, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0x0, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:13 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:13 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:13 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:13 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0x0, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:13 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x0, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:13 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:13 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:13 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:13 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0x0, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:13 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x0, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:13 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:13 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0x0, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:14 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:14 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x0, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:14 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:14 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0x0, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:14 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x0, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:14 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:14 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:14 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x0, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:14 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:14 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x0, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:14 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:14 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x0, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:15 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x0, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:15 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x0, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:15 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:15 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x0, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:15 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:15 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x0, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:15 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:15 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x0, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:16 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:16 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x0, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:16 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x0, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x0, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x0, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x0, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x0, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x0, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:16 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:17 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:17 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x0, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:17 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x0, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:17 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:17 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:17 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0xff, 0x0, 0x0, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:17 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x0, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:17 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:17 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x0, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:17 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:17 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0x0, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:17 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:19 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x0, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0x0, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:19 executing program 0: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x0, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:19 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x3, 0x0, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x0, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:19 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x0, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x0, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x0, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:20 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:20 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0x0, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:20 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x3, 0x0, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:20 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:20 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0x0, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:20 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:20 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x0, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:20 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0x0, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3214.565199][T32510] syz-executor.4: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3214.615830][T32510] CPU: 0 PID: 32510 Comm: syz-executor.4 Not tainted 5.9.0-syzkaller #0 [ 3214.624179][T32510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3214.634260][T32510] Call Trace: [ 3214.637550][T32510] dump_stack+0x116/0x15d [ 3214.641885][T32510] warn_alloc+0x105/0x160 [ 3214.646283][T32510] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3214.652293][T32510] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3214.657741][T32510] ? __schedule+0x39b/0x550 [ 3214.662236][T32510] ? get_page_from_freelist+0x168/0x480 [ 3214.667784][T32510] __alloc_pages_nodemask+0x269/0x350 [ 3214.673316][T32510] alloc_pages_current+0x21d/0x310 [ 3214.678420][T32510] ion_page_pool_alloc+0x230/0x260 [ 3214.683547][T32510] ion_system_heap_allocate+0x18a/0x6b0 [ 3214.689262][T32510] ion_ioctl+0x2d2/0x9b0 [ 3214.693534][T32510] ? debug_shrink_set+0xa0/0xa0 [ 3214.698871][T32510] __se_sys_ioctl+0xcb/0x140 [ 3214.703450][T32510] __x64_sys_ioctl+0x3f/0x50 [ 3214.708035][T32510] do_syscall_64+0x39/0x80 [ 3214.712451][T32510] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3214.718416][T32510] RIP: 0033:0x45de59 [ 3214.722308][T32510] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3214.741921][T32510] RSP: 002b:00007fc51da9cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3214.750320][T32510] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3214.758295][T32510] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000003 [ 3214.766280][T32510] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3214.774792][T32510] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3214.782895][T32510] R13: 00007ffc0e4ae2ff R14: 00007fc51da9d9c0 R15: 000000000118bf2c [ 3215.068655][T32510] Mem-Info: [ 3215.075273][T32510] active_anon:2289 inactive_anon:25529 isolated_anon:0 [ 3215.075273][T32510] active_file:4209 inactive_file:7121 isolated_file:0 [ 3215.075273][T32510] unevictable:0 dirty:107 writeback:0 [ 3215.075273][T32510] slab_reclaimable:7750 slab_unreclaimable:19900 [ 3215.075273][T32510] mapped:64049 shmem:9159 pagetables:946 bounce:0 [ 3215.075273][T32510] free:202711 free_pcp:514 free_cma:0 [ 3215.158241][T32510] Node 0 active_anon:9188kB inactive_anon:101784kB active_file:16904kB inactive_file:28452kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:256196kB dirty:436kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 20480kB writeback_tmp:0kB kernel_stack:4208kB all_unreclaimable? no [ 3215.223185][T32510] Node 1 active_anon:0kB inactive_anon:244kB active_file:4kB inactive_file:8kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:48kB all_unreclaimable? yes [ 3215.254540][T32510] Node 0 DMA free:15468kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3215.292261][T32510] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3215.301613][T32510] Node 0 DMA32 free:154664kB min:32820kB low:41024kB high:49228kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4228kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:248kB bounce:0kB free_pcp:320kB local_pcp:160kB free_cma:0kB [ 3215.334958][T32510] lowmem_reserve[]: 0 0 959 959 959 [ 3215.344062][T32510] Node 0 Normal free:15548kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:9240kB inactive_anon:95484kB active_file:16888kB inactive_file:28356kB unevictable:0kB writepending:436kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3296kB bounce:0kB free_pcp:1756kB local_pcp:1160kB free_cma:0kB [ 3215.379935][T32510] lowmem_reserve[]: 0 0 0 0 0 [ 3215.393049][T32510] Node 1 Normal free:626692kB min:48180kB low:59712kB high:71244kB reserved_highatomic:0KB active_anon:0kB inactive_anon:196kB active_file:4kB inactive_file:8kB unevictable:0kB writepending:4kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:84kB bounce:0kB free_pcp:256kB local_pcp:16kB free_cma:0kB [ 3215.427135][T32510] lowmem_reserve[]: 0 0 0 0 0 [ 3215.431871][T32510] Node 0 DMA: 1*4kB (U) 1*8kB (U) 0*16kB 1*32kB (U) 1*64kB (U) 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15468kB [ 3215.454316][T32510] Node 0 DMA32: 26*4kB (M) 22*8kB (UM) 11*16kB (UM) 6*32kB (M) 0*64kB 1*128kB (U) 1*256kB (U) 0*512kB 66*1024kB (U) 26*2048kB (UM) 8*4096kB (UM) = 154632kB [ 3215.473857][T32510] Node 0 Normal: 1079*4kB (ME) 480*8kB (ME) 154*16kB (ME) 74*32kB (ME) 30*64kB (ME) 5*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 15548kB [ 3215.493164][T32510] Node 1 Normal: 37*4kB (UM) 28*8kB (M) 13*16kB (UM) 2*32kB (M) 2*64kB (UM) 2*128kB (UM) 0*256kB 2*512kB (UM) 322*1024kB (U) 58*2048kB (U) 43*4096kB (U) = 626692kB [ 3215.513659][T32510] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3215.527163][T32510] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3215.536600][T32510] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3215.552986][T32510] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3215.566463][T32510] 20077 total pagecache pages [ 3215.574848][T32510] 0 pages in swap cache [ 3215.582572][T32510] Swap cache stats: add 0, delete 0, find 0/0 [ 3215.592428][T32510] Free swap = 0kB [ 3215.596174][T32510] Total swap = 0kB [ 3215.607307][T32510] 2097051 pages RAM [ 3215.611810][T32510] 0 pages HighMem/MovableOnly [ 3215.616516][T32510] 80035 pages reserved [ 3215.627331][T32510] 0 pages cma reserved 04:26:22 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x0, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x0, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:22 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:22 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x42, 0x0, 0x0, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x0, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x0, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x0, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x0, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x101, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x0, @usage=0x6, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:23 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:23 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:24 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:24 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:24 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:24 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:24 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:24 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:24 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:24 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage, 0x0, 0x4, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:24 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:24 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x0, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x0, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:25 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x0, 0xf43a, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x0, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:25 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:25 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x0, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:25 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0x0, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:25 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0x0, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x4, 0x0, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:26 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0x0, 0x8, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x6, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:26 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:26 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:26 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:26 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:27 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x675b, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:27 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x0, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x0, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:28 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:28 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x0, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:28 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x0, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:28 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:28 executing program 0: syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:28 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:28 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:28 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x9, 0x0, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:28 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x0, 0x1, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:28 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:29 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:29 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:29 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x0, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:29 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:29 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:29 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:29 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x0, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:29 executing program 0: syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:29 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x0, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:30 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x0, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:30 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:30 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x0, 0x60, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:30 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0xfffffffffffffff8, 0x0, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:30 executing program 0: syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:30 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:30 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:30 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:32 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:32 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:32 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:32 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x0, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:32 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:32 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:32 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:32 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:32 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:32 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x0, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:32 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:32 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:32 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:32 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:32 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:32 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:32 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x0, 0x3ff}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:32 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:32 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:33 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x0, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:33 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:33 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:33 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:33 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:33 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x0, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:33 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:33 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:33 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x9, 0x0, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:34 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:34 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:34 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:34 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:34 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3228.364633][ T405] warn_alloc: 2 callbacks suppressed [ 3228.364691][ T405] syz-executor.4: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3228.416012][ T405] CPU: 0 PID: 405 Comm: syz-executor.4 Not tainted 5.9.0-syzkaller #0 [ 3228.424262][ T405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3228.434376][ T405] Call Trace: [ 3228.437888][ T405] dump_stack+0x116/0x15d [ 3228.442198][ T405] warn_alloc+0x105/0x160 [ 3228.446527][ T405] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3228.452489][ T405] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3228.457927][ T405] ? get_page_from_freelist+0x168/0x480 [ 3228.463526][ T405] __alloc_pages_nodemask+0x269/0x350 [ 3228.469103][ T405] alloc_pages_current+0x21d/0x310 [ 3228.474200][ T405] ion_page_pool_alloc+0x230/0x260 [ 3228.479289][ T405] ion_system_heap_allocate+0x18a/0x6b0 [ 3228.485185][ T405] ion_ioctl+0x2d2/0x9b0 [ 3228.489409][ T405] ? debug_shrink_set+0xa0/0xa0 [ 3228.494308][ T405] __se_sys_ioctl+0xcb/0x140 [ 3228.498877][ T405] __x64_sys_ioctl+0x3f/0x50 [ 3228.503442][ T405] do_syscall_64+0x39/0x80 [ 3228.507854][ T405] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3228.513722][ T405] RIP: 0033:0x45de59 [ 3228.517597][ T405] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3228.537355][ T405] RSP: 002b:00007fc51da9cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3228.545909][ T405] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3228.553880][ T405] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000003 [ 3228.561829][ T405] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3228.569795][ T405] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3228.577759][ T405] R13: 00007ffc0e4ae2ff R14: 00007fc51da9d9c0 R15: 000000000118bf2c [ 3228.745191][ T405] Mem-Info: [ 3228.751497][ T405] active_anon:2695 inactive_anon:25006 isolated_anon:0 [ 3228.751497][ T405] active_file:689 inactive_file:0 isolated_file:0 [ 3228.751497][ T405] unevictable:0 dirty:85 writeback:0 [ 3228.751497][ T405] slab_reclaimable:7595 slab_unreclaimable:19910 [ 3228.751497][ T405] mapped:56846 shmem:9159 pagetables:959 bounce:0 [ 3228.751497][ T405] free:30174 free_pcp:693 free_cma:0 [ 3228.798466][ T405] Node 0 active_anon:10780kB inactive_anon:100024kB active_file:2596kB inactive_file:188kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:227384kB dirty:340kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 26624kB writeback_tmp:0kB kernel_stack:4224kB all_unreclaimable? no [ 3228.862877][ T405] Node 1 active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:8kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB all_unreclaimable? yes [ 3228.926559][ T405] Node 0 DMA free:15484kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3228.971732][ T405] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3228.981059][ T405] Node 0 DMA32 free:661216kB min:32820kB low:41024kB high:49228kB reserved_highatomic:0KB active_anon:0kB inactive_anon:2048kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:1440kB local_pcp:0kB free_cma:0kB [ 3229.015708][ T405] lowmem_reserve[]: 0 0 959 959 959 [ 3229.023846][ T405] Node 0 Normal free:149888kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10380kB inactive_anon:95880kB active_file:2064kB inactive_file:1440kB unevictable:0kB writepending:340kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3704kB bounce:0kB free_pcp:2184kB local_pcp:1196kB free_cma:0kB [ 3229.057423][ T405] lowmem_reserve[]: 0 0 0 0 0 [ 3229.062240][ T405] Node 1 Normal free:117456kB min:48180kB low:59712kB high:71244kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:8kB unevictable:0kB writepending:0kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:4kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3229.098259][ T405] lowmem_reserve[]: 0 0 0 0 0 [ 3229.103020][ T405] Node 0 DMA: 3*4kB (U) 2*8kB (U) 0*16kB 1*32kB (U) 1*64kB (U) 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15484kB [ 3229.118849][ T405] Node 0 DMA32: 2560*4kB (U) 848*8kB (UM) 368*16kB (U) 117*32kB (UM) 1693*64kB (UM) 639*128kB (UM) 359*256kB (UM) 157*512kB (U) 317*1024kB (U) 93*2048kB (UM) 3*4096kB (UM) = 916448kB [ 3229.140738][ T405] Node 0 Normal: 1001*4kB (UME) 312*8kB (UME) 289*16kB (UME) 133*32kB (UME) 944*64kB (UM) 223*128kB (UM) 83*256kB (UM) 21*512kB (UM) 4*1024kB (UM) 4*2048kB (UM) 0*4096kB = 148628kB [ 3229.162858][ T405] Node 1 Normal: 30*4kB (UM) 27*8kB (UM) 21*16kB (UM) 11*32kB (UM) 581*64kB (UM) 74*128kB (UM) 33*256kB (UM) 12*512kB (UM) 36*1024kB (U) 5*2048kB (U) 2*4096kB (U) = 117568kB [ 3229.183560][ T405] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3229.194259][ T405] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3229.210009][ T405] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3229.236608][ T405] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3229.252155][ T405] 10840 total pagecache pages [ 3229.260501][ T405] 0 pages in swap cache [ 3229.264724][ T405] Swap cache stats: add 0, delete 0, find 0/0 [ 3229.273869][ T405] Free swap = 0kB [ 3229.279800][ T405] Total swap = 0kB [ 3229.285788][ T405] 2097051 pages RAM [ 3229.292258][ T405] 0 pages HighMem/MovableOnly [ 3229.297101][ T405] 80035 pages reserved [ 3229.302174][ T405] 0 pages cma reserved 04:26:35 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:35 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:35 executing program 5: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:35 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:35 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:35 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x0, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x0, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x0, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x0, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:36 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x0, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 4: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:36 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:36 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x0, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 4: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x0, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x6]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x0, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x0, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x0, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:37 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x0, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x0, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x0, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:37 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:38 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:38 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x0, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x1000, 0x0, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:38 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x0, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x0, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:38 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0xfff, 0x0, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:38 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:39 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x0, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:39 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0x0, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x0, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:39 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:39 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x0, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:39 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0x0, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x80000001, 0x0, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:39 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:40 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:40 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:40 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x0, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:40 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:40 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:41 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:41 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x0, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:41 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x0, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:41 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:41 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:41 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:42 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:42 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x0, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:42 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:42 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x0, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:42 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:42 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x0, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:42 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:43 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x0, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x0, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:43 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:43 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:43 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x0, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x5, 0x1, 0x2, 0x5, 0x5, 0x4, 0x8, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:26:43 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x70bd27, 0x0, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:43 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:43 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x0, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:43 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x0, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:26:43 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:43 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:43 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x3) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:43 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x0, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:44 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:44 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage, 0x0, 0x3ff, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:44 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x9, 0x0, 0x0, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:44 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:44 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x0, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:44 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:26:44 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x0, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:44 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:44 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:44 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x0, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x7, 0x0, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x0, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x0, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x0, 0x9d6d, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:45 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:45 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x0, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:45 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x3, 0x0, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3239.548799][ T698] warn_alloc: 3 callbacks suppressed [ 3239.548819][ T698] syz-executor.0: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3239.622091][ T698] CPU: 1 PID: 698 Comm: syz-executor.0 Not tainted 5.9.0-syzkaller #0 [ 3239.630388][ T698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3239.640510][ T698] Call Trace: [ 3239.643800][ T698] dump_stack+0x116/0x15d [ 3239.648119][ T698] warn_alloc+0x105/0x160 [ 3239.652458][ T698] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3239.658431][ T698] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3239.663825][ T698] ? get_page_from_freelist+0x168/0x480 [ 3239.669361][ T698] __alloc_pages_nodemask+0x269/0x350 [ 3239.674897][ T698] alloc_pages_current+0x21d/0x310 [ 3239.680047][ T698] ion_page_pool_alloc+0x230/0x260 [ 3239.685163][ T698] ion_system_heap_allocate+0x18a/0x6b0 [ 3239.690900][ T698] ion_ioctl+0x2d2/0x9b0 [ 3239.695321][ T698] ? debug_shrink_set+0xa0/0xa0 [ 3239.700258][ T698] __se_sys_ioctl+0xcb/0x140 [ 3239.704876][ T698] __x64_sys_ioctl+0x3f/0x50 [ 3239.709456][ T698] do_syscall_64+0x39/0x80 [ 3239.713872][ T698] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3239.720031][ T698] RIP: 0033:0x45de59 [ 3239.723924][ T698] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3239.743605][ T698] RSP: 002b:00007ff378d23c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3239.752102][ T698] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3239.760093][ T698] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000003 04:26:46 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3239.768060][ T698] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3239.776292][ T698] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3239.784435][ T698] R13: 00007ffdca28396f R14: 00007ff378d249c0 R15: 000000000118bf2c [ 3240.150027][ T698] Mem-Info: [ 3240.157729][ T698] active_anon:2706 inactive_anon:25495 isolated_anon:0 [ 3240.157729][ T698] active_file:1490 inactive_file:1265 isolated_file:32 [ 3240.157729][ T698] unevictable:0 dirty:104 writeback:0 [ 3240.157729][ T698] slab_reclaimable:7577 slab_unreclaimable:19898 [ 3240.157729][ T698] mapped:58546 shmem:9159 pagetables:981 bounce:0 [ 3240.157729][ T698] free:515412 free_pcp:1125 free_cma:0 [ 3240.239999][ T698] Node 0 active_anon:10824kB inactive_anon:101960kB active_file:5552kB inactive_file:5168kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:233980kB dirty:420kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 26624kB writeback_tmp:0kB kernel_stack:4224kB all_unreclaimable? no [ 3240.305150][ T698] Node 1 active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:8kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB all_unreclaimable? yes [ 3240.363026][ T698] Node 0 DMA free:15520kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3240.421290][ T698] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3240.434117][ T698] Node 0 DMA32 free:44876kB min:32820kB low:41024kB high:49228kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4104kB active_file:256kB inactive_file:184kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:1524kB local_pcp:1444kB free_cma:0kB [ 3240.487812][ T698] lowmem_reserve[]: 0 0 959 959 959 [ 3240.493096][ T698] Node 0 Normal free:33928kB min:15076kB low:17820kB high:20564kB reserved_highatomic:0KB active_anon:10824kB inactive_anon:95740kB active_file:5908kB inactive_file:4372kB unevictable:0kB writepending:420kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3624kB bounce:0kB free_pcp:2476kB local_pcp:1372kB free_cma:0kB [ 3240.539630][ T698] lowmem_reserve[]: 0 0 0 0 0 [ 3240.551940][ T698] Node 1 Normal free:1246928kB min:48180kB low:59712kB high:71244kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:8kB unevictable:0kB writepending:0kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:4kB bounce:0kB free_pcp:436kB local_pcp:188kB free_cma:0kB [ 3240.585488][ T698] lowmem_reserve[]: 0 0 0 0 0 [ 3240.595431][ T698] Node 0 DMA: 2*4kB (U) 1*8kB (U) 1*16kB (U) 0*32kB 0*64kB 1*128kB (U) 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15520kB [ 3240.609800][ T698] Node 0 DMA32: 1027*4kB (UM) 208*8kB (UM) 148*16kB (UM) 136*32kB (UM) 0*64kB 1*128kB (U) 0*256kB 55*512kB (U) 0*1024kB 3*2048kB (M) 0*4096kB = 46924kB [ 3240.628264][ T698] Node 0 Normal: 2818*4kB (UME) 1433*8kB (UME) 421*16kB (UME) 116*32kB (UME) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 33184kB [ 3240.643531][ T698] Node 1 Normal: 2*4kB (M) 1*8kB (M) 2*16kB (M) 3*32kB (UM) 2*64kB (UM) 1*128kB (M) 1*256kB (M) 2*512kB (M) 0*1024kB 156*2048kB (U) 226*4096kB (U) = 1246864kB [ 3240.662674][ T698] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3240.672509][ T698] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3240.684841][ T698] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3240.694880][ T698] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3240.707485][ T698] 11842 total pagecache pages [ 3240.712244][ T698] 0 pages in swap cache [ 3240.716574][ T698] Swap cache stats: add 0, delete 0, find 0/0 [ 3240.723584][ T698] Free swap = 0kB [ 3240.729827][ T698] Total swap = 0kB [ 3240.733538][ T698] 2097051 pages RAM [ 3240.739080][ T698] 0 pages HighMem/MovableOnly [ 3240.743754][ T698] 80035 pages reserved [ 3240.751034][ T698] 0 pages cma reserved 04:26:48 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:48 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:48 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x0, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:48 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:48 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:48 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:48 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0x0, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:48 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x0, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:49 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0x0, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:49 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:49 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:49 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x0, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:49 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:49 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:49 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0x0, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:49 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:50 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:50 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x0, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:50 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:50 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x0, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:51 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:51 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:51 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x0, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:51 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:52 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:52 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x0, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:52 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:52 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x0, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x0, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x0, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:52 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:53 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:53 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x0, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:53 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x0, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 4: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:54 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:54 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x0, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:54 executing program 4: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:54 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x0, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x0, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x0, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x0, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:54 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x0, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x0, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:55 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:26:55 executing program 4: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:55 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x0, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:55 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x0, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:56 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0x0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:56 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:56 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x0, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:56 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0x0, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:56 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0x0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:56 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0x0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:56 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:57 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:57 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0x0, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:57 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:57 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:57 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x0, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:57 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:58 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0x0, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:58 executing program 5: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:58 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:58 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x0, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:58 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:58 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x0, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3252.627331][ T935] warn_alloc: 7 callbacks suppressed [ 3252.627349][ T935] syz-executor.5: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3252.652961][ T935] CPU: 0 PID: 935 Comm: syz-executor.5 Not tainted 5.9.0-syzkaller #0 [ 3252.661209][ T935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3252.671263][ T935] Call Trace: [ 3252.674642][ T935] dump_stack+0x116/0x15d [ 3252.679019][ T935] warn_alloc+0x105/0x160 [ 3252.683407][ T935] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3252.689493][ T935] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3252.695512][ T935] ? get_page_from_freelist+0x168/0x480 [ 3252.701947][ T935] __alloc_pages_nodemask+0x269/0x350 [ 3252.707792][ T935] alloc_pages_current+0x21d/0x310 [ 3252.714670][ T935] ion_page_pool_alloc+0x230/0x260 [ 3252.720056][ T935] ion_system_heap_allocate+0x18a/0x6b0 [ 3252.725638][ T935] ion_ioctl+0x2d2/0x9b0 [ 3252.729897][ T935] ? debug_shrink_set+0xa0/0xa0 [ 3252.734985][ T935] __se_sys_ioctl+0xcb/0x140 [ 3252.739615][ T935] __x64_sys_ioctl+0x3f/0x50 [ 3252.744214][ T935] do_syscall_64+0x39/0x80 [ 3252.749881][ T935] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3252.756542][ T935] RIP: 0033:0x45de59 [ 3252.760431][ T935] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3252.780386][ T935] RSP: 002b:00007fe47d626c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3252.789257][ T935] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3252.797248][ T935] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000003 [ 3252.805508][ T935] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3252.814811][ T935] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3252.822977][ T935] R13: 00007ffd37fe73df R14: 00007fe47d6279c0 R15: 000000000118bf2c [ 3252.849511][ T935] Mem-Info: [ 3252.855398][ T935] active_anon:2706 inactive_anon:23951 isolated_anon:0 [ 3252.855398][ T935] active_file:1230 inactive_file:2561 isolated_file:0 [ 3252.855398][ T935] unevictable:0 dirty:88 writeback:0 [ 3252.855398][ T935] slab_reclaimable:7563 slab_unreclaimable:19906 [ 3252.855398][ T935] mapped:58993 shmem:9159 pagetables:931 bounce:0 [ 3252.855398][ T935] free:35400 free_pcp:724 free_cma:0 [ 3252.901727][ T935] Node 0 active_anon:10824kB inactive_anon:95804kB active_file:4896kB inactive_file:10188kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:235948kB dirty:352kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 20480kB writeback_tmp:0kB kernel_stack:4240kB all_unreclaimable? no [ 3252.974392][ T935] Node 1 active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:56kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:24kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB all_unreclaimable? yes [ 3253.004248][ T935] Node 0 DMA free:15528kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:20kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3253.043015][ T935] lowmem_reserve[]: 0 2868 3827 3827 3827 04:26:59 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:26:59 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x0, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:59 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x0, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:26:59 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3253.055086][ T935] Node 0 DMA32 free:58600kB min:32820kB low:41024kB high:49228kB reserved_highatomic:0KB active_anon:0kB inactive_anon:16kB active_file:0kB inactive_file:100kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:4kB bounce:0kB free_pcp:1412kB local_pcp:0kB free_cma:0kB [ 3253.131185][ T935] lowmem_reserve[]: 0 0 959 959 959 04:26:59 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x0, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3253.160600][ T935] Node 0 Normal free:98556kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10824kB inactive_anon:97812kB active_file:4984kB inactive_file:10280kB unevictable:0kB writepending:352kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3928kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 04:26:59 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x0, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3253.271334][ T935] lowmem_reserve[]: 0 0 0 0 0 [ 3253.305167][ T935] Node 1 Normal free:1241256kB min:46132kB low:57664kB high:69196kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:56kB unevictable:0kB writepending:0kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:4kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 04:26:59 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x0, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3253.408859][ T935] lowmem_reserve[]: 0 0 0 0 0 [ 3253.429847][ T935] Node 0 DMA: 3*4kB (UM) 1*8kB (U) 2*16kB (UM) 2*32kB (UM) 3*64kB (UM) 1*128kB (M) 1*256kB (M) 1*512kB (M) 2*1024kB (UM) 0*2048kB 3*4096kB (M) = 15540kB [ 3253.452616][ T935] Node 0 DMA32: 7277*4kB (UM) 604*8kB (UM) 640*16kB (UM) 441*32kB (U) 381*64kB (UM) 410*128kB (UM) 228*256kB (UM) 139*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 264692kB [ 3253.475668][ T935] Node 0 Normal: 854*4kB (UE) 225*8kB (UE) 480*16kB (UE) 242*32kB (UE) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20640kB [ 3253.496437][ T935] Node 1 Normal: 1192*4kB (UM) 169*8kB (UM) 90*16kB (UM) 41*32kB (UM) 2634*64kB (UM) 221*128kB (UM) 81*256kB (U) 28*512kB (UM) 0*1024kB 207*2048kB (U) 74*4096kB (U) = 967848kB [ 3253.534390][ T935] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3253.548856][ T935] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3253.565200][ T935] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3253.578501][ T935] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3253.592344][ T935] 13050 total pagecache pages [ 3253.607737][ T935] 0 pages in swap cache [ 3253.621558][ T935] Swap cache stats: add 0, delete 0, find 0/0 [ 3253.632982][ T935] Free swap = 0kB [ 3253.645563][ T935] Total swap = 0kB [ 3253.649338][ T935] 2097051 pages RAM [ 3253.653191][ T935] 0 pages HighMem/MovableOnly [ 3253.668303][ T935] 80035 pages reserved [ 3253.676116][ T935] 0 pages cma reserved 04:27:01 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:01 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x0, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x0, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:01 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:01 executing program 0: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x0, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x0, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 0: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x0, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x0, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0x0, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:01 executing program 0: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x0, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0x0, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0x0, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:02 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0x0, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0x0, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x0, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0x0, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:02 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:02 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x0, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:03 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:03 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:03 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x0, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:03 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:03 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x0, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:03 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:03 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:04 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0x0, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:04 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x0, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:04 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, 0x0) 04:27:04 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, 0x0) 04:27:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0x0, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:06 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:06 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, 0x0) 04:27:06 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x0, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:06 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:06 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0x0, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:06 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:06 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:27:06 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0x0, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:06 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x0, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:06 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:27:06 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:27:06 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0x0, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:07 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:07 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x0, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:07 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:27:07 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0x0, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:07 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:07 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:07 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:07 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:27:07 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:07 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:07 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x0, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:07 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x0, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:07 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:27:07 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:07 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:07 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:07 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:09 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x0, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:09 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:09 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:09 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:09 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:09 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x0, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:10 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x0, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:10 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x0, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:10 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x0, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:10 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x0, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:10 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x0, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:10 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x0, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3264.308143][ T1162] warn_alloc: 6 callbacks suppressed [ 3264.308222][ T1162] syz-executor.5: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3264.355447][ T1162] CPU: 0 PID: 1162 Comm: syz-executor.5 Not tainted 5.9.0-syzkaller #0 [ 3264.363741][ T1162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3264.373788][ T1162] Call Trace: [ 3264.377077][ T1162] dump_stack+0x116/0x15d [ 3264.381525][ T1162] warn_alloc+0x105/0x160 [ 3264.385861][ T1162] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3264.391835][ T1162] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3264.397204][ T1162] ? get_page_from_freelist+0x168/0x480 [ 3264.402785][ T1162] __alloc_pages_nodemask+0x269/0x350 [ 3264.408214][ T1162] alloc_pages_current+0x21d/0x310 [ 3264.413421][ T1162] ion_page_pool_alloc+0x230/0x260 [ 3264.418689][ T1162] ion_system_heap_allocate+0x18a/0x6b0 [ 3264.424662][ T1162] ion_ioctl+0x2d2/0x9b0 [ 3264.428897][ T1162] ? debug_shrink_set+0xa0/0xa0 [ 3264.433864][ T1162] __se_sys_ioctl+0xcb/0x140 [ 3264.438531][ T1162] __x64_sys_ioctl+0x3f/0x50 [ 3264.443205][ T1162] do_syscall_64+0x39/0x80 [ 3264.447632][ T1162] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3264.453542][ T1162] RIP: 0033:0x45de59 [ 3264.457460][ T1162] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 04:27:10 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x0, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3264.477667][ T1162] RSP: 002b:00007fe47d626c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3264.486080][ T1162] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3264.494043][ T1162] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000003 [ 3264.502092][ T1162] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3264.510204][ T1162] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3264.518189][ T1162] R13: 00007ffd37fe73df R14: 00007fe47d6279c0 R15: 000000000118bf2c [ 3264.715488][ T1162] Mem-Info: [ 3264.718836][ T1162] active_anon:2706 inactive_anon:24503 isolated_anon:0 [ 3264.718836][ T1162] active_file:1636 inactive_file:2200 isolated_file:0 [ 3264.718836][ T1162] unevictable:0 dirty:104 writeback:0 [ 3264.718836][ T1162] slab_reclaimable:7533 slab_unreclaimable:19884 [ 3264.718836][ T1162] mapped:59145 shmem:9159 pagetables:956 bounce:0 [ 3264.718836][ T1162] free:67724 free_pcp:387 free_cma:0 [ 3264.787576][ T1162] Node 0 active_anon:10824kB inactive_anon:98012kB active_file:6520kB inactive_file:8720kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:237056kB dirty:416kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 22528kB writeback_tmp:0kB kernel_stack:4256kB all_unreclaimable? no [ 3264.828688][ T1162] Node 1 active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:80kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:24kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB all_unreclaimable? yes [ 3264.859752][ T1162] Node 0 DMA free:15564kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3264.892359][ T1162] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3264.902184][ T1162] Node 0 DMA32 free:196620kB min:32820kB low:41024kB high:49228kB reserved_highatomic:0KB active_anon:0kB inactive_anon:96kB active_file:0kB inactive_file:220kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:192kB bounce:0kB free_pcp:348kB local_pcp:348kB free_cma:0kB [ 3264.978781][ T1162] lowmem_reserve[]: 0 0 959 959 959 [ 3264.991079][ T1162] Node 0 Normal free:14360kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10824kB inactive_anon:95900kB active_file:6548kB inactive_file:8596kB unevictable:0kB writepending:416kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3756kB bounce:0kB free_pcp:1192kB local_pcp:640kB free_cma:0kB [ 3265.045747][ T1162] lowmem_reserve[]: 0 0 0 0 0 [ 3265.050613][ T1162] Node 1 Normal free:46092kB min:46132kB low:57664kB high:69196kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:80kB unevictable:0kB writepending:0kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:4kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3265.087945][ T1162] lowmem_reserve[]: 0 0 0 0 0 [ 3265.092764][ T1162] Node 0 DMA: 5*4kB (UM) 5*8kB (UM) 3*16kB (UM) 1*32kB (M) 1*64kB (M) 2*128kB (UM) 1*256kB (M) 1*512kB (M) 2*1024kB (UM) 0*2048kB 3*4096kB (M) = 15564kB [ 3265.116709][ T1162] Node 0 DMA32: 16507*4kB (UM) 5810*8kB (U) 2679*16kB (U) 1167*32kB (U) 29*64kB (U) 0*128kB 0*256kB 0*512kB 0*1024kB 1*2048kB (M) 0*4096kB = 196620kB 04:27:11 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3265.136256][ T1162] Node 0 Normal: 1460*4kB (UME) 843*8kB (UE) 71*16kB (UE) 20*32kB (UE) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14360kB [ 3265.155012][ T1162] Node 1 Normal: 1438*4kB (UM) 596*8kB (UM) 251*16kB (UM) 120*32kB (UM) 2*64kB (UM) 2*128kB (UM) 1*256kB (U) 53*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 46152kB [ 3265.183384][ T1162] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3265.196299][ T1162] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3265.205676][ T1162] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3265.217394][ T1162] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3265.229012][ T1162] 13028 total pagecache pages [ 3265.235520][ T1162] 0 pages in swap cache [ 3265.241223][ T1162] Swap cache stats: add 0, delete 0, find 0/0 [ 3265.247838][ T1162] Free swap = 0kB [ 3265.264110][ T1162] Total swap = 0kB [ 3265.268118][ T1162] 2097051 pages RAM [ 3265.271926][ T1162] 0 pages HighMem/MovableOnly [ 3265.285317][ T1162] 80035 pages reserved [ 3265.293247][ T1162] 0 pages cma reserved 04:27:12 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x0, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:12 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:12 executing program 0: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:12 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:12 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:12 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:12 executing program 0: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:12 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x0, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:12 executing program 0: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:12 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:13 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:13 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:13 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:13 executing program 5: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:13 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:13 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:13 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:14 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:14 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:14 executing program 5: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:14 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:14 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:14 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x0, 0x63032, 0xffffffffffffffff, 0x0) 04:27:14 executing program 5: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:14 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x0, 0x63032, 0xffffffffffffffff, 0x0) 04:27:14 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:14 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x0, 0x63032, 0xffffffffffffffff, 0x0) 04:27:14 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:14 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x0, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:15 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:15 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:15 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x10, 0xffffffffffffffff, 0x0) 04:27:15 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:15 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x0, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:15 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x10, 0xffffffffffffffff, 0x0) 04:27:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1}) 04:27:15 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:15 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x10, 0xffffffffffffffff, 0x0) 04:27:15 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x0, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:15 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1}) 04:27:16 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:16 executing program 2: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:16 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x0, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1}) 04:27:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x0, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:16 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000}) 04:27:16 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x0, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 04:27:16 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x0, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:16 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000}) 04:27:16 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x0, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:27:16 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:16 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:27:16 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000}) 04:27:16 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x0, 0x1, 0x1}) 04:27:16 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x0, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:16 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:17 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:27:17 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:17 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x0, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:17 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:27:17 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:17 executing program 2: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:17 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x0, 0x1}) 04:27:17 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:17 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x0, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:18 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:18 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:18 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x0, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:18 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x0, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:18 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:18 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x0, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:18 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:18 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x0, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x0, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:19 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:19 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x0, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0x0, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:19 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:19 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0x0, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:19 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:20 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0x0, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:20 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x0, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:20 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x0, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:20 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x0, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:20 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:22 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:22 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:22 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:22 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:22 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r0, 0x0, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0x0, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:22 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x0, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0x0, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:22 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x0, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0x0, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:22 executing program 5: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x9, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x0, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:22 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x0, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 3: r0 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x38c, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0xfffffffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000500)={0x8000, 0x1, 0x3}) syz_io_uring_submit(r1, 0x0, 0x0, 0xff) r3 = syz_open_dev$vcsu(&(0x7f0000000440)='/dev/vcsu#\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r5, r6, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r7, r8+10000000}, 0x1, 0x1, 0x1}, 0x8001) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000000d80)={0x4, 0x0, {0x0, @usage=0x100000001, 0x0, 0x8, 0xef, 0x724, 0x5, 0x6, 0x0, @struct={0x40, 0x9078}, 0x7225, 0x1ff, [0x2, 0xc76, 0x40, 0x6, 0x2, 0x1]}, {0x80000001, @usage=0x6, 0x0, 0x4, 0xf43a, 0x0, 0x8, 0x1, 0x0, @struct={0x7}, 0x9, 0x0, [0x401, 0x0, 0xfff, 0x1000, 0x6, 0x4]}, {0x400, @usage=0xfffffffffffffffd, 0x0, 0x3ff, 0x0, 0xa255, 0x2, 0x7, 0x2a, @struct={0x9, 0x200}, 0x0, 0xd0, [0xa000000000, 0x0, 0xac, 0x7f, 0x38ab, 0x2]}, {0x7f, 0x7fff, 0x3ff}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1}) 04:27:23 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x0, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x0, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:23 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x0, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x0, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x0, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x5, 0x2, 0x42, 0xb50a, 0x7e, 0x8001, 0x100000000, 0x0, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x0, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:23 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3277.904885][ T1482] warn_alloc: 10 callbacks suppressed [ 3277.904899][ T1482] syz-executor.5: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3277.941412][ T1482] CPU: 0 PID: 1482 Comm: syz-executor.5 Not tainted 5.9.0-syzkaller #0 [ 3277.949917][ T1482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3277.961113][ T1482] Call Trace: [ 3277.964408][ T1482] dump_stack+0x116/0x15d [ 3277.968834][ T1482] warn_alloc+0x105/0x160 [ 3277.973163][ T1482] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3277.979237][ T1482] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3277.984755][ T1482] ? get_page_from_freelist+0x168/0x480 [ 3277.991646][ T1482] __alloc_pages_nodemask+0x269/0x350 [ 3277.998448][ T1482] alloc_pages_current+0x21d/0x310 [ 3278.003721][ T1482] ion_page_pool_alloc+0x230/0x260 [ 3278.008962][ T1482] ion_system_heap_allocate+0x18a/0x6b0 [ 3278.015746][ T1482] ion_ioctl+0x2d2/0x9b0 [ 3278.019998][ T1482] ? debug_shrink_set+0xa0/0xa0 [ 3278.024856][ T1482] __se_sys_ioctl+0xcb/0x140 [ 3278.029493][ T1482] __x64_sys_ioctl+0x3f/0x50 [ 3278.035501][ T1482] do_syscall_64+0x39/0x80 [ 3278.039913][ T1482] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3278.045845][ T1482] RIP: 0033:0x45de59 [ 3278.049805][ T1482] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3278.070009][ T1482] RSP: 002b:00007fe47d626c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3278.079614][ T1482] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3278.088815][ T1482] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000004 [ 3278.096930][ T1482] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3278.105036][ T1482] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3278.114144][ T1482] R13: 00007ffd37fe73df R14: 00007fe47d6279c0 R15: 000000000118bf2c [ 3278.180011][ T1482] Mem-Info: [ 3278.205135][ T1482] active_anon:2706 inactive_anon:25006 isolated_anon:0 [ 3278.205135][ T1482] active_file:1555 inactive_file:1775 isolated_file:0 [ 3278.205135][ T1482] unevictable:0 dirty:93 writeback:0 [ 3278.205135][ T1482] slab_reclaimable:7532 slab_unreclaimable:19912 [ 3278.205135][ T1482] mapped:58609 shmem:9159 pagetables:991 bounce:0 [ 3278.205135][ T1482] free:371486 free_pcp:426 free_cma:0 [ 3278.249817][ T1482] Node 0 active_anon:10824kB inactive_anon:100024kB active_file:6196kB inactive_file:7096kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:234416kB dirty:372kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 24576kB writeback_tmp:0kB kernel_stack:4256kB all_unreclaimable? no [ 3278.342576][ T1482] Node 1 active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:4kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:20kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB all_unreclaimable? yes [ 3278.397231][ T1482] Node 0 DMA free:15500kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:32kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3278.429853][ T1482] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3278.439111][ T1482] Node 0 DMA32 free:476480kB min:106660kB low:114864kB high:123068kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4260kB active_file:132kB inactive_file:724kB unevictable:0kB writepending:24kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:636kB local_pcp:380kB free_cma:0kB [ 3278.475001][ T1482] lowmem_reserve[]: 0 0 959 959 959 04:27:24 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3278.480285][ T1482] Node 0 Normal free:13532kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10824kB inactive_anon:95604kB active_file:6108kB inactive_file:6280kB unevictable:0kB writepending:348kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3860kB bounce:0kB free_pcp:1596kB local_pcp:612kB free_cma:0kB [ 3278.542458][ T1482] lowmem_reserve[]: 0 0 0 0 0 [ 3278.547299][ T1482] Node 1 Normal free:862520kB min:46132kB low:57664kB high:69196kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:4kB unevictable:0kB writepending:0kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:4kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3278.632491][ T1482] lowmem_reserve[]: 0 0 0 0 0 [ 3278.637263][ T1482] Node 0 DMA: 2*4kB (UM) 1*8kB (U) 1*16kB (M) 2*32kB (UM) 1*64kB (M) 2*128kB (UM) 1*256kB (M) 1*512kB (M) 2*1024kB (UM) 0*2048kB 3*4096kB (M) = 15520kB [ 3278.664211][ T1482] Node 0 DMA32: 1*4kB (M) 1*8kB (M) 1*16kB (U) 1*32kB (M) 1*64kB (M) 1*128kB (M) 1*256kB (M) 0*512kB 2*1024kB (UM) 55*2048kB (UM) 1*4096kB (U) = 119292kB [ 3278.684473][ T1482] Node 0 Normal: 83*4kB (UE) 60*8kB (UE) 17*16kB (ME) 69*32kB (UE) 2*64kB (UM) 1*128kB (M) 1*256kB (M) 1*512kB (M) 9*1024kB (UM) 0*2048kB 0*4096kB = 13532kB [ 3278.704722][ T1482] Node 1 Normal: 60*4kB (UM) 13*8kB (UM) 20*16kB (UM) 11*32kB (UM) 111*64kB (UM) 11*128kB (U) 2*256kB (UM) 87*512kB (UM) 425*1024kB (U) 133*2048kB (U) 4*4096kB (U) = 778552kB [ 3278.726646][ T1482] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3278.740356][ T1482] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3278.753745][ T1482] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3278.767751][ T1482] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3278.780952][ T1482] 12485 total pagecache pages [ 3278.789409][ T1482] 0 pages in swap cache [ 3278.797436][ T1482] Swap cache stats: add 0, delete 0, find 0/0 [ 3278.807447][ T1482] Free swap = 0kB [ 3278.811223][ T1482] Total swap = 0kB [ 3278.822959][ T1482] 2097051 pages RAM [ 3278.826913][ T1482] 0 pages HighMem/MovableOnly [ 3278.840469][ T1482] 80035 pages reserved [ 3278.848202][ T1482] 0 pages cma reserved 04:27:26 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x0, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:26 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:26 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:26 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:26 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x0, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:26 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x0, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x0, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x0, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:26 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x0, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x0, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:27 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:27 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:27 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:27 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x0, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x0, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:28 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:28 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x0, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:28 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:28 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:28 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:28 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:28 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x0, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:29 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:29 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:29 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:29 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x0, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:29 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:29 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:30 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x0, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x0, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x0, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x0, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:30 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x0, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:31 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:31 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x0, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:31 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:31 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3286.291397][ T1614] syz-executor.2 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 3286.335417][ T1614] CPU: 0 PID: 1614 Comm: syz-executor.2 Not tainted 5.9.0-syzkaller #0 [ 3286.343906][ T1614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3286.353965][ T1614] Call Trace: [ 3286.357385][ T1614] dump_stack+0x116/0x15d [ 3286.361778][ T1614] dump_header+0x98/0x410 [ 3286.366104][ T1614] oom_kill_process+0x182/0x3e0 [ 3286.371000][ T1614] out_of_memory+0x610/0x8c0 [ 3286.375841][ T1614] __alloc_pages_slowpath+0x740/0x9c0 [ 3286.382661][ T1614] __alloc_pages_nodemask+0x269/0x350 [ 3286.388025][ T1614] alloc_pages_current+0x21d/0x310 [ 3286.393207][ T1614] __page_cache_alloc+0x4d/0xf0 [ 3286.398377][ T1614] pagecache_get_page+0x554/0x980 [ 3286.403580][ T1614] filemap_fault+0xbe6/0x12e0 [ 3286.408236][ T1614] ext4_filemap_fault+0x4b/0x60 [ 3286.413334][ T1614] do_read_fault+0x403/0x760 [ 3286.417913][ T1614] handle_mm_fault+0xfeb/0x1770 [ 3286.424927][ T1614] do_user_addr_fault+0x33e/0x730 [ 3286.430000][ T1614] exc_page_fault+0x91/0x290 [ 3286.434602][ T1614] ? asm_exc_page_fault+0x8/0x30 [ 3286.439548][ T1614] asm_exc_page_fault+0x1e/0x30 [ 3286.444471][ T1614] RIP: 0033:0x41236b [ 3286.448361][ T1614] Code: Unable to access opcode bytes at RIP 0x412341. [ 3286.455187][ T1614] RSP: 002b:00007fff40f51ed0 EFLAGS: 00010287 [ 3286.461276][ T1614] RAX: 00007f91ae920010 RBX: ffffffff811069e8 RCX: ffffffff812b3bcc [ 3286.469271][ T1614] RDX: 0000000000000010 RSI: 00007f91ae920008 RDI: 00007f91ae920010 [ 3286.477505][ T1614] RBP: 00007f91ae920018 R08: ffffffff812b3e77 R09: 00000000206159e8 [ 3286.485649][ T1614] R10: 00007fff40f52060 R11: 0000000000000246 R12: 0000000000000008 [ 3286.493874][ T1614] R13: 00007f91ae920008 R14: 00007f91ae920088 R15: 000000000003ffff [ 3286.501849][ T1614] ? mmu_shrink_count+0x8/0x40 [ 3286.506612][ T1614] ? release_task_stack+0x237/0x3b0 [ 3286.511799][ T1614] ? put_task_stack+0xc/0x80 [ 3286.732132][ T1614] Mem-Info: [ 3286.735289][ T1614] active_anon:2706 inactive_anon:24959 isolated_anon:0 [ 3286.735289][ T1614] active_file:51 inactive_file:1479 isolated_file:0 [ 3286.735289][ T1614] unevictable:0 dirty:3 writeback:0 [ 3286.735289][ T1614] slab_reclaimable:7529 slab_unreclaimable:19913 [ 3286.735289][ T1614] mapped:57344 shmem:9159 pagetables:910 bounce:0 [ 3286.735289][ T1614] free:216268 free_pcp:465 free_cma:0 [ 3286.774259][ T1614] Node 0 active_anon:10824kB inactive_anon:99752kB active_file:72kB inactive_file:6860kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:229852kB dirty:12kB writeback:0kB shmem:36636kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 26624kB writeback_tmp:0kB kernel_stack:4192kB all_unreclaimable? no [ 3286.833532][ T1614] Node 1 active_anon:0kB inactive_anon:84kB active_file:132kB inactive_file:56kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:48kB all_unreclaimable? no [ 3286.872563][ T1614] Node 0 DMA free:15480kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3286.900735][ T1614] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3286.908676][ T1614] Node 0 DMA32 free:100176kB min:32820kB low:41024kB high:49228kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4320kB active_file:64kB inactive_file:9040kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:260kB bounce:0kB free_pcp:308kB local_pcp:276kB free_cma:0kB [ 3286.941585][ T1614] lowmem_reserve[]: 0 0 959 959 959 [ 3286.950371][ T1614] Node 0 Normal free:13524kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10824kB inactive_anon:95492kB active_file:56kB inactive_file:12kB unevictable:0kB writepending:12kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3488kB bounce:0kB free_pcp:1596kB local_pcp:104kB free_cma:0kB [ 3287.030051][ T1614] lowmem_reserve[]: 0 0 0 0 0 [ 3287.040922][ T1614] Node 1 Normal free:598812kB min:46132kB low:57664kB high:69196kB reserved_highatomic:0KB active_anon:0kB inactive_anon:184kB active_file:32kB inactive_file:180kB unevictable:0kB writepending:0kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:188kB bounce:0kB free_pcp:548kB local_pcp:280kB free_cma:0kB [ 3287.077442][ T1614] lowmem_reserve[]: 0 0 0 0 0 [ 3287.083723][ T1614] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15480kB [ 3287.103079][ T1614] Node 0 DMA32: 2*4kB (UM) 1*8kB (U) 1*16kB (M) 1*32kB (M) 2*64kB (UM) 0*128kB 18*256kB (U) 52*512kB (UM) 13*1024kB (UM) 0*2048kB 0*4096kB = 44736kB 04:27:33 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x0, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:33 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:33 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:33 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3287.126710][ T1614] Node 0 Normal: 827*4kB (ME) 301*8kB (UME) 104*16kB (UME) 22*32kB (ME) 38*64kB (UME) 19*128kB (U) 3*256kB (U) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 13716kB [ 3287.147590][ T1614] Node 1 Normal: 1*4kB (U) 2*8kB (UM) 2*16kB (UM) 1*32kB (U) 635*64kB (U) 495*128kB (U) 306*256kB (UM) 120*512kB (UM) 200*1024kB (UM) 46*2048kB (U) 0*4096kB = 542868kB [ 3287.213665][ T1614] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3287.256027][ T1614] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 04:27:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x0, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3287.297310][ T1614] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3287.346754][ T1614] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3287.390861][ T1614] 12574 total pagecache pages [ 3287.414806][ T1614] 0 pages in swap cache [ 3287.436570][ T1614] Swap cache stats: add 0, delete 0, find 0/0 [ 3287.468109][ T1614] Free swap = 0kB 04:27:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x0, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3287.491203][ T1614] Total swap = 0kB [ 3287.508877][ T1614] 2097051 pages RAM [ 3287.532873][ T1614] 0 pages HighMem/MovableOnly [ 3287.552580][ T1614] 80035 pages reserved [ 3287.569383][ T1614] 0 pages cma reserved [ 3287.584352][ T1614] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0-1,global_oom,task_memcg=/,task=syz-executor.0,pid=1586,uid=0 [ 3287.646282][ T1614] Out of memory: OOM victim 1586 (syz-executor.0) is already exiting. Skip killing the task 04:27:33 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x0, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3287.955467][ T1631] warn_alloc: 16 callbacks suppressed [ 3287.955564][ T1631] syz-executor.5: page allocation failure: order:4, mode:0x140dc2(GFP_HIGHUSER|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3288.027599][ T1631] CPU: 1 PID: 1631 Comm: syz-executor.5 Not tainted 5.9.0-syzkaller #0 [ 3288.035885][ T1631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3288.046032][ T1631] Call Trace: [ 3288.049384][ T1631] dump_stack+0x116/0x15d [ 3288.053695][ T1631] warn_alloc+0x105/0x160 [ 3288.058021][ T1631] ? __alloc_pages_direct_compact+0xe7/0x1a0 [ 3288.063992][ T1631] __alloc_pages_slowpath+0x9ab/0x9c0 [ 3288.069516][ T1631] ? preempt_schedule_irq+0x43/0x80 [ 3288.076184][ T1631] ? get_page_from_freelist+0x168/0x480 [ 3288.081969][ T1631] __alloc_pages_nodemask+0x269/0x350 [ 3288.087337][ T1631] alloc_pages_current+0x21d/0x310 [ 3288.092459][ T1631] ion_page_pool_alloc+0x230/0x260 [ 3288.097633][ T1631] ion_system_heap_allocate+0x18a/0x6b0 [ 3288.103246][ T1631] ion_ioctl+0x2d2/0x9b0 [ 3288.107467][ T1631] ? debug_shrink_set+0xa0/0xa0 [ 3288.112370][ T1631] __se_sys_ioctl+0xcb/0x140 [ 3288.117075][ T1631] __x64_sys_ioctl+0x3f/0x50 [ 3288.121659][ T1631] do_syscall_64+0x39/0x80 [ 3288.126095][ T1631] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3288.132022][ T1631] RIP: 0033:0x45de59 [ 3288.135939][ T1631] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3288.155699][ T1631] RSP: 002b:00007fe47d626c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3288.164279][ T1631] RAX: ffffffffffffffda RBX: 00000000000106c0 RCX: 000000000045de59 [ 3288.172238][ T1631] RDX: 00000000200001c0 RSI: 00000000c0184900 RDI: 0000000000000003 [ 3288.180193][ T1631] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 3288.188159][ T1631] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 3288.196118][ T1631] R13: 00007ffd37fe73df R14: 00007fe47d6279c0 R15: 000000000118bf2c [ 3288.402312][ T1631] Mem-Info: [ 3288.406855][ T1631] active_anon:2706 inactive_anon:23963 isolated_anon:0 [ 3288.406855][ T1631] active_file:298 inactive_file:1565 isolated_file:3 [ 3288.406855][ T1631] unevictable:0 dirty:4 writeback:19 [ 3288.406855][ T1631] slab_reclaimable:7524 slab_unreclaimable:19920 [ 3288.406855][ T1631] mapped:57632 shmem:9159 pagetables:943 bounce:0 [ 3288.406855][ T1631] free:252111 free_pcp:601 free_cma:0 04:27:34 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:34 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:34 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x0, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:34 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3288.449046][ T1631] Node 0 active_anon:10824kB inactive_anon:95420kB active_file:1252kB inactive_file:6644kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:230788kB dirty:12kB writeback:52kB shmem:36632kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 22528kB writeback_tmp:0kB kernel_stack:4128kB all_unreclaimable? no [ 3288.537529][ T1631] Node 1 active_anon:0kB inactive_anon:432kB active_file:40kB inactive_file:16kB unevictable:0kB isolated(anon):0kB isolated(file):12kB mapped:40kB dirty:4kB writeback:24kB shmem:4kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:64kB all_unreclaimable? no [ 3288.647724][ T1631] Node 0 DMA free:15608kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:4kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3288.714296][ T1631] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3288.729975][ T1631] Node 0 DMA32 free:913484kB min:34868kB low:43072kB high:51276kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4408kB active_file:1160kB inactive_file:3380kB unevictable:0kB writepending:40kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:1488kB local_pcp:1392kB free_cma:0kB [ 3288.819819][ T1631] lowmem_reserve[]: 0 0 959 959 959 [ 3288.841476][ T1631] Node 0 Normal free:71228kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10824kB inactive_anon:97516kB active_file:748kB inactive_file:7664kB unevictable:0kB writepending:20kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3632kB bounce:0kB free_pcp:1536kB local_pcp:1332kB free_cma:0kB [ 3288.942231][ T1631] lowmem_reserve[]: 0 0 0 0 0 [ 3288.959935][ T1631] Node 1 Normal free:383740kB min:46132kB low:57664kB high:69196kB reserved_highatomic:0KB active_anon:0kB inactive_anon:332kB active_file:40kB inactive_file:16kB unevictable:0kB writepending:28kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:340kB bounce:0kB free_pcp:1544kB local_pcp:80kB free_cma:0kB [ 3289.011745][ T1631] lowmem_reserve[]: 0 0 0 0 0 [ 3289.041879][ T1631] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 2*128kB (U) 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15728kB [ 3289.081709][ T1631] Node 0 DMA32: 33*4kB (UM) 29*8kB (UM) 69*16kB (UM) 96*32kB (UM) 23*64kB (M) 299*128kB (UM) 401*256kB (UM) 96*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 196092kB [ 3289.141726][ T1631] Node 0 Normal: 1838*4kB (UE) 1137*8kB (UE) 692*16kB (UE) 454*32kB (UE) 4*64kB (E) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 42304kB [ 3289.181706][ T1631] Node 1 Normal: 80*4kB (UM) 54*8kB (UM) 44*16kB (UM) 43*32kB (UM) 2907*64kB (UM) 645*128kB (UM) 176*256kB (UM) 119*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 377424kB [ 3289.241704][ T1631] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3289.251437][ T1631] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3289.276853][ T1631] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3289.331691][ T1631] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3289.358136][ T1631] 12494 total pagecache pages [ 3289.371365][ T1631] 0 pages in swap cache [ 3289.382024][ T1631] Swap cache stats: add 0, delete 0, find 0/0 [ 3289.396742][ T1631] Free swap = 0kB [ 3289.400537][ T1631] Total swap = 0kB [ 3289.421669][ T1631] 2097051 pages RAM [ 3289.438443][ T1631] 0 pages HighMem/MovableOnly [ 3289.463147][ T1631] 80035 pages reserved [ 3289.467272][ T1631] 0 pages cma reserved 04:27:35 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:35 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x0, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:35 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:35 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:35 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:35 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x0, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:35 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x0, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x0, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x0, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x0, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:36 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x0, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:36 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:36 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x0, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:36 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x0, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:37 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x0, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:37 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:37 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:37 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x0, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x0, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x0, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x0, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:37 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:37 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x0, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:38 executing program 5: syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:38 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:38 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x0, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:38 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x0, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:38 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:38 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:38 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x0, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3292.708671][ T1728] syz-executor.4 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 3293.020020][ T1728] CPU: 0 PID: 1728 Comm: syz-executor.4 Not tainted 5.9.0-syzkaller #0 [ 3293.028472][ T1728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3293.038633][ T1728] Call Trace: [ 3293.042407][ T1728] dump_stack+0x116/0x15d [ 3293.046800][ T1728] dump_header+0x98/0x410 [ 3293.051146][ T1728] oom_kill_process+0x182/0x3e0 [ 3293.055993][ T1728] out_of_memory+0x610/0x8c0 [ 3293.060841][ T1728] __alloc_pages_slowpath+0x740/0x9c0 [ 3293.066253][ T1728] __alloc_pages_nodemask+0x269/0x350 [ 3293.071762][ T1728] alloc_pages_current+0x21d/0x310 [ 3293.077125][ T1728] __page_cache_alloc+0x4d/0xf0 [ 3293.081963][ T1728] pagecache_get_page+0x554/0x980 [ 3293.087178][ T1728] filemap_fault+0xbe6/0x12e0 [ 3293.092637][ T1728] ext4_filemap_fault+0x4b/0x60 [ 3293.097964][ T1728] do_read_fault+0x403/0x760 [ 3293.102830][ T1728] handle_mm_fault+0xfeb/0x1770 [ 3293.107910][ T1728] do_user_addr_fault+0x33e/0x730 [ 3293.113113][ T1728] exc_page_fault+0x91/0x290 [ 3293.118288][ T1728] ? asm_exc_page_fault+0x8/0x30 [ 3293.123484][ T1728] asm_exc_page_fault+0x1e/0x30 [ 3293.128580][ T1728] RIP: 0033:0x460a80 [ 3293.132557][ T1728] Code: Unable to access opcode bytes at RIP 0x460a56. [ 3293.139709][ T1728] RSP: 002b:00007ffc0e4ae348 EFLAGS: 00010293 [ 3293.146009][ T1728] RAX: 0000000000000000 RBX: 0000000000323f44 RCX: 000000000045c321 [ 3293.154375][ T1728] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3293.162339][ T1728] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 3293.170413][ T1728] R10: 00007ffc0e4ae450 R11: 0000000000000293 R12: 000000000118bf20 [ 3293.178498][ T1728] R13: 000000000118c9a0 R14: 00000000000003e8 R15: 000000000118bf2c [ 3293.224454][ T1728] Mem-Info: [ 3293.251462][ T1728] active_anon:2707 inactive_anon:26074 isolated_anon:0 [ 3293.251462][ T1728] active_file:121 inactive_file:469 isolated_file:0 [ 3293.251462][ T1728] unevictable:0 dirty:2 writeback:0 [ 3293.251462][ T1728] slab_reclaimable:7525 slab_unreclaimable:19924 [ 3293.251462][ T1728] mapped:56617 shmem:9159 pagetables:1011 bounce:0 [ 3293.251462][ T1728] free:417700 free_pcp:1955 free_cma:0 [ 3293.465205][ T1728] Node 0 active_anon:10828kB inactive_anon:106072kB active_file:3556kB inactive_file:6124kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:232368kB dirty:8kB writeback:0kB shmem:36632kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 28672kB writeback_tmp:0kB kernel_stack:4240kB all_unreclaimable? no 04:27:39 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:39 executing program 3: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:39 executing program 5: syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:39 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x0, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:39 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x0, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3293.629313][ T1728] Node 1 active_anon:0kB inactive_anon:196kB active_file:8kB inactive_file:8kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:4kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:32kB all_unreclaimable? yes 04:27:40 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x0, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) [ 3293.776052][ T1728] Node 0 DMA free:15680kB min:176kB low:220kB high:264kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3293.909622][ T1728] lowmem_reserve[]: 0 2868 3827 3827 3827 [ 3293.935549][ T1728] Node 0 DMA32 free:972220kB min:34868kB low:43072kB high:51276kB reserved_highatomic:0KB active_anon:0kB inactive_anon:8296kB active_file:212kB inactive_file:4512kB unevictable:0kB writepending:0kB present:3129332kB managed:2941268kB mlocked:0kB pagetables:252kB bounce:0kB free_pcp:2924kB local_pcp:1436kB free_cma:0kB [ 3294.055135][ T1728] lowmem_reserve[]: 0 0 959 959 959 [ 3294.074740][ T1728] Node 0 Normal free:13700kB min:10980kB low:13724kB high:16468kB reserved_highatomic:0KB active_anon:10828kB inactive_anon:95976kB active_file:3844kB inactive_file:3668kB unevictable:0kB writepending:112kB present:1048576kB managed:982580kB mlocked:0kB pagetables:3928kB bounce:0kB free_pcp:848kB local_pcp:724kB free_cma:0kB [ 3294.183732][ T1728] lowmem_reserve[]: 0 0 0 0 0 [ 3294.201524][ T1728] Node 1 Normal free:585932kB min:46132kB low:57664kB high:69196kB reserved_highatomic:0KB active_anon:0kB inactive_anon:100kB active_file:12kB inactive_file:4kB unevictable:0kB writepending:12kB present:4194304kB managed:4128312kB mlocked:0kB pagetables:92kB bounce:0kB free_pcp:2804kB local_pcp:1344kB free_cma:0kB [ 3294.275945][ T1728] lowmem_reserve[]: 0 0 0 0 0 [ 3294.290287][ T1728] Node 0 DMA: 2*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 4*64kB (U) 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15680kB [ 3294.328230][ T1728] Node 0 DMA32: 4*4kB (UME) 3*8kB (UME) 2*16kB (ME) 2*32kB (UE) 2*64kB (UE) 167*128kB (UME) 699*256kB (UME) 263*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 335240kB [ 3294.371581][ T1728] Node 0 Normal: 181*4kB (UE) 44*8kB (E) 19*16kB (UE) 5*32kB (E) 4*64kB (UE) 1*128kB (U) 16*256kB (U) 15*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 13700kB [ 3294.415405][ T1728] Node 1 Normal: 63*4kB (UM) 46*8kB (UM) 30*16kB (UM) 22*32kB (UM) 4049*64kB (UM) 1125*128kB (UM) 365*256kB (UM) 171*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 585932kB [ 3294.444707][ T1728] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3294.457486][ T1728] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3294.481305][ T1728] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3294.491015][ T1728] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3294.512984][ T1728] 12256 total pagecache pages [ 3294.541853][ T1728] 0 pages in swap cache [ 3294.546030][ T1728] Swap cache stats: add 0, delete 0, find 0/0 [ 3294.572158][ T1728] Free swap = 0kB [ 3294.575927][ T1728] Total swap = 0kB [ 3294.579659][ T1728] 2097051 pages RAM [ 3294.594468][ T1728] 0 pages HighMem/MovableOnly [ 3294.599154][ T1728] 80035 pages reserved [ 3294.614505][ T1728] 0 pages cma reserved [ 3294.618587][ T1728] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0-1,global_oom,task_memcg=/,task=syz-executor.3,pid=1719,uid=0 [ 3294.643921][ T1728] Out of memory: OOM victim 1719 (syz-executor.3) is already exiting. Skip killing the task 04:27:40 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:40 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x0, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:40 executing program 3: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:40 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x0, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:40 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:40 executing program 5: syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:41 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x0, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x0, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x0, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x0, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:41 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x0, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:41 executing program 3: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:41 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:42 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:42 executing program 0: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x1}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:42 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:42 executing program 4: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:42 executing program 5: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:42 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:43 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:43 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) 04:27:43 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0xfffffffe) openat$vcs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vcs\x00', 0x202002, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0x0, 0x1, 0x3}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000940)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000540)={0x0, 0xecd3, 0x0, [0x0, 0x80, 0x43, 0x724, 0xf64], [0x56, 0x1, 0x6, 0x1, 0x9, 0x8, 0x2, 0x5, 0x2, 0x5, 0x80000000, 0x4, 0x60000, 0x100, 0x2, 0x1, 0x9, 0xfffffffffffffff9, 0x3, 0xff, 0x100000000, 0x7, 0x401, 0x1000, 0x800000000000000, 0x5, 0x7, 0x7, 0x1, 0xfffffffffffffff9, 0x3, 0xf7c, 0x8, 0x3d5, 0xb10, 0x2, 0x0, 0x2, 0x42, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x9, 0x0, 0x52ed, 0xe331, 0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x0, 0x9, 0x1ff, 0x0, 0x4, 0x0, 0x675b, 0x54a2, 0x0, 0x0, 0x3, 0xfffffffffffff7a5, 0x0, 0x0, 0x0, 0x3, 0x3, 0xff, 0x0, 0x7, 0x10000, 0x886, 0x2, 0xb10, 0xfffffffffffffffb, 0x6, 0x6, 0xffffffffffff0001, 0x7, 0x20, 0x0, 0x0, 0xfffffffffffffffc, 0x800, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x401, 0x1, 0x7, 0x0, 0xb062, 0x3, 0xffff, 0x6, 0x0, 0x0, 0x2, 0x0, 0x7, 0x8, 0xfffffffffffff001, 0x7ff, 0x101, 0x3, 0x0, 0x7fffffff, 0x1, 0x80000001, 0x0, 0x0, 0x5, 0x609e, 0x3f]}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000980)={0x0, 0x6}) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000c, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000c6d000/0x3000)=nil, 0x3000, 0x2, 0x2010, 0xffffffffffffffff, 0x10000000) clock_gettime(0x0, &(0x7f0000001180)={0x0, 0x0}) syz_io_uring_submit(r0, r1, &(0x7f0000001200)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x3, &(0x7f00000011c0)={r2, r3+10000000}, 0x1, 0x1, 0x1}, 0x8001) mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x63032, 0xffffffffffffffff, 0x0) 04:27:43 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000bfe000/0x400000)=nil, 0x404000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r0, 0x0, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x20000010) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000001c0)={0x80000000, 0x1, 0x1}) [ 3297.972613][ T1842] ==================================================================