, 0x7, 0x91c, 0x200, 0x6, 0x2, 0x200, 0x8000, 0x3, 0x5, 0x2, 0x7fffffff, 0x7fff, 0x3, 0x6, 0xfffffc00, 0xc0a7, 0x2, 0x0, 0x101, 0x80, 0x1, 0x3dfb, 0x1, 0x1000, 0x0, 0x828c, 0x2000000, 0x40, 0x3, 0x1ff, 0xfff, 0x80000000, 0x903, 0x200, 0x80000001, 0x3ff, 0x3f, 0x3ff, 0x0, 0x2, 0x9b94, 0x1000, 0x7f, 0x67, 0x2, 0x6, 0x806, 0x7c000, 0xfffffc00, 0x4, 0xff, 0xe3d00, 0x0, 0x3, 0x10001, 0x8, 0x0, 0x3, 0x3bd2, 0x23aa, 0x8, 0xc4f, 0x2, 0xe3e, 0x7, 0x7ff, 0x8, 0x1, 0x1ff, 0x1e67fc35, 0x6, 0x2, 0x8, 0x7, 0x9, 0x9, 0x3, 0x80000001, 0x2, 0xfff, 0x80, 0xfffffff7, 0x40, 0x1, 0x3, 0x6, 0x1, 0x8, 0x6, 0x3ff, 0x1f0000, 0x3, 0x80, 0x0, 0x0, 0x4b9, 0x7fff, 0xab96, 0x8, 0x0, 0x5, 0x3, 0x0, 0x80000000, 0x200, 0x3f, 0x1, 0x96, 0x40, 0xfffffff7, 0x200, 0x6e7, 0x1, 0x80000001, 0x2, 0xffffffff, 0x51, 0x0, 0x0, 0x2, 0x5, 0x7f, 0x581b, 0x5, 0x800, 0x101, 0x83b, 0x923, 0x7, 0x8000, 0xffffff00, 0x4, 0x5, 0x1, 0x6, 0xfffffff7, 0x200, 0x2, 0xb0, 0x0, 0x8, 0x0, 0x9, 0xffffff7f, 0xff, 0x7, 0x0, 0x3, 0x5, 0x8000, 0xfff, 0x8, 0xc100, 0x81, 0xff, 0x8, 0x3, 0x7, 0xbf8, 0xd7, 0x3, 0x2, 0x8001, 0x1, 0xffffffff, 0x1, 0xfffeffff, 0x7, 0xfffffffe, 0x81, 0x4, 0x1000, 0x4, 0x8001, 0x3, 0x1, 0x6, 0x257d, 0x4, 0xffff0000, 0x0, 0x8, 0x2, 0xfffffb0a, 0x6ae6fbdb, 0xfcf, 0x97, 0x6, 0x903, 0x9, 0x20, 0x7, 0x2, 0x0, 0x100, 0x5, 0xa3, 0xffff, 0x1, 0x2, 0x7, 0x9, 0x3f, 0xe74, 0x7, 0x7fc0b824, 0xffffffff, 0x8001, 0x198, 0xeb, 0x4, 0x1, 0xb7c8, 0x3f, 0x8000, 0x5, 0x400, 0x96, 0x9, 0x2, 0x0, 0x2, 0x1, 0x7, 0x5, 0x9, 0x40, 0x7ff, 0x800, 0xffff0000, 0x1, 0x3, 0x3, 0x100, 0x10000, 0x7, 0x9, 0x0, 0xfffff73b, 0x4, 0x2, 0x5, 0x1, 0x1000, 0xffffffff, 0x7511, 0x5], 0x1, 0x400, 0xd8}) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000140)) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000000100)={&(0x7f0000001780)=[0x5, 0x1, 0x3, 0x1, 0x4, 0xc6, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1000, 0x3, 0xfffffbff, 0x9, 0x200, 0x80, 0xff, 0x7, 0x1, 0xf0dd, 0xffff, 0xea, 0x4, 0xffff, 0xf43, 0xcab, 0x8, 0x0, 0x3, 0x7, 0xfff, 0xc5, 0x2, 0x5, 0x4, 0x90aa, 0x5000, 0x10000, 0xffff3b9a, 0x4, 0x5, 0x1, 0x800, 0x10001, 0x2, 0x5, 0x101, 0xfffffff8, 0x9, 0xfffff001, 0x80000000, 0xff, 0x920, 0x6, 0x5, 0x3b3c, 0x7fff, 0x5, 0x42, 0x9, 0x4, 0x16, 0x7, 0xf787, 0x81, 0x10000, 0x6, 0xfff, 0x418457e, 0x1ff, 0x80000001, 0x8, 0x6, 0x7f, 0x8, 0xb0000000, 0x9b, 0x5, 0x2, 0x0, 0xb01e, 0xfffffff7, 0xfffffffc, 0xffff, 0x7f, 0x7fc0, 0xc, 0x9, 0x3, 0x100, 0x0, 0x8, 0xff, 0xc1, 0xf533588a, 0x0, 0x1f, 0x1, 0x6, 0x1000, 0x7, 0x267, 0x5, 0x3, 0x3, 0x28c, 0x9, 0x0, 0x7, 0x1, 0x7ade, 0xfffffffa, 0x3, 0xff, 0x8, 0xddd, 0x6, 0x2, 0x7ff, 0xfffffffc, 0xe70, 0x5, 0x7fffffff, 0xffff, 0xd6e, 0x8, 0x22, 0x6, 0x237, 0x81, 0x6, 0x9, 0x3, 0xf44, 0x7fff, 0xffffffff, 0x10000, 0xffff, 0x29e7, 0x101, 0x4, 0x8, 0x6, 0x7, 0x9, 0x3, 0x9, 0x0, 0xff, 0x200, 0x7, 0x1, 0x5d, 0xd735, 0x4, 0x5, 0x800, 0x6, 0x0, 0x10000, 0x6, 0x0, 0x3, 0x7, 0x8, 0x3e7, 0x8, 0x3, 0x81, 0x3, 0xfff, 0x6, 0x34, 0x3, 0x351, 0x9, 0xffffffe1, 0x6, 0xcfb, 0x2, 0x4, 0x7, 0x5, 0x0, 0x5, 0x0, 0x3, 0x100, 0xffff8000, 0x401, 0x4, 0x1, 0xb7a7, 0x9b, 0xdd5, 0x7, 0x6, 0x1487, 0x1, 0x3ff, 0x1000, 0xf8, 0x6aa9, 0x10000, 0x80000000, 0x3f, 0x200, 0x5, 0x2060, 0x1, 0x4, 0x3, 0x7, 0x0, 0x1, 0x70, 0x9, 0x7, 0x0, 0x1f, 0x6, 0x579b, 0xfff, 0x0, 0x7c04, 0x7, 0x0, 0xfffffffa, 0xfff, 0x7, 0x2, 0x9efa, 0x100, 0x1000, 0x5, 0x6040, 0x101, 0x2, 0xffffffff, 0x8, 0x0, 0xbb5, 0x2, 0x5, 0x80000000, 0x3, 0x2, 0x7, 0x4, 0x7fff, 0x8a, 0x2, 0x1, 0x1f, 0x9, 0xf54a, 0xfff, 0x100, 0x40, 0x4, 0x20, 0x8, 0x100, 0x344, 0x40, 0xad4f, 0x7, 0xfff, 0x0, 0x2d9b, 0x160, 0xff, 0x8, 0x2c4, 0x3, 0x3, 0x9, 0x8, 0x81, 0x7fff, 0x8d7, 0x7, 0x4, 0x7, 0x5, 0x7f, 0x1, 0x74, 0x8, 0x100, 0x3, 0xa65, 0x3ff, 0x3, 0x2, 0x6, 0x1c0, 0x2, 0x6, 0xfffffffa, 0x4, 0x4, 0x9, 0x0, 0x6, 0x1, 0x2, 0x8, 0x263, 0x5, 0x2, 0x8, 0x2, 0x4e, 0xc02, 0x2, 0x1ff, 0x4, 0xffffffff, 0x8001, 0x5, 0x8, 0x7fff, 0x26, 0x1000, 0x6, 0x674, 0x5, 0xfc, 0x3ff, 0x241392f1, 0xfffffff9, 0xb7, 0x81, 0x1000, 0x4, 0x1, 0x1, 0x30a, 0x8, 0x1, 0x9, 0x7, 0xac51, 0x4, 0x167, 0xfff, 0x80, 0x100, 0x400, 0x5be9, 0x5f25, 0x40, 0x9fb8, 0x1, 0x2, 0x1000, 0x5, 0x5, 0x56b5f136, 0xae64, 0x0, 0x6, 0x6, 0x6, 0x602cb27d, 0xca46, 0x8001, 0xf88, 0x4, 0xfff, 0x1000, 0x5, 0xc8f, 0xd05, 0x20, 0x3eea, 0x9, 0x5, 0x6, 0x3, 0x36, 0x2, 0x6, 0x401, 0x1, 0x7, 0x0, 0x6, 0x7a, 0xfffffffb, 0x20, 0x80000001, 0x3, 0x0, 0x1f, 0x3da3, 0x2f1, 0x7, 0x2, 0x10000, 0x0, 0x9, 0xf4, 0x401, 0x5, 0x5, 0x7, 0x81, 0x9, 0x9, 0x4, 0x1ff, 0x4, 0xffffffff, 0x1, 0x3, 0x2a, 0x2, 0x3, 0xffffffff, 0x1, 0x1, 0x5, 0x4, 0x4, 0x1, 0x6, 0x5, 0x3, 0x3f, 0x1, 0x8001, 0x200, 0xffffffff, 0xffffff81, 0x0, 0x8, 0x5, 0x0, 0xa58, 0x7, 0x1000, 0x5, 0x1ff, 0x5, 0x7fff, 0x1, 0xff, 0xffff, 0x6, 0xc95, 0x3, 0x1ff, 0x8, 0x0, 0x7fff, 0x81, 0x8, 0x3ff, 0xdc89, 0x10000, 0xfffffff7, 0x2, 0x4, 0x10000002, 0x7fff, 0xfffffffa, 0x3ff, 0xc05, 0xd7e, 0xffffffe1, 0x6, 0x5, 0x7, 0x7385, 0x2, 0x2, 0x3d6, 0x401, 0x5, 0x4, 0x0, 0xa4, 0x7, 0x5, 0x0, 0x7f, 0x1050, 0x3f, 0x7fffffff, 0x80000000, 0x2, 0x1, 0x3, 0x2, 0x0, 0x87c, 0x4, 0x0, 0xffffff80, 0x1f, 0x5, 0x4, 0x401, 0x5, 0x7, 0x2, 0x77d, 0xf62, 0x8000, 0x3, 0x0, 0x800, 0x401, 0x3ff, 0xb2, 0x1, 0x6, 0x0, 0x2, 0x78e9, 0x40, 0x3, 0x200, 0x5, 0x0, 0x9, 0xffff, 0x3d8d, 0x0, 0x1, 0xfffffff9, 0x353, 0x8, 0x80000001, 0x0, 0x863, 0x4, 0x0, 0x9, 0x8, 0x5, 0x5, 0x9, 0x10001, 0x3ff, 0x9d, 0x9, 0x200, 0x10001, 0x4, 0x9, 0x4, 0x5, 0x200, 0x4, 0x0, 0x3, 0x3, 0x1, 0x1000, 0x7, 0x6, 0x3, 0x8, 0xff, 0x3, 0x7, 0x7, 0x80000000, 0x2, 0x7fff, 0x3, 0x9, 0x4, 0x5, 0x71, 0x3bc, 0x9, 0x200, 0x6, 0x3f, 0x8, 0x0, 0xffffffe1, 0x2, 0xffffffff, 0x80000001, 0xff, 0x483f, 0x1000, 0x7, 0x4, 0x6, 0x8, 0x40, 0x4ec2, 0x4000000, 0x7f, 0x0, 0x7, 0x9, 0xab12, 0x5, 0xff, 0x9d9e, 0x16, 0x0, 0x1, 0x0, 0xfff, 0x80000000, 0x10000, 0x3, 0x7, 0x8, 0x0, 0xeff, 0x1, 0x64000, 0x6, 0x2, 0x6f27, 0x1, 0x8, 0x80000000, 0xfffffffb, 0x7, 0xcc5, 0x6, 0x9, 0x9, 0x3, 0x5, 0x8001, 0x1000, 0x5, 0x4, 0x9f89, 0x20, 0x1, 0x7fffffff, 0x6, 0x3f, 0x7, 0x0, 0x1ff, 0xf22, 0x2, 0xfffffed7, 0x17, 0x620, 0x2, 0x1, 0x9, 0x3, 0x7d, 0x3ff, 0xffffffff, 0x7, 0x5, 0xe5, 0x592bae59, 0x100, 0x9, 0xffff, 0x4, 0xfff, 0x81, 0x5, 0x6, 0xfff, 0x1ff, 0x1000, 0x9, 0x42c0ec21, 0x8, 0x0, 0x6, 0x20, 0x3, 0x1ff, 0x6, 0x8, 0x200, 0x1, 0x8a8, 0x1ff, 0x2, 0x7, 0x6, 0x3ff, 0x0, 0x6, 0x20, 0xfffffff8, 0x5, 0x0, 0x9, 0xffffff81, 0x7, 0x200, 0x3, 0x1, 0x1000, 0xdc, 0x8888, 0x7fffffff, 0x4, 0xa7, 0x1a, 0x1, 0x3, 0x12, 0x5, 0x3, 0x10001, 0x5, 0x1f, 0x3, 0x0, 0x1f, 0x9, 0xfffffff7, 0x1, 0x9, 0x3, 0x1, 0x800, 0x1f, 0x4d0, 0x4, 0x2, 0x0, 0x3, 0x26e, 0xb7, 0x0, 0x8, 0x1, 0x7, 0x8000, 0x7cdc, 0xfffffffc, 0x9, 0xb775, 0x4a7f, 0x8, 0x81, 0x8, 0x101, 0xc3ea, 0x84, 0x3, 0x3, 0x25f, 0x3, 0x7, 0x1f, 0x8, 0x3c00, 0x2, 0x0, 0xfa1, 0x4, 0x90d9, 0x575, 0x8, 0xfffff801, 0x0, 0x7f, 0x7, 0x1, 0x1, 0x3, 0xfffffff9, 0x8, 0x0, 0x7, 0x0, 0x8, 0x10001, 0xff, 0x2, 0x8, 0x9, 0x97f3, 0x6, 0xffffffff, 0x33, 0x4faf5653, 0x5d0a, 0x4, 0x8000, 0x7f, 0x7, 0x1000, 0x5, 0xf3da, 0x800, 0x6c, 0x1, 0x8001, 0x5, 0x7f, 0x2, 0x1, 0x4d, 0x1, 0xea8a, 0x3, 0x8, 0x3, 0x2, 0x5, 0x9, 0x2, 0x4, 0x80000000, 0x0, 0x4, 0x2, 0x7, 0xb6cd, 0x6, 0x1000, 0x3, 0x7ff, 0x7, 0x77a6ad4e, 0x5, 0x101, 0x2, 0x7f, 0x40, 0x40, 0x7, 0x8001, 0x284, 0x6, 0x9, 0x834, 0x6, 0x7e, 0x1, 0x1ff, 0x81, 0x1, 0xffffffff, 0x7, 0x5, 0x9, 0x1, 0x8fc, 0x1, 0x7ff, 0xc27, 0x43, 0x9, 0x4, 0x7, 0x2, 0x4, 0x9, 0x7f, 0x9, 0x273, 0x8, 0x3ff, 0x5, 0x81, 0x2, 0xcf, 0x10000, 0x8, 0x1, 0x3f, 0xbd, 0x200, 0x80000001, 0x800, 0x40000000, 0xfffffffe, 0x7, 0xe20, 0x5, 0x2, 0x8, 0x1d137441, 0x10001, 0xd2c, 0x3, 0x3ff, 0x2, 0x4, 0x0, 0x3, 0x7, 0x6483, 0x1000, 0x2, 0x2, 0x909, 0x605, 0x2, 0x8001, 0x8cf, 0x2, 0x1, 0x9, 0x4000, 0x400, 0x1, 0x36, 0x3, 0x4, 0x0, 0x9, 0xfffffffb, 0xe1f6, 0xadd, 0x2, 0xde7, 0x7, 0x59, 0xffffff80, 0x1, 0xebf, 0x0, 0x2, 0x1, 0x1, 0x5, 0x5, 0x0, 0x805e, 0x6, 0x4, 0x7, 0x6, 0x6, 0x80000000, 0x1, 0xd21, 0xff, 0x20, 0x9b, 0x40, 0x8a4, 0x800, 0x6, 0x7, 0x0, 0x10001, 0xdc, 0x6, 0x4, 0x100, 0x7fff, 0x5, 0x2, 0x9, 0xff, 0x2, 0x40, 0x1, 0x4, 0x2, 0x7, 0xc193, 0x0, 0x0, 0x1000, 0x2d, 0x9, 0x80000001, 0x9, 0x7ff, 0x3, 0xaa, 0xfffffffc, 0x94ff, 0x100, 0xffffffff, 0xa0b1, 0x4, 0x3, 0x5, 0x5, 0xfff, 0x12a4e29b, 0x100, 0xaf36, 0x1, 0x9, 0xfffffff9, 0x0, 0x0, 0x1000, 0x9, 0x50, 0x3, 0x3, 0x9, 0x800, 0x0, 0xd680, 0x0, 0x9, 0x81, 0x4, 0x3, 0x7ff, 0x1, 0x80000001, 0x6, 0x4, 0x81, 0x9, 0x9, 0x4, 0x1], 0x1, 0x400, 0x7}) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000180)=0xd7540e53b5cf887d, 0x2) getsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f00000001c0), &(0x7f0000000200)=0x4) [ 2779.685701] FAULT_INJECTION: forcing a failure. [ 2779.685701] name failslab, interval 1, probability 0, space 0, times 0 [ 2779.699068] CPU: 0 PID: 30504 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2779.707045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2779.716397] Call Trace: [ 2779.718993] dump_stack+0x1b2/0x281 [ 2779.722663] should_fail.cold+0x10a/0x149 [ 2779.726818] should_failslab+0xd6/0x130 [ 2779.730796] kmem_cache_alloc_trace+0x29a/0x3d0 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x0, 0x8, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:28 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r5, 0x40184150, &(0x7f0000000000)={0x0, &(0x7f0000000100)="6221496bbf8bb801d693071b685549d85076b8128552dca3bcb4d839e6de563b537157d0618e2ef95e9063ecae7897592b2e336fc04f7132821ad430995e1095d93476731e270720def62afc0bbc639a1492", 0x52}) [ 2779.735469] apparmor_file_alloc_security+0x129/0x800 [ 2779.740666] security_file_alloc+0x66/0xa0 [ 2779.744899] ? selinux_is_enabled+0x5/0x50 [ 2779.749134] get_empty_filp+0x16b/0x3f0 [ 2779.753122] alloc_file+0x23/0x440 [ 2779.756662] __shmem_file_setup.part.0+0x198/0x3c0 [ 2779.761586] ? fs_reclaim_release+0xd0/0x110 [ 2779.765996] ? shmem_create+0x30/0x30 [ 2779.769798] ? __vgem_gem_create+0x44/0xe0 [ 2779.774033] shmem_file_setup+0x4b/0x60 [ 2779.778006] drm_gem_object_init+0x36/0xa0 [ 2779.782252] __vgem_gem_create+0x6a/0xe0 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0x81e, 0x7fffffffffffffff, 0x8}) [ 2779.786316] vgem_gem_dumb_create+0xc6/0x260 [ 2779.790732] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2779.795750] ? __drm_printfn_debug+0x70/0x70 [ 2779.800166] drm_ioctl_kernel+0x14c/0x200 [ 2779.804317] drm_ioctl+0x42e/0x890 [ 2779.808125] ? __drm_printfn_debug+0x70/0x70 [ 2779.812534] ? drm_getstats+0x20/0x20 [ 2779.816340] ? fsnotify+0x974/0x11b0 [ 2779.820050] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2779.824979] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2779.829994] ? SyS_write+0x1b7/0x210 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, 0x0) [ 2779.833711] ? drm_getstats+0x20/0x20 [ 2779.837519] do_vfs_ioctl+0x75a/0xff0 [ 2779.841317] ? lock_acquire+0x170/0x3f0 [ 2779.845287] ? ioctl_preallocate+0x1a0/0x1a0 [ 2779.849720] ? __fget+0x265/0x3e0 [ 2779.853173] ? do_vfs_ioctl+0xff0/0xff0 [ 2779.857150] ? security_file_ioctl+0x83/0xb0 [ 2779.861553] SyS_ioctl+0x7f/0xb0 [ 2779.864914] ? do_vfs_ioctl+0xff0/0xff0 [ 2779.868895] do_syscall_64+0x1d5/0x640 [ 2779.872788] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2779.877973] RIP: 0033:0x7f252f53e109 13:11:28 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:28 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x6, 0x6, 0x2e0}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x1350, 0xfffffff7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, 0x0) 13:11:28 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0xffffffff, 0x5a3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0xffffffff, 0x5a3}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) 13:11:28 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000000040)={&(0x7f0000000780)=[0x9, 0x20, 0xffffffff, 0xfffffb41, 0x7, 0x9, 0x800, 0x1ff, 0x1, 0x796d, 0x80, 0x7f79, 0x4, 0xbd, 0x8, 0x5, 0xfff, 0x7e0b, 0x80000001, 0x10001, 0xfe4, 0x9, 0x2, 0x4, 0x8000, 0x3, 0x0, 0x9, 0x6, 0x20, 0x7, 0x3, 0x0, 0x7, 0xffffffff, 0x6, 0x7, 0x9, 0x5e3, 0x7, 0x80000001, 0x0, 0xc76, 0x5c4, 0xff, 0x0, 0x8b, 0x7, 0x6, 0x7f, 0x1, 0x5, 0x7f, 0x7, 0x7, 0x8001, 0x81d0, 0x5, 0x3, 0xbc63, 0x9, 0x9, 0x3ff, 0x5, 0x9, 0x1, 0x3f, 0x0, 0x6, 0x68, 0x20, 0x272, 0x0, 0x8, 0x3f, 0x2000, 0x7fff, 0x1000, 0xf4, 0x10001, 0xfffffffa, 0x8001, 0x40, 0x18feab0d, 0x5, 0x7, 0xffffff15, 0x45d0, 0x1ff, 0x2, 0x3f, 0xffffffff, 0xfffffff9, 0x9, 0x9, 0x7c, 0xfff, 0x0, 0x1, 0x7, 0x81, 0x8, 0x6, 0x1, 0x5, 0x3, 0xff, 0x3, 0x5, 0x8, 0x6, 0x9, 0xfa0b, 0x0, 0xf97, 0x299a, 0x0, 0x6, 0x6, 0x7, 0x4, 0x400, 0x1f, 0x800, 0x95, 0xffff, 0x275c, 0x2, 0x2, 0xab, 0x6472, 0x8001, 0x7, 0x7, 0x1000, 0x0, 0xff, 0x3, 0x6e, 0x401, 0x6, 0x5, 0x401, 0x7, 0x0, 0x3, 0x3f, 0x7, 0x0, 0x8, 0x8, 0x5, 0x773, 0x1, 0x0, 0x9, 0x5, 0x4, 0xa7, 0xfffffeff, 0x37, 0x6, 0x7, 0x200, 0x4, 0x1, 0xa6, 0x800, 0x1000, 0xe408, 0x0, 0x0, 0x1, 0x6, 0x5, 0x8, 0x2, 0x5, 0x1000, 0x2, 0x1, 0x6, 0x95, 0x1, 0x80, 0x92, 0x8, 0xca, 0x4a, 0x401, 0x3f, 0x92, 0x0, 0x6, 0xfff, 0x7, 0x3, 0xffff, 0x80, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x6, 0xfffffbff, 0xffffffff, 0x80, 0x2, 0x7, 0x4, 0x9, 0x4, 0x7f, 0xffff, 0x0, 0x9, 0x8, 0x1, 0xffffffff, 0x1f, 0x1, 0x200, 0x4, 0xeac, 0x2, 0x7fffffff, 0x0, 0x80, 0x5, 0xba1, 0x1ff, 0x9, 0x5, 0x2, 0x8, 0x7, 0x10000, 0x80000000, 0x4, 0x7, 0x3, 0x4, 0x953, 0x1, 0x5, 0x8, 0x7, 0xffffffc0, 0x5, 0x2, 0x2, 0x5, 0xcdf, 0x5, 0xffffffff, 0x1f, 0x6, 0x7, 0xfffffffe, 0x0, 0x101, 0x7ff, 0x2, 0x6, 0x0, 0x8, 0x4, 0x7, 0x7, 0x6, 0xfffffff7, 0x9, 0x7f, 0x10000, 0x3f, 0x26d9, 0x9, 0x40, 0x9e, 0x1000, 0x800, 0x8, 0x7f, 0x2, 0x0, 0x87e3, 0x3, 0x4000000, 0x7c7a, 0xb10c, 0xff, 0x5, 0x1, 0x2f, 0x97b, 0x7, 0x3, 0x6, 0x800, 0x1, 0x1, 0x0, 0x7, 0x6, 0x7, 0x80000000, 0x101, 0x5, 0x3f, 0xffff, 0x3, 0x4, 0x2a8e, 0xffff, 0x1000, 0x3, 0x2b, 0x180000, 0x0, 0x10001, 0xfffffe19, 0x7fff, 0x0, 0x733f, 0x0, 0xfe2, 0x2, 0x1, 0x7, 0x5, 0x2, 0xfffffd01, 0x39d, 0x5, 0x8, 0x1, 0x0, 0x4, 0x2, 0xfe, 0x6c6, 0x7fff, 0x9, 0xffff06db, 0x53, 0xffb, 0x100, 0x6, 0x7fff, 0x7fffffff, 0x1, 0x844, 0x0, 0x6, 0xfb, 0x74, 0xffffffff, 0x1, 0x7ff, 0x8, 0x401, 0x9, 0x3, 0x0, 0xd19, 0x6, 0x401, 0x800, 0x9, 0xbea1, 0x4, 0x7, 0x9, 0x1, 0x7fff, 0x5, 0x6, 0x3ff00000, 0x800, 0x7ff, 0x2, 0x1, 0x1, 0x7, 0x34a9, 0x9968, 0x7, 0x3f, 0x3f, 0x5, 0x80000001, 0x1f8, 0x100, 0x9, 0x6, 0x7348, 0x7, 0x4a34, 0x7, 0xfffffffa, 0x7, 0x4, 0x9, 0xb41, 0x7, 0x2, 0x6, 0x101, 0x3, 0xffffffff, 0x1, 0x5, 0xa000, 0x4c6, 0x3, 0x1f, 0x2, 0x7f, 0x8, 0xfffff000, 0x6, 0x6b0, 0x1, 0x2, 0xba, 0x520, 0x7fffffff, 0x3, 0xffff, 0x0, 0x7, 0x78, 0x3cde, 0x3000000, 0x7ff, 0x5, 0x7, 0x6c43, 0x50, 0x9, 0x7, 0x10001, 0x1408, 0x0, 0x7ff, 0x1000, 0x7, 0xc9b3, 0x4, 0x8, 0xe, 0x7f, 0xf6a, 0x7, 0x81, 0x9, 0x1, 0x8001, 0xea, 0x9, 0x20, 0x3, 0x31a1, 0xc92, 0x82c, 0x7, 0x6, 0x1e2, 0x3, 0x18d, 0x80, 0x7, 0x4, 0x1, 0x7fffffff, 0x1000, 0x10000, 0x2, 0x8, 0x9, 0x4, 0x5, 0x1000, 0x9, 0x1, 0x3, 0x6f77, 0x6, 0x7, 0x3, 0x1f, 0x20, 0xc9, 0x4, 0x10000, 0x74b, 0x8000, 0x6, 0x9, 0x6, 0x6, 0xfff, 0x1, 0xffff, 0x8, 0x6, 0xfffff421, 0x3, 0x3, 0x1f, 0x2, 0x7ff, 0x1, 0x1, 0xfffff49e, 0x9ce3, 0x2, 0x4, 0x10001, 0x7ff, 0x9, 0x5, 0x6, 0x676b908, 0x8000, 0x7, 0x2, 0x0, 0x721, 0x3, 0x4c, 0x4, 0x9, 0x5, 0xff, 0x1ff, 0x9, 0x4, 0x8000, 0x6, 0xffffffb4, 0x80, 0x7fff, 0x7bf, 0x1f, 0x2, 0x0, 0x5, 0x0, 0x7, 0x4, 0x6, 0x9, 0x1000, 0x3, 0x1, 0x742a71dc, 0x9c24, 0xcae5, 0x3f, 0xfffffffb, 0x3, 0xffffffff, 0xd44, 0x3, 0x81, 0x9, 0x5, 0x2, 0x4, 0xffffffe0, 0x5, 0x7ff, 0x401, 0x1, 0xdf, 0x3, 0x1ff, 0x47, 0x7f, 0xffffffff, 0x3, 0x1ff, 0x7, 0x3ff, 0x1, 0x9, 0x7f, 0x8, 0xffff, 0x10000, 0xff, 0xfffffec1, 0x0, 0xffff8000, 0x4, 0x7c9, 0x6, 0x8, 0x0, 0x80000001, 0x5, 0x36, 0x4, 0xc67e, 0x0, 0x5, 0x97c, 0x6, 0x100, 0x4, 0x1, 0x36, 0x5, 0x14, 0x4, 0x80, 0x4, 0x5, 0x8001, 0x16b0000, 0x802, 0x401, 0x10000, 0xab, 0x4a, 0x7f, 0x0, 0x2, 0x7fff, 0x9, 0x1, 0x8001, 0xffff, 0x8, 0x5, 0x5f, 0x6, 0xf2, 0x8, 0x8001, 0x3, 0x8000, 0x3, 0x0, 0x6, 0x1, 0x40, 0x1, 0xfffffffc, 0x5, 0x0, 0x1, 0x4, 0x6ba, 0x77, 0x6, 0x3, 0xffff8001, 0x4, 0xbd, 0x6, 0x6, 0xf4, 0xffffffff, 0x3ff, 0xf0c2, 0x3ed, 0x3, 0x2, 0x4, 0x1, 0x7fff, 0xbff, 0x9, 0x7, 0x1, 0x0, 0xffffffff, 0x8, 0x5, 0x9, 0x1, 0x2, 0x2, 0x9, 0x200, 0x8, 0x1, 0x7, 0x9, 0x5c6, 0x10000, 0x20, 0x7, 0x7, 0x1, 0x6, 0x5, 0x7fff, 0x7, 0x3ff, 0x1, 0x23, 0x0, 0x4f, 0x48000000, 0x7, 0x7, 0x0, 0x9, 0xffff, 0x1, 0x7, 0x4, 0x2, 0x0, 0xffff, 0x1, 0x9, 0x2, 0x1, 0x80000001, 0xea, 0x3, 0x5, 0xc9e, 0xfffffff8, 0x401, 0x0, 0xae68, 0x200, 0x6, 0x4, 0xde, 0xfe0a, 0x7fff, 0x9, 0xfffffff9, 0x2, 0x4, 0x7, 0xfffffc00, 0x1, 0x1, 0x5, 0x8, 0x9, 0x9, 0x0, 0x7, 0xffffffe0, 0x1, 0x3f, 0x7, 0x7d, 0xa9, 0x1f, 0x4, 0x0, 0x3, 0x8, 0xd3080000, 0x3, 0x1c, 0x4, 0xef4a, 0x0, 0x2, 0xf1, 0x1, 0x8, 0xfffffffd, 0x8000, 0xffffffff, 0x7, 0x91c, 0x200, 0x6, 0x2, 0x200, 0x8000, 0x3, 0x5, 0x2, 0x7fffffff, 0x7fff, 0x3, 0x6, 0xfffffc00, 0xc0a7, 0x2, 0x0, 0x101, 0x80, 0x1, 0x3dfb, 0x1, 0x1000, 0x0, 0x828c, 0x2000000, 0x40, 0x3, 0x1ff, 0xfff, 0x80000000, 0x903, 0x200, 0x80000001, 0x3ff, 0x3f, 0x3ff, 0x0, 0x2, 0x9b94, 0x1000, 0x7f, 0x67, 0x2, 0x6, 0x806, 0x7c000, 0xfffffc00, 0x4, 0xff, 0xe3d00, 0x0, 0x3, 0x10001, 0x8, 0x0, 0x3, 0x3bd2, 0x23aa, 0x8, 0xc4f, 0x2, 0xe3e, 0x7, 0x7ff, 0x8, 0x1, 0x1ff, 0x1e67fc35, 0x6, 0x2, 0x8, 0x7, 0x9, 0x9, 0x3, 0x80000001, 0x2, 0xfff, 0x80, 0xfffffff7, 0x40, 0x1, 0x3, 0x6, 0x1, 0x8, 0x6, 0x3ff, 0x1f0000, 0x3, 0x80, 0x0, 0x0, 0x4b9, 0x7fff, 0xab96, 0x8, 0x0, 0x5, 0x3, 0x0, 0x80000000, 0x200, 0x3f, 0x1, 0x96, 0x40, 0xfffffff7, 0x200, 0x6e7, 0x1, 0x80000001, 0x2, 0xffffffff, 0x51, 0x0, 0x0, 0x2, 0x5, 0x7f, 0x581b, 0x5, 0x800, 0x101, 0x83b, 0x923, 0x7, 0x8000, 0xffffff00, 0x4, 0x5, 0x1, 0x6, 0xfffffff7, 0x200, 0x2, 0xb0, 0x0, 0x8, 0x0, 0x9, 0xffffff7f, 0xff, 0x7, 0x0, 0x3, 0x5, 0x8000, 0xfff, 0x8, 0xc100, 0x81, 0xff, 0x8, 0x3, 0x7, 0xbf8, 0xd7, 0x3, 0x2, 0x8001, 0x1, 0xffffffff, 0x1, 0xfffeffff, 0x7, 0xfffffffe, 0x81, 0x4, 0x1000, 0x4, 0x8001, 0x3, 0x1, 0x6, 0x257d, 0x4, 0xffff0000, 0x0, 0x8, 0x2, 0xfffffb0a, 0x6ae6fbdb, 0xfcf, 0x97, 0x6, 0x903, 0x9, 0x20, 0x7, 0x2, 0x0, 0x100, 0x5, 0xa3, 0xffff, 0x1, 0x2, 0x7, 0x9, 0x3f, 0xe74, 0x7, 0x7fc0b824, 0xffffffff, 0x8001, 0x198, 0xeb, 0x4, 0x1, 0xb7c8, 0x3f, 0x8000, 0x5, 0x400, 0x96, 0x9, 0x2, 0x0, 0x2, 0x1, 0x7, 0x5, 0x9, 0x40, 0x7ff, 0x800, 0xffff0000, 0x1, 0x3, 0x3, 0x100, 0x10000, 0x7, 0x9, 0x0, 0xfffff73b, 0x4, 0x2, 0x5, 0x1, 0x1000, 0xffffffff, 0x7511, 0x5], 0x1, 0x400, 0xd8}) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000140)) (async, rerun: 64) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (rerun: 64) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000000100)={&(0x7f0000001780)=[0x5, 0x1, 0x3, 0x1, 0x4, 0xc6, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1000, 0x3, 0xfffffbff, 0x9, 0x200, 0x80, 0xff, 0x7, 0x1, 0xf0dd, 0xffff, 0xea, 0x4, 0xffff, 0xf43, 0xcab, 0x8, 0x0, 0x3, 0x7, 0xfff, 0xc5, 0x2, 0x5, 0x4, 0x90aa, 0x5000, 0x10000, 0xffff3b9a, 0x4, 0x5, 0x1, 0x800, 0x10001, 0x2, 0x5, 0x101, 0xfffffff8, 0x9, 0xfffff001, 0x80000000, 0xff, 0x920, 0x6, 0x5, 0x3b3c, 0x7fff, 0x5, 0x42, 0x9, 0x4, 0x16, 0x7, 0xf787, 0x81, 0x10000, 0x6, 0xfff, 0x418457e, 0x1ff, 0x80000001, 0x8, 0x6, 0x7f, 0x8, 0xb0000000, 0x9b, 0x5, 0x2, 0x0, 0xb01e, 0xfffffff7, 0xfffffffc, 0xffff, 0x7f, 0x7fc0, 0xc, 0x9, 0x3, 0x100, 0x0, 0x8, 0xff, 0xc1, 0xf533588a, 0x0, 0x1f, 0x1, 0x6, 0x1000, 0x7, 0x267, 0x5, 0x3, 0x3, 0x28c, 0x9, 0x0, 0x7, 0x1, 0x7ade, 0xfffffffa, 0x3, 0xff, 0x8, 0xddd, 0x6, 0x2, 0x7ff, 0xfffffffc, 0xe70, 0x5, 0x7fffffff, 0xffff, 0xd6e, 0x8, 0x22, 0x6, 0x237, 0x81, 0x6, 0x9, 0x3, 0xf44, 0x7fff, 0xffffffff, 0x10000, 0xffff, 0x29e7, 0x101, 0x4, 0x8, 0x6, 0x7, 0x9, 0x3, 0x9, 0x0, 0xff, 0x200, 0x7, 0x1, 0x5d, 0xd735, 0x4, 0x5, 0x800, 0x6, 0x0, 0x10000, 0x6, 0x0, 0x3, 0x7, 0x8, 0x3e7, 0x8, 0x3, 0x81, 0x3, 0xfff, 0x6, 0x34, 0x3, 0x351, 0x9, 0xffffffe1, 0x6, 0xcfb, 0x2, 0x4, 0x7, 0x5, 0x0, 0x5, 0x0, 0x3, 0x100, 0xffff8000, 0x401, 0x4, 0x1, 0xb7a7, 0x9b, 0xdd5, 0x7, 0x6, 0x1487, 0x1, 0x3ff, 0x1000, 0xf8, 0x6aa9, 0x10000, 0x80000000, 0x3f, 0x200, 0x5, 0x2060, 0x1, 0x4, 0x3, 0x7, 0x0, 0x1, 0x70, 0x9, 0x7, 0x0, 0x1f, 0x6, 0x579b, 0xfff, 0x0, 0x7c04, 0x7, 0x0, 0xfffffffa, 0xfff, 0x7, 0x2, 0x9efa, 0x100, 0x1000, 0x5, 0x6040, 0x101, 0x2, 0xffffffff, 0x8, 0x0, 0xbb5, 0x2, 0x5, 0x80000000, 0x3, 0x2, 0x7, 0x4, 0x7fff, 0x8a, 0x2, 0x1, 0x1f, 0x9, 0xf54a, 0xfff, 0x100, 0x40, 0x4, 0x20, 0x8, 0x100, 0x344, 0x40, 0xad4f, 0x7, 0xfff, 0x0, 0x2d9b, 0x160, 0xff, 0x8, 0x2c4, 0x3, 0x3, 0x9, 0x8, 0x81, 0x7fff, 0x8d7, 0x7, 0x4, 0x7, 0x5, 0x7f, 0x1, 0x74, 0x8, 0x100, 0x3, 0xa65, 0x3ff, 0x3, 0x2, 0x6, 0x1c0, 0x2, 0x6, 0xfffffffa, 0x4, 0x4, 0x9, 0x0, 0x6, 0x1, 0x2, 0x8, 0x263, 0x5, 0x2, 0x8, 0x2, 0x4e, 0xc02, 0x2, 0x1ff, 0x4, 0xffffffff, 0x8001, 0x5, 0x8, 0x7fff, 0x26, 0x1000, 0x6, 0x674, 0x5, 0xfc, 0x3ff, 0x241392f1, 0xfffffff9, 0xb7, 0x81, 0x1000, 0x4, 0x1, 0x1, 0x30a, 0x8, 0x1, 0x9, 0x7, 0xac51, 0x4, 0x167, 0xfff, 0x80, 0x100, 0x400, 0x5be9, 0x5f25, 0x40, 0x9fb8, 0x1, 0x2, 0x1000, 0x5, 0x5, 0x56b5f136, 0xae64, 0x0, 0x6, 0x6, 0x6, 0x602cb27d, 0xca46, 0x8001, 0xf88, 0x4, 0xfff, 0x1000, 0x5, 0xc8f, 0xd05, 0x20, 0x3eea, 0x9, 0x5, 0x6, 0x3, 0x36, 0x2, 0x6, 0x401, 0x1, 0x7, 0x0, 0x6, 0x7a, 0xfffffffb, 0x20, 0x80000001, 0x3, 0x0, 0x1f, 0x3da3, 0x2f1, 0x7, 0x2, 0x10000, 0x0, 0x9, 0xf4, 0x401, 0x5, 0x5, 0x7, 0x81, 0x9, 0x9, 0x4, 0x1ff, 0x4, 0xffffffff, 0x1, 0x3, 0x2a, 0x2, 0x3, 0xffffffff, 0x1, 0x1, 0x5, 0x4, 0x4, 0x1, 0x6, 0x5, 0x3, 0x3f, 0x1, 0x8001, 0x200, 0xffffffff, 0xffffff81, 0x0, 0x8, 0x5, 0x0, 0xa58, 0x7, 0x1000, 0x5, 0x1ff, 0x5, 0x7fff, 0x1, 0xff, 0xffff, 0x6, 0xc95, 0x3, 0x1ff, 0x8, 0x0, 0x7fff, 0x81, 0x8, 0x3ff, 0xdc89, 0x10000, 0xfffffff7, 0x2, 0x4, 0x10000002, 0x7fff, 0xfffffffa, 0x3ff, 0xc05, 0xd7e, 0xffffffe1, 0x6, 0x5, 0x7, 0x7385, 0x2, 0x2, 0x3d6, 0x401, 0x5, 0x4, 0x0, 0xa4, 0x7, 0x5, 0x0, 0x7f, 0x1050, 0x3f, 0x7fffffff, 0x80000000, 0x2, 0x1, 0x3, 0x2, 0x0, 0x87c, 0x4, 0x0, 0xffffff80, 0x1f, 0x5, 0x4, 0x401, 0x5, 0x7, 0x2, 0x77d, 0xf62, 0x8000, 0x3, 0x0, 0x800, 0x401, 0x3ff, 0xb2, 0x1, 0x6, 0x0, 0x2, 0x78e9, 0x40, 0x3, 0x200, 0x5, 0x0, 0x9, 0xffff, 0x3d8d, 0x0, 0x1, 0xfffffff9, 0x353, 0x8, 0x80000001, 0x0, 0x863, 0x4, 0x0, 0x9, 0x8, 0x5, 0x5, 0x9, 0x10001, 0x3ff, 0x9d, 0x9, 0x200, 0x10001, 0x4, 0x9, 0x4, 0x5, 0x200, 0x4, 0x0, 0x3, 0x3, 0x1, 0x1000, 0x7, 0x6, 0x3, 0x8, 0xff, 0x3, 0x7, 0x7, 0x80000000, 0x2, 0x7fff, 0x3, 0x9, 0x4, 0x5, 0x71, 0x3bc, 0x9, 0x200, 0x6, 0x3f, 0x8, 0x0, 0xffffffe1, 0x2, 0xffffffff, 0x80000001, 0xff, 0x483f, 0x1000, 0x7, 0x4, 0x6, 0x8, 0x40, 0x4ec2, 0x4000000, 0x7f, 0x0, 0x7, 0x9, 0xab12, 0x5, 0xff, 0x9d9e, 0x16, 0x0, 0x1, 0x0, 0xfff, 0x80000000, 0x10000, 0x3, 0x7, 0x8, 0x0, 0xeff, 0x1, 0x64000, 0x6, 0x2, 0x6f27, 0x1, 0x8, 0x80000000, 0xfffffffb, 0x7, 0xcc5, 0x6, 0x9, 0x9, 0x3, 0x5, 0x8001, 0x1000, 0x5, 0x4, 0x9f89, 0x20, 0x1, 0x7fffffff, 0x6, 0x3f, 0x7, 0x0, 0x1ff, 0xf22, 0x2, 0xfffffed7, 0x17, 0x620, 0x2, 0x1, 0x9, 0x3, 0x7d, 0x3ff, 0xffffffff, 0x7, 0x5, 0xe5, 0x592bae59, 0x100, 0x9, 0xffff, 0x4, 0xfff, 0x81, 0x5, 0x6, 0xfff, 0x1ff, 0x1000, 0x9, 0x42c0ec21, 0x8, 0x0, 0x6, 0x20, 0x3, 0x1ff, 0x6, 0x8, 0x200, 0x1, 0x8a8, 0x1ff, 0x2, 0x7, 0x6, 0x3ff, 0x0, 0x6, 0x20, 0xfffffff8, 0x5, 0x0, 0x9, 0xffffff81, 0x7, 0x200, 0x3, 0x1, 0x1000, 0xdc, 0x8888, 0x7fffffff, 0x4, 0xa7, 0x1a, 0x1, 0x3, 0x12, 0x5, 0x3, 0x10001, 0x5, 0x1f, 0x3, 0x0, 0x1f, 0x9, 0xfffffff7, 0x1, 0x9, 0x3, 0x1, 0x800, 0x1f, 0x4d0, 0x4, 0x2, 0x0, 0x3, 0x26e, 0xb7, 0x0, 0x8, 0x1, 0x7, 0x8000, 0x7cdc, 0xfffffffc, 0x9, 0xb775, 0x4a7f, 0x8, 0x81, 0x8, 0x101, 0xc3ea, 0x84, 0x3, 0x3, 0x25f, 0x3, 0x7, 0x1f, 0x8, 0x3c00, 0x2, 0x0, 0xfa1, 0x4, 0x90d9, 0x575, 0x8, 0xfffff801, 0x0, 0x7f, 0x7, 0x1, 0x1, 0x3, 0xfffffff9, 0x8, 0x0, 0x7, 0x0, 0x8, 0x10001, 0xff, 0x2, 0x8, 0x9, 0x97f3, 0x6, 0xffffffff, 0x33, 0x4faf5653, 0x5d0a, 0x4, 0x8000, 0x7f, 0x7, 0x1000, 0x5, 0xf3da, 0x800, 0x6c, 0x1, 0x8001, 0x5, 0x7f, 0x2, 0x1, 0x4d, 0x1, 0xea8a, 0x3, 0x8, 0x3, 0x2, 0x5, 0x9, 0x2, 0x4, 0x80000000, 0x0, 0x4, 0x2, 0x7, 0xb6cd, 0x6, 0x1000, 0x3, 0x7ff, 0x7, 0x77a6ad4e, 0x5, 0x101, 0x2, 0x7f, 0x40, 0x40, 0x7, 0x8001, 0x284, 0x6, 0x9, 0x834, 0x6, 0x7e, 0x1, 0x1ff, 0x81, 0x1, 0xffffffff, 0x7, 0x5, 0x9, 0x1, 0x8fc, 0x1, 0x7ff, 0xc27, 0x43, 0x9, 0x4, 0x7, 0x2, 0x4, 0x9, 0x7f, 0x9, 0x273, 0x8, 0x3ff, 0x5, 0x81, 0x2, 0xcf, 0x10000, 0x8, 0x1, 0x3f, 0xbd, 0x200, 0x80000001, 0x800, 0x40000000, 0xfffffffe, 0x7, 0xe20, 0x5, 0x2, 0x8, 0x1d137441, 0x10001, 0xd2c, 0x3, 0x3ff, 0x2, 0x4, 0x0, 0x3, 0x7, 0x6483, 0x1000, 0x2, 0x2, 0x909, 0x605, 0x2, 0x8001, 0x8cf, 0x2, 0x1, 0x9, 0x4000, 0x400, 0x1, 0x36, 0x3, 0x4, 0x0, 0x9, 0xfffffffb, 0xe1f6, 0xadd, 0x2, 0xde7, 0x7, 0x59, 0xffffff80, 0x1, 0xebf, 0x0, 0x2, 0x1, 0x1, 0x5, 0x5, 0x0, 0x805e, 0x6, 0x4, 0x7, 0x6, 0x6, 0x80000000, 0x1, 0xd21, 0xff, 0x20, 0x9b, 0x40, 0x8a4, 0x800, 0x6, 0x7, 0x0, 0x10001, 0xdc, 0x6, 0x4, 0x100, 0x7fff, 0x5, 0x2, 0x9, 0xff, 0x2, 0x40, 0x1, 0x4, 0x2, 0x7, 0xc193, 0x0, 0x0, 0x1000, 0x2d, 0x9, 0x80000001, 0x9, 0x7ff, 0x3, 0xaa, 0xfffffffc, 0x94ff, 0x100, 0xffffffff, 0xa0b1, 0x4, 0x3, 0x5, 0x5, 0xfff, 0x12a4e29b, 0x100, 0xaf36, 0x1, 0x9, 0xfffffff9, 0x0, 0x0, 0x1000, 0x9, 0x50, 0x3, 0x3, 0x9, 0x800, 0x0, 0xd680, 0x0, 0x9, 0x81, 0x4, 0x3, 0x7ff, 0x1, 0x80000001, 0x6, 0x4, 0x81, 0x9, 0x9, 0x4, 0x1], 0x1, 0x400, 0x7}) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000180)=0xd7540e53b5cf887d, 0x2) (async) getsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f00000001c0), &(0x7f0000000200)=0x4) [ 2779.881690] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2779.889393] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2779.896670] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2779.903935] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 [ 2779.911201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2779.918489] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 13:11:28 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) (async) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) getsockname$llc(r5, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000140)=0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r4}) (rerun: 32) syz_open_dev$sndpcmc(&(0x7f0000000240), 0x8001, 0x200002) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r5, 0x800443d3, &(0x7f0000000200)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x8, 0xb8, 0xdd}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x0, 0x5, 0x5a3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r6}) 13:11:28 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x6, 0x6, 0x2e0}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x1350, 0xfffffff7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, 0x0) 13:11:28 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) getsockname$llc(r5, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000140)=0x10) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r4}) (async) syz_open_dev$sndpcmc(&(0x7f0000000240), 0x8001, 0x200002) (async) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r5, 0x800443d3, &(0x7f0000000200)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x8, 0xb8, 0xdd}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000180)={0x0, 0x5, 0x5a3, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r6}) [ 2780.045022] FAULT_INJECTION: forcing a failure. [ 2780.045022] name failslab, interval 1, probability 0, space 0, times 0 [ 2780.056354] CPU: 0 PID: 30551 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2780.064235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2780.073593] Call Trace: [ 2780.076181] dump_stack+0x1b2/0x281 [ 2780.079817] should_fail.cold+0x10a/0x149 [ 2780.083967] should_failslab+0xd6/0x130 [ 2780.087952] kmem_cache_alloc+0x40/0x3c0 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, &(0x7f0000000240)={0x0, 0x81e, 0x7fffffffffffffff, 0x8}) 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x7fffffffffffffff, 0x8}) [ 2780.092020] radix_tree_node_alloc.constprop.0+0x1b0/0x2f0 [ 2780.097770] idr_get_free_cmn+0x595/0x8d0 [ 2780.102028] idr_alloc_cmn+0xe8/0x1e0 [ 2780.105831] ? __fprop_inc_percpu_max+0x1d0/0x1d0 [ 2780.110676] ? drm_gem_handle_create_tail+0x118/0x330 [ 2780.115871] ? __radix_tree_preload+0x1c3/0x250 [ 2780.120549] drm_gem_handle_create_tail+0x13e/0x330 [ 2780.125569] ? drm_gem_destroy+0xa0/0xa0 [ 2780.129650] vgem_gem_dumb_create+0xe8/0x260 [ 2780.134070] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2780.139093] ? __drm_printfn_debug+0x70/0x70 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x7fffffffffffffff, 0x8}) [ 2780.143506] drm_ioctl_kernel+0x14c/0x200 [ 2780.147657] drm_ioctl+0x42e/0x890 [ 2780.151200] ? __drm_printfn_debug+0x70/0x70 [ 2780.155606] ? drm_getstats+0x20/0x20 [ 2780.159418] ? fsnotify+0x974/0x11b0 [ 2780.163131] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2780.168059] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2780.173079] ? SyS_write+0x1b7/0x210 [ 2780.176795] ? drm_getstats+0x20/0x20 [ 2780.180594] do_vfs_ioctl+0x75a/0xff0 [ 2780.184396] ? lock_acquire+0x170/0x3f0 [ 2780.188369] ? ioctl_preallocate+0x1a0/0x1a0 [ 2780.192770] ? __fget+0x265/0x3e0 [ 2780.196206] ? do_vfs_ioctl+0xff0/0xff0 [ 2780.200174] ? security_file_ioctl+0x83/0xb0 [ 2780.204584] SyS_ioctl+0x7f/0xb0 [ 2780.208034] ? do_vfs_ioctl+0xff0/0xff0 [ 2780.212008] do_syscall_64+0x1d5/0x640 [ 2780.215890] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2780.221060] RIP: 0033:0x7f252f53e109 [ 2780.225009] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2780.232696] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2780.239950] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2780.247379] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 [ 2780.254644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2780.261910] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 13:11:28 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000080)={{0x6, 0x200}, 0x40}, 0x10) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (fail_nth: 7) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r1}) 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x7fffffffffffffff, 0x8}) 13:11:28 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000000040)={&(0x7f0000000780)=[0x9, 0x20, 0xffffffff, 0xfffffb41, 0x7, 0x9, 0x800, 0x1ff, 0x1, 0x796d, 0x80, 0x7f79, 0x4, 0xbd, 0x8, 0x5, 0xfff, 0x7e0b, 0x80000001, 0x10001, 0xfe4, 0x9, 0x2, 0x4, 0x8000, 0x3, 0x0, 0x9, 0x6, 0x20, 0x7, 0x3, 0x0, 0x7, 0xffffffff, 0x6, 0x7, 0x9, 0x5e3, 0x7, 0x80000001, 0x0, 0xc76, 0x5c4, 0xff, 0x0, 0x8b, 0x7, 0x6, 0x7f, 0x1, 0x5, 0x7f, 0x7, 0x7, 0x8001, 0x81d0, 0x5, 0x3, 0xbc63, 0x9, 0x9, 0x3ff, 0x5, 0x9, 0x1, 0x3f, 0x0, 0x6, 0x68, 0x20, 0x272, 0x0, 0x8, 0x3f, 0x2000, 0x7fff, 0x1000, 0xf4, 0x10001, 0xfffffffa, 0x8001, 0x40, 0x18feab0d, 0x5, 0x7, 0xffffff15, 0x45d0, 0x1ff, 0x2, 0x3f, 0xffffffff, 0xfffffff9, 0x9, 0x9, 0x7c, 0xfff, 0x0, 0x1, 0x7, 0x81, 0x8, 0x6, 0x1, 0x5, 0x3, 0xff, 0x3, 0x5, 0x8, 0x6, 0x9, 0xfa0b, 0x0, 0xf97, 0x299a, 0x0, 0x6, 0x6, 0x7, 0x4, 0x400, 0x1f, 0x800, 0x95, 0xffff, 0x275c, 0x2, 0x2, 0xab, 0x6472, 0x8001, 0x7, 0x7, 0x1000, 0x0, 0xff, 0x3, 0x6e, 0x401, 0x6, 0x5, 0x401, 0x7, 0x0, 0x3, 0x3f, 0x7, 0x0, 0x8, 0x8, 0x5, 0x773, 0x1, 0x0, 0x9, 0x5, 0x4, 0xa7, 0xfffffeff, 0x37, 0x6, 0x7, 0x200, 0x4, 0x1, 0xa6, 0x800, 0x1000, 0xe408, 0x0, 0x0, 0x1, 0x6, 0x5, 0x8, 0x2, 0x5, 0x1000, 0x2, 0x1, 0x6, 0x95, 0x1, 0x80, 0x92, 0x8, 0xca, 0x4a, 0x401, 0x3f, 0x92, 0x0, 0x6, 0xfff, 0x7, 0x3, 0xffff, 0x80, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x6, 0xfffffbff, 0xffffffff, 0x80, 0x2, 0x7, 0x4, 0x9, 0x4, 0x7f, 0xffff, 0x0, 0x9, 0x8, 0x1, 0xffffffff, 0x1f, 0x1, 0x200, 0x4, 0xeac, 0x2, 0x7fffffff, 0x0, 0x80, 0x5, 0xba1, 0x1ff, 0x9, 0x5, 0x2, 0x8, 0x7, 0x10000, 0x80000000, 0x4, 0x7, 0x3, 0x4, 0x953, 0x1, 0x5, 0x8, 0x7, 0xffffffc0, 0x5, 0x2, 0x2, 0x5, 0xcdf, 0x5, 0xffffffff, 0x1f, 0x6, 0x7, 0xfffffffe, 0x0, 0x101, 0x7ff, 0x2, 0x6, 0x0, 0x8, 0x4, 0x7, 0x7, 0x6, 0xfffffff7, 0x9, 0x7f, 0x10000, 0x3f, 0x26d9, 0x9, 0x40, 0x9e, 0x1000, 0x800, 0x8, 0x7f, 0x2, 0x0, 0x87e3, 0x3, 0x4000000, 0x7c7a, 0xb10c, 0xff, 0x5, 0x1, 0x2f, 0x97b, 0x7, 0x3, 0x6, 0x800, 0x1, 0x1, 0x0, 0x7, 0x6, 0x7, 0x80000000, 0x101, 0x5, 0x3f, 0xffff, 0x3, 0x4, 0x2a8e, 0xffff, 0x1000, 0x3, 0x2b, 0x180000, 0x0, 0x10001, 0xfffffe19, 0x7fff, 0x0, 0x733f, 0x0, 0xfe2, 0x2, 0x1, 0x7, 0x5, 0x2, 0xfffffd01, 0x39d, 0x5, 0x8, 0x1, 0x0, 0x4, 0x2, 0xfe, 0x6c6, 0x7fff, 0x9, 0xffff06db, 0x53, 0xffb, 0x100, 0x6, 0x7fff, 0x7fffffff, 0x1, 0x844, 0x0, 0x6, 0xfb, 0x74, 0xffffffff, 0x1, 0x7ff, 0x8, 0x401, 0x9, 0x3, 0x0, 0xd19, 0x6, 0x401, 0x800, 0x9, 0xbea1, 0x4, 0x7, 0x9, 0x1, 0x7fff, 0x5, 0x6, 0x3ff00000, 0x800, 0x7ff, 0x2, 0x1, 0x1, 0x7, 0x34a9, 0x9968, 0x7, 0x3f, 0x3f, 0x5, 0x80000001, 0x1f8, 0x100, 0x9, 0x6, 0x7348, 0x7, 0x4a34, 0x7, 0xfffffffa, 0x7, 0x4, 0x9, 0xb41, 0x7, 0x2, 0x6, 0x101, 0x3, 0xffffffff, 0x1, 0x5, 0xa000, 0x4c6, 0x3, 0x1f, 0x2, 0x7f, 0x8, 0xfffff000, 0x6, 0x6b0, 0x1, 0x2, 0xba, 0x520, 0x7fffffff, 0x3, 0xffff, 0x0, 0x7, 0x78, 0x3cde, 0x3000000, 0x7ff, 0x5, 0x7, 0x6c43, 0x50, 0x9, 0x7, 0x10001, 0x1408, 0x0, 0x7ff, 0x1000, 0x7, 0xc9b3, 0x4, 0x8, 0xe, 0x7f, 0xf6a, 0x7, 0x81, 0x9, 0x1, 0x8001, 0xea, 0x9, 0x20, 0x3, 0x31a1, 0xc92, 0x82c, 0x7, 0x6, 0x1e2, 0x3, 0x18d, 0x80, 0x7, 0x4, 0x1, 0x7fffffff, 0x1000, 0x10000, 0x2, 0x8, 0x9, 0x4, 0x5, 0x1000, 0x9, 0x1, 0x3, 0x6f77, 0x6, 0x7, 0x3, 0x1f, 0x20, 0xc9, 0x4, 0x10000, 0x74b, 0x8000, 0x6, 0x9, 0x6, 0x6, 0xfff, 0x1, 0xffff, 0x8, 0x6, 0xfffff421, 0x3, 0x3, 0x1f, 0x2, 0x7ff, 0x1, 0x1, 0xfffff49e, 0x9ce3, 0x2, 0x4, 0x10001, 0x7ff, 0x9, 0x5, 0x6, 0x676b908, 0x8000, 0x7, 0x2, 0x0, 0x721, 0x3, 0x4c, 0x4, 0x9, 0x5, 0xff, 0x1ff, 0x9, 0x4, 0x8000, 0x6, 0xffffffb4, 0x80, 0x7fff, 0x7bf, 0x1f, 0x2, 0x0, 0x5, 0x0, 0x7, 0x4, 0x6, 0x9, 0x1000, 0x3, 0x1, 0x742a71dc, 0x9c24, 0xcae5, 0x3f, 0xfffffffb, 0x3, 0xffffffff, 0xd44, 0x3, 0x81, 0x9, 0x5, 0x2, 0x4, 0xffffffe0, 0x5, 0x7ff, 0x401, 0x1, 0xdf, 0x3, 0x1ff, 0x47, 0x7f, 0xffffffff, 0x3, 0x1ff, 0x7, 0x3ff, 0x1, 0x9, 0x7f, 0x8, 0xffff, 0x10000, 0xff, 0xfffffec1, 0x0, 0xffff8000, 0x4, 0x7c9, 0x6, 0x8, 0x0, 0x80000001, 0x5, 0x36, 0x4, 0xc67e, 0x0, 0x5, 0x97c, 0x6, 0x100, 0x4, 0x1, 0x36, 0x5, 0x14, 0x4, 0x80, 0x4, 0x5, 0x8001, 0x16b0000, 0x802, 0x401, 0x10000, 0xab, 0x4a, 0x7f, 0x0, 0x2, 0x7fff, 0x9, 0x1, 0x8001, 0xffff, 0x8, 0x5, 0x5f, 0x6, 0xf2, 0x8, 0x8001, 0x3, 0x8000, 0x3, 0x0, 0x6, 0x1, 0x40, 0x1, 0xfffffffc, 0x5, 0x0, 0x1, 0x4, 0x6ba, 0x77, 0x6, 0x3, 0xffff8001, 0x4, 0xbd, 0x6, 0x6, 0xf4, 0xffffffff, 0x3ff, 0xf0c2, 0x3ed, 0x3, 0x2, 0x4, 0x1, 0x7fff, 0xbff, 0x9, 0x7, 0x1, 0x0, 0xffffffff, 0x8, 0x5, 0x9, 0x1, 0x2, 0x2, 0x9, 0x200, 0x8, 0x1, 0x7, 0x9, 0x5c6, 0x10000, 0x20, 0x7, 0x7, 0x1, 0x6, 0x5, 0x7fff, 0x7, 0x3ff, 0x1, 0x23, 0x0, 0x4f, 0x48000000, 0x7, 0x7, 0x0, 0x9, 0xffff, 0x1, 0x7, 0x4, 0x2, 0x0, 0xffff, 0x1, 0x9, 0x2, 0x1, 0x80000001, 0xea, 0x3, 0x5, 0xc9e, 0xfffffff8, 0x401, 0x0, 0xae68, 0x200, 0x6, 0x4, 0xde, 0xfe0a, 0x7fff, 0x9, 0xfffffff9, 0x2, 0x4, 0x7, 0xfffffc00, 0x1, 0x1, 0x5, 0x8, 0x9, 0x9, 0x0, 0x7, 0xffffffe0, 0x1, 0x3f, 0x7, 0x7d, 0xa9, 0x1f, 0x4, 0x0, 0x3, 0x8, 0xd3080000, 0x3, 0x1c, 0x4, 0xef4a, 0x0, 0x2, 0xf1, 0x1, 0x8, 0xfffffffd, 0x8000, 0xffffffff, 0x7, 0x91c, 0x200, 0x6, 0x2, 0x200, 0x8000, 0x3, 0x5, 0x2, 0x7fffffff, 0x7fff, 0x3, 0x6, 0xfffffc00, 0xc0a7, 0x2, 0x0, 0x101, 0x80, 0x1, 0x3dfb, 0x1, 0x1000, 0x0, 0x828c, 0x2000000, 0x40, 0x3, 0x1ff, 0xfff, 0x80000000, 0x903, 0x200, 0x80000001, 0x3ff, 0x3f, 0x3ff, 0x0, 0x2, 0x9b94, 0x1000, 0x7f, 0x67, 0x2, 0x6, 0x806, 0x7c000, 0xfffffc00, 0x4, 0xff, 0xe3d00, 0x0, 0x3, 0x10001, 0x8, 0x0, 0x3, 0x3bd2, 0x23aa, 0x8, 0xc4f, 0x2, 0xe3e, 0x7, 0x7ff, 0x8, 0x1, 0x1ff, 0x1e67fc35, 0x6, 0x2, 0x8, 0x7, 0x9, 0x9, 0x3, 0x80000001, 0x2, 0xfff, 0x80, 0xfffffff7, 0x40, 0x1, 0x3, 0x6, 0x1, 0x8, 0x6, 0x3ff, 0x1f0000, 0x3, 0x80, 0x0, 0x0, 0x4b9, 0x7fff, 0xab96, 0x8, 0x0, 0x5, 0x3, 0x0, 0x80000000, 0x200, 0x3f, 0x1, 0x96, 0x40, 0xfffffff7, 0x200, 0x6e7, 0x1, 0x80000001, 0x2, 0xffffffff, 0x51, 0x0, 0x0, 0x2, 0x5, 0x7f, 0x581b, 0x5, 0x800, 0x101, 0x83b, 0x923, 0x7, 0x8000, 0xffffff00, 0x4, 0x5, 0x1, 0x6, 0xfffffff7, 0x200, 0x2, 0xb0, 0x0, 0x8, 0x0, 0x9, 0xffffff7f, 0xff, 0x7, 0x0, 0x3, 0x5, 0x8000, 0xfff, 0x8, 0xc100, 0x81, 0xff, 0x8, 0x3, 0x7, 0xbf8, 0xd7, 0x3, 0x2, 0x8001, 0x1, 0xffffffff, 0x1, 0xfffeffff, 0x7, 0xfffffffe, 0x81, 0x4, 0x1000, 0x4, 0x8001, 0x3, 0x1, 0x6, 0x257d, 0x4, 0xffff0000, 0x0, 0x8, 0x2, 0xfffffb0a, 0x6ae6fbdb, 0xfcf, 0x97, 0x6, 0x903, 0x9, 0x20, 0x7, 0x2, 0x0, 0x100, 0x5, 0xa3, 0xffff, 0x1, 0x2, 0x7, 0x9, 0x3f, 0xe74, 0x7, 0x7fc0b824, 0xffffffff, 0x8001, 0x198, 0xeb, 0x4, 0x1, 0xb7c8, 0x3f, 0x8000, 0x5, 0x400, 0x96, 0x9, 0x2, 0x0, 0x2, 0x1, 0x7, 0x5, 0x9, 0x40, 0x7ff, 0x800, 0xffff0000, 0x1, 0x3, 0x3, 0x100, 0x10000, 0x7, 0x9, 0x0, 0xfffff73b, 0x4, 0x2, 0x5, 0x1, 0x1000, 0xffffffff, 0x7511, 0x5], 0x1, 0x400, 0xd8}) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x1}) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000140)) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000000100)={&(0x7f0000001780)=[0x5, 0x1, 0x3, 0x1, 0x4, 0xc6, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1000, 0x3, 0xfffffbff, 0x9, 0x200, 0x80, 0xff, 0x7, 0x1, 0xf0dd, 0xffff, 0xea, 0x4, 0xffff, 0xf43, 0xcab, 0x8, 0x0, 0x3, 0x7, 0xfff, 0xc5, 0x2, 0x5, 0x4, 0x90aa, 0x5000, 0x10000, 0xffff3b9a, 0x4, 0x5, 0x1, 0x800, 0x10001, 0x2, 0x5, 0x101, 0xfffffff8, 0x9, 0xfffff001, 0x80000000, 0xff, 0x920, 0x6, 0x5, 0x3b3c, 0x7fff, 0x5, 0x42, 0x9, 0x4, 0x16, 0x7, 0xf787, 0x81, 0x10000, 0x6, 0xfff, 0x418457e, 0x1ff, 0x80000001, 0x8, 0x6, 0x7f, 0x8, 0xb0000000, 0x9b, 0x5, 0x2, 0x0, 0xb01e, 0xfffffff7, 0xfffffffc, 0xffff, 0x7f, 0x7fc0, 0xc, 0x9, 0x3, 0x100, 0x0, 0x8, 0xff, 0xc1, 0xf533588a, 0x0, 0x1f, 0x1, 0x6, 0x1000, 0x7, 0x267, 0x5, 0x3, 0x3, 0x28c, 0x9, 0x0, 0x7, 0x1, 0x7ade, 0xfffffffa, 0x3, 0xff, 0x8, 0xddd, 0x6, 0x2, 0x7ff, 0xfffffffc, 0xe70, 0x5, 0x7fffffff, 0xffff, 0xd6e, 0x8, 0x22, 0x6, 0x237, 0x81, 0x6, 0x9, 0x3, 0xf44, 0x7fff, 0xffffffff, 0x10000, 0xffff, 0x29e7, 0x101, 0x4, 0x8, 0x6, 0x7, 0x9, 0x3, 0x9, 0x0, 0xff, 0x200, 0x7, 0x1, 0x5d, 0xd735, 0x4, 0x5, 0x800, 0x6, 0x0, 0x10000, 0x6, 0x0, 0x3, 0x7, 0x8, 0x3e7, 0x8, 0x3, 0x81, 0x3, 0xfff, 0x6, 0x34, 0x3, 0x351, 0x9, 0xffffffe1, 0x6, 0xcfb, 0x2, 0x4, 0x7, 0x5, 0x0, 0x5, 0x0, 0x3, 0x100, 0xffff8000, 0x401, 0x4, 0x1, 0xb7a7, 0x9b, 0xdd5, 0x7, 0x6, 0x1487, 0x1, 0x3ff, 0x1000, 0xf8, 0x6aa9, 0x10000, 0x80000000, 0x3f, 0x200, 0x5, 0x2060, 0x1, 0x4, 0x3, 0x7, 0x0, 0x1, 0x70, 0x9, 0x7, 0x0, 0x1f, 0x6, 0x579b, 0xfff, 0x0, 0x7c04, 0x7, 0x0, 0xfffffffa, 0xfff, 0x7, 0x2, 0x9efa, 0x100, 0x1000, 0x5, 0x6040, 0x101, 0x2, 0xffffffff, 0x8, 0x0, 0xbb5, 0x2, 0x5, 0x80000000, 0x3, 0x2, 0x7, 0x4, 0x7fff, 0x8a, 0x2, 0x1, 0x1f, 0x9, 0xf54a, 0xfff, 0x100, 0x40, 0x4, 0x20, 0x8, 0x100, 0x344, 0x40, 0xad4f, 0x7, 0xfff, 0x0, 0x2d9b, 0x160, 0xff, 0x8, 0x2c4, 0x3, 0x3, 0x9, 0x8, 0x81, 0x7fff, 0x8d7, 0x7, 0x4, 0x7, 0x5, 0x7f, 0x1, 0x74, 0x8, 0x100, 0x3, 0xa65, 0x3ff, 0x3, 0x2, 0x6, 0x1c0, 0x2, 0x6, 0xfffffffa, 0x4, 0x4, 0x9, 0x0, 0x6, 0x1, 0x2, 0x8, 0x263, 0x5, 0x2, 0x8, 0x2, 0x4e, 0xc02, 0x2, 0x1ff, 0x4, 0xffffffff, 0x8001, 0x5, 0x8, 0x7fff, 0x26, 0x1000, 0x6, 0x674, 0x5, 0xfc, 0x3ff, 0x241392f1, 0xfffffff9, 0xb7, 0x81, 0x1000, 0x4, 0x1, 0x1, 0x30a, 0x8, 0x1, 0x9, 0x7, 0xac51, 0x4, 0x167, 0xfff, 0x80, 0x100, 0x400, 0x5be9, 0x5f25, 0x40, 0x9fb8, 0x1, 0x2, 0x1000, 0x5, 0x5, 0x56b5f136, 0xae64, 0x0, 0x6, 0x6, 0x6, 0x602cb27d, 0xca46, 0x8001, 0xf88, 0x4, 0xfff, 0x1000, 0x5, 0xc8f, 0xd05, 0x20, 0x3eea, 0x9, 0x5, 0x6, 0x3, 0x36, 0x2, 0x6, 0x401, 0x1, 0x7, 0x0, 0x6, 0x7a, 0xfffffffb, 0x20, 0x80000001, 0x3, 0x0, 0x1f, 0x3da3, 0x2f1, 0x7, 0x2, 0x10000, 0x0, 0x9, 0xf4, 0x401, 0x5, 0x5, 0x7, 0x81, 0x9, 0x9, 0x4, 0x1ff, 0x4, 0xffffffff, 0x1, 0x3, 0x2a, 0x2, 0x3, 0xffffffff, 0x1, 0x1, 0x5, 0x4, 0x4, 0x1, 0x6, 0x5, 0x3, 0x3f, 0x1, 0x8001, 0x200, 0xffffffff, 0xffffff81, 0x0, 0x8, 0x5, 0x0, 0xa58, 0x7, 0x1000, 0x5, 0x1ff, 0x5, 0x7fff, 0x1, 0xff, 0xffff, 0x6, 0xc95, 0x3, 0x1ff, 0x8, 0x0, 0x7fff, 0x81, 0x8, 0x3ff, 0xdc89, 0x10000, 0xfffffff7, 0x2, 0x4, 0x10000002, 0x7fff, 0xfffffffa, 0x3ff, 0xc05, 0xd7e, 0xffffffe1, 0x6, 0x5, 0x7, 0x7385, 0x2, 0x2, 0x3d6, 0x401, 0x5, 0x4, 0x0, 0xa4, 0x7, 0x5, 0x0, 0x7f, 0x1050, 0x3f, 0x7fffffff, 0x80000000, 0x2, 0x1, 0x3, 0x2, 0x0, 0x87c, 0x4, 0x0, 0xffffff80, 0x1f, 0x5, 0x4, 0x401, 0x5, 0x7, 0x2, 0x77d, 0xf62, 0x8000, 0x3, 0x0, 0x800, 0x401, 0x3ff, 0xb2, 0x1, 0x6, 0x0, 0x2, 0x78e9, 0x40, 0x3, 0x200, 0x5, 0x0, 0x9, 0xffff, 0x3d8d, 0x0, 0x1, 0xfffffff9, 0x353, 0x8, 0x80000001, 0x0, 0x863, 0x4, 0x0, 0x9, 0x8, 0x5, 0x5, 0x9, 0x10001, 0x3ff, 0x9d, 0x9, 0x200, 0x10001, 0x4, 0x9, 0x4, 0x5, 0x200, 0x4, 0x0, 0x3, 0x3, 0x1, 0x1000, 0x7, 0x6, 0x3, 0x8, 0xff, 0x3, 0x7, 0x7, 0x80000000, 0x2, 0x7fff, 0x3, 0x9, 0x4, 0x5, 0x71, 0x3bc, 0x9, 0x200, 0x6, 0x3f, 0x8, 0x0, 0xffffffe1, 0x2, 0xffffffff, 0x80000001, 0xff, 0x483f, 0x1000, 0x7, 0x4, 0x6, 0x8, 0x40, 0x4ec2, 0x4000000, 0x7f, 0x0, 0x7, 0x9, 0xab12, 0x5, 0xff, 0x9d9e, 0x16, 0x0, 0x1, 0x0, 0xfff, 0x80000000, 0x10000, 0x3, 0x7, 0x8, 0x0, 0xeff, 0x1, 0x64000, 0x6, 0x2, 0x6f27, 0x1, 0x8, 0x80000000, 0xfffffffb, 0x7, 0xcc5, 0x6, 0x9, 0x9, 0x3, 0x5, 0x8001, 0x1000, 0x5, 0x4, 0x9f89, 0x20, 0x1, 0x7fffffff, 0x6, 0x3f, 0x7, 0x0, 0x1ff, 0xf22, 0x2, 0xfffffed7, 0x17, 0x620, 0x2, 0x1, 0x9, 0x3, 0x7d, 0x3ff, 0xffffffff, 0x7, 0x5, 0xe5, 0x592bae59, 0x100, 0x9, 0xffff, 0x4, 0xfff, 0x81, 0x5, 0x6, 0xfff, 0x1ff, 0x1000, 0x9, 0x42c0ec21, 0x8, 0x0, 0x6, 0x20, 0x3, 0x1ff, 0x6, 0x8, 0x200, 0x1, 0x8a8, 0x1ff, 0x2, 0x7, 0x6, 0x3ff, 0x0, 0x6, 0x20, 0xfffffff8, 0x5, 0x0, 0x9, 0xffffff81, 0x7, 0x200, 0x3, 0x1, 0x1000, 0xdc, 0x8888, 0x7fffffff, 0x4, 0xa7, 0x1a, 0x1, 0x3, 0x12, 0x5, 0x3, 0x10001, 0x5, 0x1f, 0x3, 0x0, 0x1f, 0x9, 0xfffffff7, 0x1, 0x9, 0x3, 0x1, 0x800, 0x1f, 0x4d0, 0x4, 0x2, 0x0, 0x3, 0x26e, 0xb7, 0x0, 0x8, 0x1, 0x7, 0x8000, 0x7cdc, 0xfffffffc, 0x9, 0xb775, 0x4a7f, 0x8, 0x81, 0x8, 0x101, 0xc3ea, 0x84, 0x3, 0x3, 0x25f, 0x3, 0x7, 0x1f, 0x8, 0x3c00, 0x2, 0x0, 0xfa1, 0x4, 0x90d9, 0x575, 0x8, 0xfffff801, 0x0, 0x7f, 0x7, 0x1, 0x1, 0x3, 0xfffffff9, 0x8, 0x0, 0x7, 0x0, 0x8, 0x10001, 0xff, 0x2, 0x8, 0x9, 0x97f3, 0x6, 0xffffffff, 0x33, 0x4faf5653, 0x5d0a, 0x4, 0x8000, 0x7f, 0x7, 0x1000, 0x5, 0xf3da, 0x800, 0x6c, 0x1, 0x8001, 0x5, 0x7f, 0x2, 0x1, 0x4d, 0x1, 0xea8a, 0x3, 0x8, 0x3, 0x2, 0x5, 0x9, 0x2, 0x4, 0x80000000, 0x0, 0x4, 0x2, 0x7, 0xb6cd, 0x6, 0x1000, 0x3, 0x7ff, 0x7, 0x77a6ad4e, 0x5, 0x101, 0x2, 0x7f, 0x40, 0x40, 0x7, 0x8001, 0x284, 0x6, 0x9, 0x834, 0x6, 0x7e, 0x1, 0x1ff, 0x81, 0x1, 0xffffffff, 0x7, 0x5, 0x9, 0x1, 0x8fc, 0x1, 0x7ff, 0xc27, 0x43, 0x9, 0x4, 0x7, 0x2, 0x4, 0x9, 0x7f, 0x9, 0x273, 0x8, 0x3ff, 0x5, 0x81, 0x2, 0xcf, 0x10000, 0x8, 0x1, 0x3f, 0xbd, 0x200, 0x80000001, 0x800, 0x40000000, 0xfffffffe, 0x7, 0xe20, 0x5, 0x2, 0x8, 0x1d137441, 0x10001, 0xd2c, 0x3, 0x3ff, 0x2, 0x4, 0x0, 0x3, 0x7, 0x6483, 0x1000, 0x2, 0x2, 0x909, 0x605, 0x2, 0x8001, 0x8cf, 0x2, 0x1, 0x9, 0x4000, 0x400, 0x1, 0x36, 0x3, 0x4, 0x0, 0x9, 0xfffffffb, 0xe1f6, 0xadd, 0x2, 0xde7, 0x7, 0x59, 0xffffff80, 0x1, 0xebf, 0x0, 0x2, 0x1, 0x1, 0x5, 0x5, 0x0, 0x805e, 0x6, 0x4, 0x7, 0x6, 0x6, 0x80000000, 0x1, 0xd21, 0xff, 0x20, 0x9b, 0x40, 0x8a4, 0x800, 0x6, 0x7, 0x0, 0x10001, 0xdc, 0x6, 0x4, 0x100, 0x7fff, 0x5, 0x2, 0x9, 0xff, 0x2, 0x40, 0x1, 0x4, 0x2, 0x7, 0xc193, 0x0, 0x0, 0x1000, 0x2d, 0x9, 0x80000001, 0x9, 0x7ff, 0x3, 0xaa, 0xfffffffc, 0x94ff, 0x100, 0xffffffff, 0xa0b1, 0x4, 0x3, 0x5, 0x5, 0xfff, 0x12a4e29b, 0x100, 0xaf36, 0x1, 0x9, 0xfffffff9, 0x0, 0x0, 0x1000, 0x9, 0x50, 0x3, 0x3, 0x9, 0x800, 0x0, 0xd680, 0x0, 0x9, 0x81, 0x4, 0x3, 0x7ff, 0x1, 0x80000001, 0x6, 0x4, 0x81, 0x9, 0x9, 0x4, 0x1], 0x1, 0x400, 0x7}) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000180)=0xd7540e53b5cf887d, 0x2) getsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f00000001c0), &(0x7f0000000200)=0x4) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000000040)={&(0x7f0000000780)=[0x9, 0x20, 0xffffffff, 0xfffffb41, 0x7, 0x9, 0x800, 0x1ff, 0x1, 0x796d, 0x80, 0x7f79, 0x4, 0xbd, 0x8, 0x5, 0xfff, 0x7e0b, 0x80000001, 0x10001, 0xfe4, 0x9, 0x2, 0x4, 0x8000, 0x3, 0x0, 0x9, 0x6, 0x20, 0x7, 0x3, 0x0, 0x7, 0xffffffff, 0x6, 0x7, 0x9, 0x5e3, 0x7, 0x80000001, 0x0, 0xc76, 0x5c4, 0xff, 0x0, 0x8b, 0x7, 0x6, 0x7f, 0x1, 0x5, 0x7f, 0x7, 0x7, 0x8001, 0x81d0, 0x5, 0x3, 0xbc63, 0x9, 0x9, 0x3ff, 0x5, 0x9, 0x1, 0x3f, 0x0, 0x6, 0x68, 0x20, 0x272, 0x0, 0x8, 0x3f, 0x2000, 0x7fff, 0x1000, 0xf4, 0x10001, 0xfffffffa, 0x8001, 0x40, 0x18feab0d, 0x5, 0x7, 0xffffff15, 0x45d0, 0x1ff, 0x2, 0x3f, 0xffffffff, 0xfffffff9, 0x9, 0x9, 0x7c, 0xfff, 0x0, 0x1, 0x7, 0x81, 0x8, 0x6, 0x1, 0x5, 0x3, 0xff, 0x3, 0x5, 0x8, 0x6, 0x9, 0xfa0b, 0x0, 0xf97, 0x299a, 0x0, 0x6, 0x6, 0x7, 0x4, 0x400, 0x1f, 0x800, 0x95, 0xffff, 0x275c, 0x2, 0x2, 0xab, 0x6472, 0x8001, 0x7, 0x7, 0x1000, 0x0, 0xff, 0x3, 0x6e, 0x401, 0x6, 0x5, 0x401, 0x7, 0x0, 0x3, 0x3f, 0x7, 0x0, 0x8, 0x8, 0x5, 0x773, 0x1, 0x0, 0x9, 0x5, 0x4, 0xa7, 0xfffffeff, 0x37, 0x6, 0x7, 0x200, 0x4, 0x1, 0xa6, 0x800, 0x1000, 0xe408, 0x0, 0x0, 0x1, 0x6, 0x5, 0x8, 0x2, 0x5, 0x1000, 0x2, 0x1, 0x6, 0x95, 0x1, 0x80, 0x92, 0x8, 0xca, 0x4a, 0x401, 0x3f, 0x92, 0x0, 0x6, 0xfff, 0x7, 0x3, 0xffff, 0x80, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x6, 0xfffffbff, 0xffffffff, 0x80, 0x2, 0x7, 0x4, 0x9, 0x4, 0x7f, 0xffff, 0x0, 0x9, 0x8, 0x1, 0xffffffff, 0x1f, 0x1, 0x200, 0x4, 0xeac, 0x2, 0x7fffffff, 0x0, 0x80, 0x5, 0xba1, 0x1ff, 0x9, 0x5, 0x2, 0x8, 0x7, 0x10000, 0x80000000, 0x4, 0x7, 0x3, 0x4, 0x953, 0x1, 0x5, 0x8, 0x7, 0xffffffc0, 0x5, 0x2, 0x2, 0x5, 0xcdf, 0x5, 0xffffffff, 0x1f, 0x6, 0x7, 0xfffffffe, 0x0, 0x101, 0x7ff, 0x2, 0x6, 0x0, 0x8, 0x4, 0x7, 0x7, 0x6, 0xfffffff7, 0x9, 0x7f, 0x10000, 0x3f, 0x26d9, 0x9, 0x40, 0x9e, 0x1000, 0x800, 0x8, 0x7f, 0x2, 0x0, 0x87e3, 0x3, 0x4000000, 0x7c7a, 0xb10c, 0xff, 0x5, 0x1, 0x2f, 0x97b, 0x7, 0x3, 0x6, 0x800, 0x1, 0x1, 0x0, 0x7, 0x6, 0x7, 0x80000000, 0x101, 0x5, 0x3f, 0xffff, 0x3, 0x4, 0x2a8e, 0xffff, 0x1000, 0x3, 0x2b, 0x180000, 0x0, 0x10001, 0xfffffe19, 0x7fff, 0x0, 0x733f, 0x0, 0xfe2, 0x2, 0x1, 0x7, 0x5, 0x2, 0xfffffd01, 0x39d, 0x5, 0x8, 0x1, 0x0, 0x4, 0x2, 0xfe, 0x6c6, 0x7fff, 0x9, 0xffff06db, 0x53, 0xffb, 0x100, 0x6, 0x7fff, 0x7fffffff, 0x1, 0x844, 0x0, 0x6, 0xfb, 0x74, 0xffffffff, 0x1, 0x7ff, 0x8, 0x401, 0x9, 0x3, 0x0, 0xd19, 0x6, 0x401, 0x800, 0x9, 0xbea1, 0x4, 0x7, 0x9, 0x1, 0x7fff, 0x5, 0x6, 0x3ff00000, 0x800, 0x7ff, 0x2, 0x1, 0x1, 0x7, 0x34a9, 0x9968, 0x7, 0x3f, 0x3f, 0x5, 0x80000001, 0x1f8, 0x100, 0x9, 0x6, 0x7348, 0x7, 0x4a34, 0x7, 0xfffffffa, 0x7, 0x4, 0x9, 0xb41, 0x7, 0x2, 0x6, 0x101, 0x3, 0xffffffff, 0x1, 0x5, 0xa000, 0x4c6, 0x3, 0x1f, 0x2, 0x7f, 0x8, 0xfffff000, 0x6, 0x6b0, 0x1, 0x2, 0xba, 0x520, 0x7fffffff, 0x3, 0xffff, 0x0, 0x7, 0x78, 0x3cde, 0x3000000, 0x7ff, 0x5, 0x7, 0x6c43, 0x50, 0x9, 0x7, 0x10001, 0x1408, 0x0, 0x7ff, 0x1000, 0x7, 0xc9b3, 0x4, 0x8, 0xe, 0x7f, 0xf6a, 0x7, 0x81, 0x9, 0x1, 0x8001, 0xea, 0x9, 0x20, 0x3, 0x31a1, 0xc92, 0x82c, 0x7, 0x6, 0x1e2, 0x3, 0x18d, 0x80, 0x7, 0x4, 0x1, 0x7fffffff, 0x1000, 0x10000, 0x2, 0x8, 0x9, 0x4, 0x5, 0x1000, 0x9, 0x1, 0x3, 0x6f77, 0x6, 0x7, 0x3, 0x1f, 0x20, 0xc9, 0x4, 0x10000, 0x74b, 0x8000, 0x6, 0x9, 0x6, 0x6, 0xfff, 0x1, 0xffff, 0x8, 0x6, 0xfffff421, 0x3, 0x3, 0x1f, 0x2, 0x7ff, 0x1, 0x1, 0xfffff49e, 0x9ce3, 0x2, 0x4, 0x10001, 0x7ff, 0x9, 0x5, 0x6, 0x676b908, 0x8000, 0x7, 0x2, 0x0, 0x721, 0x3, 0x4c, 0x4, 0x9, 0x5, 0xff, 0x1ff, 0x9, 0x4, 0x8000, 0x6, 0xffffffb4, 0x80, 0x7fff, 0x7bf, 0x1f, 0x2, 0x0, 0x5, 0x0, 0x7, 0x4, 0x6, 0x9, 0x1000, 0x3, 0x1, 0x742a71dc, 0x9c24, 0xcae5, 0x3f, 0xfffffffb, 0x3, 0xffffffff, 0xd44, 0x3, 0x81, 0x9, 0x5, 0x2, 0x4, 0xffffffe0, 0x5, 0x7ff, 0x401, 0x1, 0xdf, 0x3, 0x1ff, 0x47, 0x7f, 0xffffffff, 0x3, 0x1ff, 0x7, 0x3ff, 0x1, 0x9, 0x7f, 0x8, 0xffff, 0x10000, 0xff, 0xfffffec1, 0x0, 0xffff8000, 0x4, 0x7c9, 0x6, 0x8, 0x0, 0x80000001, 0x5, 0x36, 0x4, 0xc67e, 0x0, 0x5, 0x97c, 0x6, 0x100, 0x4, 0x1, 0x36, 0x5, 0x14, 0x4, 0x80, 0x4, 0x5, 0x8001, 0x16b0000, 0x802, 0x401, 0x10000, 0xab, 0x4a, 0x7f, 0x0, 0x2, 0x7fff, 0x9, 0x1, 0x8001, 0xffff, 0x8, 0x5, 0x5f, 0x6, 0xf2, 0x8, 0x8001, 0x3, 0x8000, 0x3, 0x0, 0x6, 0x1, 0x40, 0x1, 0xfffffffc, 0x5, 0x0, 0x1, 0x4, 0x6ba, 0x77, 0x6, 0x3, 0xffff8001, 0x4, 0xbd, 0x6, 0x6, 0xf4, 0xffffffff, 0x3ff, 0xf0c2, 0x3ed, 0x3, 0x2, 0x4, 0x1, 0x7fff, 0xbff, 0x9, 0x7, 0x1, 0x0, 0xffffffff, 0x8, 0x5, 0x9, 0x1, 0x2, 0x2, 0x9, 0x200, 0x8, 0x1, 0x7, 0x9, 0x5c6, 0x10000, 0x20, 0x7, 0x7, 0x1, 0x6, 0x5, 0x7fff, 0x7, 0x3ff, 0x1, 0x23, 0x0, 0x4f, 0x48000000, 0x7, 0x7, 0x0, 0x9, 0xffff, 0x1, 0x7, 0x4, 0x2, 0x0, 0xffff, 0x1, 0x9, 0x2, 0x1, 0x80000001, 0xea, 0x3, 0x5, 0xc9e, 0xfffffff8, 0x401, 0x0, 0xae68, 0x200, 0x6, 0x4, 0xde, 0xfe0a, 0x7fff, 0x9, 0xfffffff9, 0x2, 0x4, 0x7, 0xfffffc00, 0x1, 0x1, 0x5, 0x8, 0x9, 0x9, 0x0, 0x7, 0xffffffe0, 0x1, 0x3f, 0x7, 0x7d, 0xa9, 0x1f, 0x4, 0x0, 0x3, 0x8, 0xd3080000, 0x3, 0x1c, 0x4, 0xef4a, 0x0, 0x2, 0xf1, 0x1, 0x8, 0xfffffffd, 0x8000, 0xffffffff, 0x7, 0x91c, 0x200, 0x6, 0x2, 0x200, 0x8000, 0x3, 0x5, 0x2, 0x7fffffff, 0x7fff, 0x3, 0x6, 0xfffffc00, 0xc0a7, 0x2, 0x0, 0x101, 0x80, 0x1, 0x3dfb, 0x1, 0x1000, 0x0, 0x828c, 0x2000000, 0x40, 0x3, 0x1ff, 0xfff, 0x80000000, 0x903, 0x200, 0x80000001, 0x3ff, 0x3f, 0x3ff, 0x0, 0x2, 0x9b94, 0x1000, 0x7f, 0x67, 0x2, 0x6, 0x806, 0x7c000, 0xfffffc00, 0x4, 0xff, 0xe3d00, 0x0, 0x3, 0x10001, 0x8, 0x0, 0x3, 0x3bd2, 0x23aa, 0x8, 0xc4f, 0x2, 0xe3e, 0x7, 0x7ff, 0x8, 0x1, 0x1ff, 0x1e67fc35, 0x6, 0x2, 0x8, 0x7, 0x9, 0x9, 0x3, 0x80000001, 0x2, 0xfff, 0x80, 0xfffffff7, 0x40, 0x1, 0x3, 0x6, 0x1, 0x8, 0x6, 0x3ff, 0x1f0000, 0x3, 0x80, 0x0, 0x0, 0x4b9, 0x7fff, 0xab96, 0x8, 0x0, 0x5, 0x3, 0x0, 0x80000000, 0x200, 0x3f, 0x1, 0x96, 0x40, 0xfffffff7, 0x200, 0x6e7, 0x1, 0x80000001, 0x2, 0xffffffff, 0x51, 0x0, 0x0, 0x2, 0x5, 0x7f, 0x581b, 0x5, 0x800, 0x101, 0x83b, 0x923, 0x7, 0x8000, 0xffffff00, 0x4, 0x5, 0x1, 0x6, 0xfffffff7, 0x200, 0x2, 0xb0, 0x0, 0x8, 0x0, 0x9, 0xffffff7f, 0xff, 0x7, 0x0, 0x3, 0x5, 0x8000, 0xfff, 0x8, 0xc100, 0x81, 0xff, 0x8, 0x3, 0x7, 0xbf8, 0xd7, 0x3, 0x2, 0x8001, 0x1, 0xffffffff, 0x1, 0xfffeffff, 0x7, 0xfffffffe, 0x81, 0x4, 0x1000, 0x4, 0x8001, 0x3, 0x1, 0x6, 0x257d, 0x4, 0xffff0000, 0x0, 0x8, 0x2, 0xfffffb0a, 0x6ae6fbdb, 0xfcf, 0x97, 0x6, 0x903, 0x9, 0x20, 0x7, 0x2, 0x0, 0x100, 0x5, 0xa3, 0xffff, 0x1, 0x2, 0x7, 0x9, 0x3f, 0xe74, 0x7, 0x7fc0b824, 0xffffffff, 0x8001, 0x198, 0xeb, 0x4, 0x1, 0xb7c8, 0x3f, 0x8000, 0x5, 0x400, 0x96, 0x9, 0x2, 0x0, 0x2, 0x1, 0x7, 0x5, 0x9, 0x40, 0x7ff, 0x800, 0xffff0000, 0x1, 0x3, 0x3, 0x100, 0x10000, 0x7, 0x9, 0x0, 0xfffff73b, 0x4, 0x2, 0x5, 0x1, 0x1000, 0xffffffff, 0x7511, 0x5], 0x1, 0x400, 0xd8}) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000000)={0x1}) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000140)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000000100)={&(0x7f0000001780)=[0x5, 0x1, 0x3, 0x1, 0x4, 0xc6, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1000, 0x3, 0xfffffbff, 0x9, 0x200, 0x80, 0xff, 0x7, 0x1, 0xf0dd, 0xffff, 0xea, 0x4, 0xffff, 0xf43, 0xcab, 0x8, 0x0, 0x3, 0x7, 0xfff, 0xc5, 0x2, 0x5, 0x4, 0x90aa, 0x5000, 0x10000, 0xffff3b9a, 0x4, 0x5, 0x1, 0x800, 0x10001, 0x2, 0x5, 0x101, 0xfffffff8, 0x9, 0xfffff001, 0x80000000, 0xff, 0x920, 0x6, 0x5, 0x3b3c, 0x7fff, 0x5, 0x42, 0x9, 0x4, 0x16, 0x7, 0xf787, 0x81, 0x10000, 0x6, 0xfff, 0x418457e, 0x1ff, 0x80000001, 0x8, 0x6, 0x7f, 0x8, 0xb0000000, 0x9b, 0x5, 0x2, 0x0, 0xb01e, 0xfffffff7, 0xfffffffc, 0xffff, 0x7f, 0x7fc0, 0xc, 0x9, 0x3, 0x100, 0x0, 0x8, 0xff, 0xc1, 0xf533588a, 0x0, 0x1f, 0x1, 0x6, 0x1000, 0x7, 0x267, 0x5, 0x3, 0x3, 0x28c, 0x9, 0x0, 0x7, 0x1, 0x7ade, 0xfffffffa, 0x3, 0xff, 0x8, 0xddd, 0x6, 0x2, 0x7ff, 0xfffffffc, 0xe70, 0x5, 0x7fffffff, 0xffff, 0xd6e, 0x8, 0x22, 0x6, 0x237, 0x81, 0x6, 0x9, 0x3, 0xf44, 0x7fff, 0xffffffff, 0x10000, 0xffff, 0x29e7, 0x101, 0x4, 0x8, 0x6, 0x7, 0x9, 0x3, 0x9, 0x0, 0xff, 0x200, 0x7, 0x1, 0x5d, 0xd735, 0x4, 0x5, 0x800, 0x6, 0x0, 0x10000, 0x6, 0x0, 0x3, 0x7, 0x8, 0x3e7, 0x8, 0x3, 0x81, 0x3, 0xfff, 0x6, 0x34, 0x3, 0x351, 0x9, 0xffffffe1, 0x6, 0xcfb, 0x2, 0x4, 0x7, 0x5, 0x0, 0x5, 0x0, 0x3, 0x100, 0xffff8000, 0x401, 0x4, 0x1, 0xb7a7, 0x9b, 0xdd5, 0x7, 0x6, 0x1487, 0x1, 0x3ff, 0x1000, 0xf8, 0x6aa9, 0x10000, 0x80000000, 0x3f, 0x200, 0x5, 0x2060, 0x1, 0x4, 0x3, 0x7, 0x0, 0x1, 0x70, 0x9, 0x7, 0x0, 0x1f, 0x6, 0x579b, 0xfff, 0x0, 0x7c04, 0x7, 0x0, 0xfffffffa, 0xfff, 0x7, 0x2, 0x9efa, 0x100, 0x1000, 0x5, 0x6040, 0x101, 0x2, 0xffffffff, 0x8, 0x0, 0xbb5, 0x2, 0x5, 0x80000000, 0x3, 0x2, 0x7, 0x4, 0x7fff, 0x8a, 0x2, 0x1, 0x1f, 0x9, 0xf54a, 0xfff, 0x100, 0x40, 0x4, 0x20, 0x8, 0x100, 0x344, 0x40, 0xad4f, 0x7, 0xfff, 0x0, 0x2d9b, 0x160, 0xff, 0x8, 0x2c4, 0x3, 0x3, 0x9, 0x8, 0x81, 0x7fff, 0x8d7, 0x7, 0x4, 0x7, 0x5, 0x7f, 0x1, 0x74, 0x8, 0x100, 0x3, 0xa65, 0x3ff, 0x3, 0x2, 0x6, 0x1c0, 0x2, 0x6, 0xfffffffa, 0x4, 0x4, 0x9, 0x0, 0x6, 0x1, 0x2, 0x8, 0x263, 0x5, 0x2, 0x8, 0x2, 0x4e, 0xc02, 0x2, 0x1ff, 0x4, 0xffffffff, 0x8001, 0x5, 0x8, 0x7fff, 0x26, 0x1000, 0x6, 0x674, 0x5, 0xfc, 0x3ff, 0x241392f1, 0xfffffff9, 0xb7, 0x81, 0x1000, 0x4, 0x1, 0x1, 0x30a, 0x8, 0x1, 0x9, 0x7, 0xac51, 0x4, 0x167, 0xfff, 0x80, 0x100, 0x400, 0x5be9, 0x5f25, 0x40, 0x9fb8, 0x1, 0x2, 0x1000, 0x5, 0x5, 0x56b5f136, 0xae64, 0x0, 0x6, 0x6, 0x6, 0x602cb27d, 0xca46, 0x8001, 0xf88, 0x4, 0xfff, 0x1000, 0x5, 0xc8f, 0xd05, 0x20, 0x3eea, 0x9, 0x5, 0x6, 0x3, 0x36, 0x2, 0x6, 0x401, 0x1, 0x7, 0x0, 0x6, 0x7a, 0xfffffffb, 0x20, 0x80000001, 0x3, 0x0, 0x1f, 0x3da3, 0x2f1, 0x7, 0x2, 0x10000, 0x0, 0x9, 0xf4, 0x401, 0x5, 0x5, 0x7, 0x81, 0x9, 0x9, 0x4, 0x1ff, 0x4, 0xffffffff, 0x1, 0x3, 0x2a, 0x2, 0x3, 0xffffffff, 0x1, 0x1, 0x5, 0x4, 0x4, 0x1, 0x6, 0x5, 0x3, 0x3f, 0x1, 0x8001, 0x200, 0xffffffff, 0xffffff81, 0x0, 0x8, 0x5, 0x0, 0xa58, 0x7, 0x1000, 0x5, 0x1ff, 0x5, 0x7fff, 0x1, 0xff, 0xffff, 0x6, 0xc95, 0x3, 0x1ff, 0x8, 0x0, 0x7fff, 0x81, 0x8, 0x3ff, 0xdc89, 0x10000, 0xfffffff7, 0x2, 0x4, 0x10000002, 0x7fff, 0xfffffffa, 0x3ff, 0xc05, 0xd7e, 0xffffffe1, 0x6, 0x5, 0x7, 0x7385, 0x2, 0x2, 0x3d6, 0x401, 0x5, 0x4, 0x0, 0xa4, 0x7, 0x5, 0x0, 0x7f, 0x1050, 0x3f, 0x7fffffff, 0x80000000, 0x2, 0x1, 0x3, 0x2, 0x0, 0x87c, 0x4, 0x0, 0xffffff80, 0x1f, 0x5, 0x4, 0x401, 0x5, 0x7, 0x2, 0x77d, 0xf62, 0x8000, 0x3, 0x0, 0x800, 0x401, 0x3ff, 0xb2, 0x1, 0x6, 0x0, 0x2, 0x78e9, 0x40, 0x3, 0x200, 0x5, 0x0, 0x9, 0xffff, 0x3d8d, 0x0, 0x1, 0xfffffff9, 0x353, 0x8, 0x80000001, 0x0, 0x863, 0x4, 0x0, 0x9, 0x8, 0x5, 0x5, 0x9, 0x10001, 0x3ff, 0x9d, 0x9, 0x200, 0x10001, 0x4, 0x9, 0x4, 0x5, 0x200, 0x4, 0x0, 0x3, 0x3, 0x1, 0x1000, 0x7, 0x6, 0x3, 0x8, 0xff, 0x3, 0x7, 0x7, 0x80000000, 0x2, 0x7fff, 0x3, 0x9, 0x4, 0x5, 0x71, 0x3bc, 0x9, 0x200, 0x6, 0x3f, 0x8, 0x0, 0xffffffe1, 0x2, 0xffffffff, 0x80000001, 0xff, 0x483f, 0x1000, 0x7, 0x4, 0x6, 0x8, 0x40, 0x4ec2, 0x4000000, 0x7f, 0x0, 0x7, 0x9, 0xab12, 0x5, 0xff, 0x9d9e, 0x16, 0x0, 0x1, 0x0, 0xfff, 0x80000000, 0x10000, 0x3, 0x7, 0x8, 0x0, 0xeff, 0x1, 0x64000, 0x6, 0x2, 0x6f27, 0x1, 0x8, 0x80000000, 0xfffffffb, 0x7, 0xcc5, 0x6, 0x9, 0x9, 0x3, 0x5, 0x8001, 0x1000, 0x5, 0x4, 0x9f89, 0x20, 0x1, 0x7fffffff, 0x6, 0x3f, 0x7, 0x0, 0x1ff, 0xf22, 0x2, 0xfffffed7, 0x17, 0x620, 0x2, 0x1, 0x9, 0x3, 0x7d, 0x3ff, 0xffffffff, 0x7, 0x5, 0xe5, 0x592bae59, 0x100, 0x9, 0xffff, 0x4, 0xfff, 0x81, 0x5, 0x6, 0xfff, 0x1ff, 0x1000, 0x9, 0x42c0ec21, 0x8, 0x0, 0x6, 0x20, 0x3, 0x1ff, 0x6, 0x8, 0x200, 0x1, 0x8a8, 0x1ff, 0x2, 0x7, 0x6, 0x3ff, 0x0, 0x6, 0x20, 0xfffffff8, 0x5, 0x0, 0x9, 0xffffff81, 0x7, 0x200, 0x3, 0x1, 0x1000, 0xdc, 0x8888, 0x7fffffff, 0x4, 0xa7, 0x1a, 0x1, 0x3, 0x12, 0x5, 0x3, 0x10001, 0x5, 0x1f, 0x3, 0x0, 0x1f, 0x9, 0xfffffff7, 0x1, 0x9, 0x3, 0x1, 0x800, 0x1f, 0x4d0, 0x4, 0x2, 0x0, 0x3, 0x26e, 0xb7, 0x0, 0x8, 0x1, 0x7, 0x8000, 0x7cdc, 0xfffffffc, 0x9, 0xb775, 0x4a7f, 0x8, 0x81, 0x8, 0x101, 0xc3ea, 0x84, 0x3, 0x3, 0x25f, 0x3, 0x7, 0x1f, 0x8, 0x3c00, 0x2, 0x0, 0xfa1, 0x4, 0x90d9, 0x575, 0x8, 0xfffff801, 0x0, 0x7f, 0x7, 0x1, 0x1, 0x3, 0xfffffff9, 0x8, 0x0, 0x7, 0x0, 0x8, 0x10001, 0xff, 0x2, 0x8, 0x9, 0x97f3, 0x6, 0xffffffff, 0x33, 0x4faf5653, 0x5d0a, 0x4, 0x8000, 0x7f, 0x7, 0x1000, 0x5, 0xf3da, 0x800, 0x6c, 0x1, 0x8001, 0x5, 0x7f, 0x2, 0x1, 0x4d, 0x1, 0xea8a, 0x3, 0x8, 0x3, 0x2, 0x5, 0x9, 0x2, 0x4, 0x80000000, 0x0, 0x4, 0x2, 0x7, 0xb6cd, 0x6, 0x1000, 0x3, 0x7ff, 0x7, 0x77a6ad4e, 0x5, 0x101, 0x2, 0x7f, 0x40, 0x40, 0x7, 0x8001, 0x284, 0x6, 0x9, 0x834, 0x6, 0x7e, 0x1, 0x1ff, 0x81, 0x1, 0xffffffff, 0x7, 0x5, 0x9, 0x1, 0x8fc, 0x1, 0x7ff, 0xc27, 0x43, 0x9, 0x4, 0x7, 0x2, 0x4, 0x9, 0x7f, 0x9, 0x273, 0x8, 0x3ff, 0x5, 0x81, 0x2, 0xcf, 0x10000, 0x8, 0x1, 0x3f, 0xbd, 0x200, 0x80000001, 0x800, 0x40000000, 0xfffffffe, 0x7, 0xe20, 0x5, 0x2, 0x8, 0x1d137441, 0x10001, 0xd2c, 0x3, 0x3ff, 0x2, 0x4, 0x0, 0x3, 0x7, 0x6483, 0x1000, 0x2, 0x2, 0x909, 0x605, 0x2, 0x8001, 0x8cf, 0x2, 0x1, 0x9, 0x4000, 0x400, 0x1, 0x36, 0x3, 0x4, 0x0, 0x9, 0xfffffffb, 0xe1f6, 0xadd, 0x2, 0xde7, 0x7, 0x59, 0xffffff80, 0x1, 0xebf, 0x0, 0x2, 0x1, 0x1, 0x5, 0x5, 0x0, 0x805e, 0x6, 0x4, 0x7, 0x6, 0x6, 0x80000000, 0x1, 0xd21, 0xff, 0x20, 0x9b, 0x40, 0x8a4, 0x800, 0x6, 0x7, 0x0, 0x10001, 0xdc, 0x6, 0x4, 0x100, 0x7fff, 0x5, 0x2, 0x9, 0xff, 0x2, 0x40, 0x1, 0x4, 0x2, 0x7, 0xc193, 0x0, 0x0, 0x1000, 0x2d, 0x9, 0x80000001, 0x9, 0x7ff, 0x3, 0xaa, 0xfffffffc, 0x94ff, 0x100, 0xffffffff, 0xa0b1, 0x4, 0x3, 0x5, 0x5, 0xfff, 0x12a4e29b, 0x100, 0xaf36, 0x1, 0x9, 0xfffffff9, 0x0, 0x0, 0x1000, 0x9, 0x50, 0x3, 0x3, 0x9, 0x800, 0x0, 0xd680, 0x0, 0x9, 0x81, 0x4, 0x3, 0x7ff, 0x1, 0x80000001, 0x6, 0x4, 0x81, 0x9, 0x9, 0x4, 0x1], 0x1, 0x400, 0x7}) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000180)=0xd7540e53b5cf887d, 0x2) (async) getsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async) 13:11:28 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r3}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2, 0x0, 0x1}) 13:11:28 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000080)={r9}) 13:11:28 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x6, 0x6, 0x2e0}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x1350, 0xfffffff7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (rerun: 64) 13:11:28 executing program 2: mq_open(&(0x7f0000000200)='(+\\&*!)\n\x00', 0x40, 0x0, &(0x7f0000000240)={0x0, 0x81e, 0x0, 0x8}) 13:11:28 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000001c0)={r1}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r3}) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2, 0x0, 0x1}) 13:11:28 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000005c0), r5) (async) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000001c0)={r7}) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000001c0)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000080)={r9}) 13:11:28 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='9p_protocol_dump\x00'}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000000000), &(0x7f0000000080)=0x4) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x3, 0x5a2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) 13:11:28 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) [ 2780.369506] FAULT_INJECTION: forcing a failure. [ 2780.369506] name failslab, interval 1, probability 0, space 0, times 0 [ 2780.416163] CPU: 0 PID: 30587 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2780.424069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2780.433428] Call Trace: [ 2780.436020] dump_stack+0x1b2/0x281 [ 2780.439654] should_fail.cold+0x10a/0x149 [ 2780.443805] should_failslab+0xd6/0x130 [ 2780.447782] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2780.452455] drm_vma_node_allow+0x4e/0x2e0 [ 2780.456692] drm_gem_handle_create_tail+0x1a1/0x330 [ 2780.461706] ? drm_gem_destroy+0xa0/0xa0 13:11:28 executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) syz_open_dev$dri(&(0x7f00000000c0), 0xffffffffffffffff, 0x200200) (async) pipe2$watch_queue(&(0x7f0000000700), 0x80) (async) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000740), 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) (async) [ 2780.465774] vgem_gem_dumb_create+0xe8/0x260 [ 2780.470186] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2780.475210] ? __drm_printfn_debug+0x70/0x70 [ 2780.479619] drm_ioctl_kernel+0x14c/0x200 [ 2780.483857] drm_ioctl+0x42e/0x890 [ 2780.487410] ? __drm_printfn_debug+0x70/0x70 [ 2780.491816] ? drm_getstats+0x20/0x20 [ 2780.495652] ? fsnotify+0x974/0x11b0 [ 2780.499362] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2780.504285] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2780.509305] ? SyS_write+0x1b7/0x210 [ 2780.513021] ? drm_getstats+0x20/0x20 [ 2780.516843] do_vfs_ioctl+0x75a/0xff0 [ 2780.520639] ? lock_acquire+0x170/0x3f0 [ 2780.524618] ? ioctl_preallocate+0x1a0/0x1a0 [ 2780.529028] ? __fget+0x265/0x3e0 [ 2780.532485] ? do_vfs_ioctl+0xff0/0xff0 [ 2780.536454] ? security_file_ioctl+0x83/0xb0 [ 2780.540846] SyS_ioctl+0x7f/0xb0 [ 2780.544189] ? do_vfs_ioctl+0xff0/0xff0 [ 2780.548164] do_syscall_64+0x1d5/0x640 [ 2780.552031] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2780.557204] RIP: 0033:0x7f252f53e109 [ 2780.561011] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2780.568705] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2780.576302] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2780.583554] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 [ 2780.590829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2780.598085] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 [ 2780.620026] ------------[ cut here ]------------ [ 2780.624797] WARNING: CPU: 0 PID: 30587 at drivers/gpu/drm/drm_gem.c:227 drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.635632] Kernel panic - not syncing: panic_on_warn set ... [ 2780.635632] [ 2780.642998] CPU: 0 PID: 30587 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0 [ 2780.650874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2780.660242] Call Trace: [ 2780.662816] dump_stack+0x1b2/0x281 [ 2780.666424] panic+0x1f9/0x42d [ 2780.669595] ? add_taint.cold+0x16/0x16 [ 2780.673551] ? drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.679433] ? __warn.cold+0x5/0x44 [ 2780.683064] ? drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.688940] __warn.cold+0x20/0x44 [ 2780.692465] ? ist_end_non_atomic+0x10/0x10 [ 2780.696914] ? drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.702799] report_bug+0x208/0x250 [ 2780.706422] do_error_trap+0x195/0x2d0 [ 2780.710299] ? math_error+0x2d0/0x2d0 [ 2780.714083] ? trace_hardirqs_on+0x10/0x10 [ 2780.718307] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2780.723151] invalid_op+0x1b/0x40 [ 2780.726591] RIP: 0010:drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.733066] RSP: 0018:ffff888095d57b08 EFLAGS: 00010246 [ 2780.738426] RAX: 0000000000040000 RBX: ffff888238562200 RCX: ffffc900076e3000 [ 2780.745695] RDX: 0000000000040000 RSI: ffffffff836d2351 RDI: ffff8880ab6a2d40 [ 2780.752947] RBP: ffff8880ab6a2d40 R08: ffffffff8b9c7090 R09: 0000000000000000 [ 2780.760200] R10: 0000000000000000 R11: ffff888099d220c0 R12: ffff8880ab6a2d44 [ 2780.767452] R13: ffff888238562200 R14: ffff8880ab6a2d48 R15: ffff8880ab6a2d58 [ 2780.774722] ? drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.780610] ? drm_gem_object_handle_put_unlocked+0x211/0x280 [ 2780.786475] drm_gem_handle_create_tail+0x2a3/0x330 [ 2780.791484] ? drm_gem_destroy+0xa0/0xa0 [ 2780.795529] vgem_gem_dumb_create+0xe8/0x260 [ 2780.799924] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 2780.804918] ? __drm_printfn_debug+0x70/0x70 [ 2780.809304] drm_ioctl_kernel+0x14c/0x200 [ 2780.813435] drm_ioctl+0x42e/0x890 [ 2780.816963] ? __drm_printfn_debug+0x70/0x70 [ 2780.821359] ? drm_getstats+0x20/0x20 [ 2780.825139] ? fsnotify+0x974/0x11b0 [ 2780.828839] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2780.833835] ? debug_check_no_obj_freed+0x2c0/0x680 [ 2780.838848] ? SyS_write+0x1b7/0x210 [ 2780.842557] ? drm_getstats+0x20/0x20 [ 2780.846352] do_vfs_ioctl+0x75a/0xff0 [ 2780.850137] ? lock_acquire+0x170/0x3f0 [ 2780.854092] ? ioctl_preallocate+0x1a0/0x1a0 [ 2780.858501] ? __fget+0x265/0x3e0 [ 2780.861946] ? do_vfs_ioctl+0xff0/0xff0 [ 2780.865999] ? security_file_ioctl+0x83/0xb0 [ 2780.870481] SyS_ioctl+0x7f/0xb0 [ 2780.873921] ? do_vfs_ioctl+0xff0/0xff0 [ 2780.877884] do_syscall_64+0x1d5/0x640 [ 2780.881762] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2780.886938] RIP: 0033:0x7f252f53e109 [ 2780.890633] RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2780.898323] RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109 [ 2780.905578] RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005 [ 2780.912837] RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000 [ 2780.920084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2780.927338] R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000 [ 2780.934926] Kernel Offset: disabled [ 2780.938545] Rebooting in 86400 seconds..