ted PEBs: 0 [ 1785.749269] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1785.774533] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:58:37 executing program 5: [ 1785.833547] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1785.856395] ubi0: background thread "ubi_bgt0d" started, PID 32191 14:58:37 executing program 5: 14:58:37 executing program 1: [ 1785.884555] ubi0: detaching mtd0 [ 1785.895982] ubi0: mtd0 is detached 14:58:37 executing program 5: 14:58:37 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0xfffffffa, 0x4) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3}}) 14:58:37 executing program 1: 14:58:37 executing program 5: [ 1786.052153] ubi0: attaching mtd0 [ 1786.073530] ubi0: scanning is finished 14:58:37 executing program 1: 14:58:37 executing program 5: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$NL80211_CMD_GET_MPP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="cf415f0fb9a1878174a7e004e8", @ANYRES16=r2, @ANYBLOB="100000000000ffdbdf256b0000000a001a00aaaaaaaaaa0a000008000300", @ANYRES32=0x0], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x40011) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$EXT4_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000140)=0x8) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0xfd14) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r4, 0x82, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc, 0x1f16, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r5 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r5) 14:58:37 executing program 1: [ 1786.291275] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1786.307330] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1786.313925] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 14:58:38 executing program 1: [ 1786.346959] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1786.378902] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1786.385042] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 14:58:38 executing program 1: [ 1786.436601] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1786.445947] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:58:38 executing program 5: [ 1786.495654] ubi0: background thread "ubi_bgt0d" started, PID 32220 14:58:38 executing program 1: 14:58:38 executing program 5: 14:58:38 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) symlinkat(&(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00') ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) r4 = dup(r3) write$P9_RLERRORu(r4, &(0x7f0000000180)={0x1b, 0x7, 0x2, {{0xe, '/dev/ubi_ctrl\x00'}, 0x3}}, 0x1b) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3}}) 14:58:38 executing program 1: 14:58:38 executing program 5: [ 1786.735565] ubi0: detaching mtd0 14:58:38 executing program 1: [ 1786.756116] ubi0: mtd0 is detached 14:58:38 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x20014, 0x5a6440be3cb97b2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, @perf_config_ext={0x0, 0xffffffff}, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3}}) 14:58:38 executing program 5: 14:58:38 executing program 1: [ 1786.894220] ubi0: attaching mtd0 14:58:38 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x3e0, 0x1f8, 0xe8, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@remote, @empty, @private}}}, {{@arp={@remote, @dev, 0x0, 0x0, 0x0, 0x0, {@mac=@dev}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'erspan0\x00', 'bond_slave_0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "d1dbd400a8e91e7d955cea6df948809a0731d3cf4b87cade63280e95df77"}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x430) [ 1786.926996] ubi0: scanning is finished 14:58:38 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b80)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ppp={{0x8, 0x1, 'ppp\x00'}, {0xc, 0x2, 0x0, 0x1, {0x8, 0x1, r3}}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x40}}, 0x0) 14:58:38 executing program 5: [ 1787.089991] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1787.121378] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 14:58:38 executing program 5: [ 1787.155281] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1787.179179] ubi0: VID header offset: 64 (aligned 64), data offset: 128 14:58:38 executing program 1: 14:58:38 executing program 5: [ 1787.207848] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1787.230193] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1787.262740] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:58:38 executing program 1: 14:58:38 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1787.305309] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1787.336047] ubi0: background thread "ubi_bgt0d" started, PID 32261 [ 1787.350284] ubi0: detaching mtd0 14:58:39 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x3e0, 0x1f8, 0xe0, 0x1f8, 0xe0, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@remote, @empty, @private}}}, {{@arp={@remote, @dev, 0x0, 0x0, 0x0, 0x0, {@mac=@dev}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'erspan0\x00', 'bond_slave_0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "d1dbd400a8e91e7d955cea6df948809a0731d3cf4b87cade63280e95df77"}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x430) [ 1787.365294] ubi0: mtd0 is detached 14:58:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:39 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x2000000007f, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={&(0x7f0000000040), 0x4}}, 0x0, 0xffffffffefffffff, 0xffffffffffffffff, 0x1) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r2}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r2, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000140)={r2, 0x8001}, 0x8) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r3 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) syncfs(r3) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3}}) 14:58:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:39 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r3) setresgid(0x0, 0xee00, 0x0) [ 1787.587567] ubi0: attaching mtd0 [ 1787.599825] ubi0: scanning is finished 14:58:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="17460000df00000008000a00", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0) ioctl$PPPIOCSMRU1(r1, 0x8004745a, 0x0) 14:58:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1787.735037] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1787.765522] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1787.799207] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1787.826445] ubi0: VID header offset: 64 (aligned 64), data offset: 128 14:58:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1787.858313] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1787.880647] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 14:58:39 executing program 1: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) unshare(0x44000600) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000040)='/dev/ashmem\x00') [ 1787.912140] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1787.961191] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1787.993204] ubi0: background thread "ubi_bgt0d" started, PID 32304 [ 1788.004688] ubi0: detaching mtd0 14:58:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1788.015073] ubi0: mtd0 is detached 14:58:39 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:39 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:39 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') sendmsg$NL80211_CMD_GET_SCAN(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x60, r6, 0xab9535e9a6578fc1, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WDEV={0x6}, @NL80211_ATTR_WIPHY={0x8}, @NL80211_ATTR_WDEV={0xc}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WDEV={0xc}, @NL80211_ATTR_WIPHY={0x8}]}, 0x60}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, r6, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @multicast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008050}, 0x4001) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3}}) [ 1788.259956] IPVS: ftp: loaded support on port[0] = 21 14:58:39 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1788.344317] ubi0: attaching mtd0 [ 1788.372332] ubi0: scanning is finished 14:58:40 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$inet_buf(r0, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:40 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$inet_buf(r0, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:40 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$inet_buf(r0, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1788.563735] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1788.578277] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1788.600947] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 14:58:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1788.623642] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1788.643743] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1788.660429] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 14:58:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1788.680458] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1788.717016] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1788.737346] ubi0: background thread "ubi_bgt0d" started, PID 32355 [ 1788.747313] ubi0: detaching mtd0 [ 1788.756840] ubi0: mtd0 is detached 14:58:40 executing program 3: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x400c630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2, 0x0}) [ 1788.848628] binder: 32370:32371 unknown command 0 [ 1788.853502] binder: 32370:32371 ioctl c0306201 20000540 returned -22 14:58:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x4c, 0x0, &(0x7f0000000480)=[@release={0x40046307}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:58:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:40 executing program 3: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x400c630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2, 0x0}) 14:58:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x11, 0xb, 0x0, &(0x7f0000000040)) [ 1789.171292] kauditd_printk_skb: 4 callbacks suppressed [ 1789.171301] audit: type=1400 audit(1589813920.802:381): avc: denied { set_context_mgr } for pid=32399 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=binder permissive=1 14:58:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:40 executing program 3: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f0000000140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2, 0x0}) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000140)={0xffc}, 0x0, 0x0) [ 1789.233153] binder: 32401:32404 unknown command 0 [ 1789.249161] binder: 32401:32404 ioctl c0306201 20000540 returned -22 14:58:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 3: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x40) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) close(r4) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000180), 0x127) 14:58:41 executing program 1: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x3a3203, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000140)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000140)={0xffc}, 0x0, 0x0) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='gid_map\x00') r1 = socket$inet(0x10, 0x80803, 0x0) sendfile(r1, r0, &(0x7f0000000040)=0x1a, 0x9b1) 14:58:41 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, 0xee00, r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r3) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, 0xee00, r5) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x4e, 0x0, &(0x7f0000000040)) 14:58:41 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r2) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000000), 0x4) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 1: syz_read_part_table(0x0, 0x1, &(0x7f0000001240)=[{&(0x7f0000000080)="0201a9ffffff0a000000ff45ac00000000006300e93119000000000000068000000063000000e100e2ff8777007200300700a5ffffff00002600008000db55", 0x3f, 0x1c0}]) 14:58:41 executing program 3: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x127) sendmsg$tipc(r3, &(0x7f0000000000)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x0, 0x2}}, 0x10, 0x0}, 0x0) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ptype\x00') r1 = socket$inet(0x10, 0x80803, 0x0) sendfile(r1, r0, &(0x7f0000000040)=0x1d, 0x9b1) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_buf(r0, 0x0, 0xd, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r1) setpriority(0x0, 0x0, 0xecffffff) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 3: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) read(r0, &(0x7f0000000080)=""/57, 0x39) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x2, 0x0) write$binfmt_misc(r4, &(0x7f00000012c0)=ANY=[], 0xc) splice(r0, 0x0, r1, 0x0, 0x200, 0x0) 14:58:41 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="17460000df00000008000a00", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r3], 0x40}}, 0x0) ioctl$PPPIOCSMRU1(r3, 0x80047456, 0x0) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:41 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.nlink\x00', 0x0, 0x1000000) 14:58:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:42 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_buf(r0, 0x0, 0x31, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x3e8, 0x1f8, 0xe8, 0x1f8, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@remote, @empty, @private}}}, {{@arp={@remote, @dev, 0x0, 0x0, 0x0, 0x0, {@mac=@dev}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'erspan0\x00', 'bond_slave_0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "d1dbd400a8e91e7d955cea6df948809a0731d3cf4b87cade63280e95df77"}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x430) 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1e, 0x0, &(0x7f0000000040)) 14:58:42 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) getpid() recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00') 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$FITRIM(r0, 0x82307202, &(0x7f0000000100)) 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) 14:58:42 executing program 1: socket$netlink(0x5, 0x3, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) open(0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000002c0)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349f2f11e931e7d62ead037cd2057df60ed8f16071558cce10b2bcb47fedfe92175aaa1c4ecc7aeeb72eb52d9e5f755563698c7e24ab61f0866f15da7f480800b100000000050000be5d2dd15b6210d53eed19bca008388e736e518b98d91c22def1125d7b1e821039a85ad8b91ceaf3e0b5556a98590000000000000000000003d12f2b0126790748260fcb8831", 0x108}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) 14:58:42 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_SWBIT(r0, 0x400c55cb, 0x0) ioctl$UI_SET_PHYS(r0, 0x40045565, &(0x7f00000004c0)='syz0\x00') 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, 0x0, &(0x7f0000695ffc)) [ 1790.850028] ptrace attach of "/root/syz-executor.1"[32535] was attempted by "/root/syz-executor.1"[32537] 14:58:42 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x3) 14:58:42 executing program 3: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000040)) 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, 0x0, &(0x7f0000695ffc)) 14:58:42 executing program 1: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40046302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2, 0x0}) 14:58:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x8, 0x0, &(0x7f0000000480)=[@exit_looper={0x630b}, @enter_looper], 0x0, 0x0, 0x0}) [ 1791.107566] binder: BC_ACQUIRE_RESULT not supported 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, 0x0, &(0x7f0000695ffc)) 14:58:42 executing program 3: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x200202, 0x0) unshare(0x44000600) fcntl$addseals(r0, 0x409, 0x0) [ 1791.134430] binder: 32552:32555 ioctl c0306201 20000540 returned -22 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, 0x0) 14:58:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x4, 0x0, &(0x7f0000000040)) 14:58:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, 0x0) 14:58:43 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x31, 0x0, &(0x7f0000000040)) 14:58:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000000000)=""/143, 0x0) 14:58:43 executing program 1: perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 14:58:43 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_SWBIT(r0, 0x400c55cb, 0x0) ioctl$UI_SET_PHYS(r0, 0x4004556e, &(0x7f00000004c0)='syz0\x00') 14:58:43 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="17460000df00000008000a00", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r3], 0x40}}, 0x0) ioctl$PPPIOCSMRU1(r3, 0x80047441, 0x0) 14:58:43 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x0, 0x0, 0x3}, 0x40) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x127) sendmsg$tipc(r1, &(0x7f0000000000)={&(0x7f0000000040), 0x10, 0x0}, 0x0) 14:58:43 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:43 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) dup3(r2, r3, 0x0) [ 1791.914030] binder: 32603:32604 ioctl c0306201 20000540 returned -14 14:58:43 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x4) 14:58:43 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000040)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0}) futex(&(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)={r1}, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:58:43 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1a, 0x0, &(0x7f0000000040)) [ 1792.270765] binder: 32625:32626 ioctl c0306201 20000540 returned -14 14:58:43 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 3: socket$netlink(0x5, 0x3, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000002c0)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349f2f11e931e7d62ead037cd2057df60ed8f16071558cce10b2bcb47fedfe92175aaa1c4ecc7aeeb72eb52d9e5f755563698c7e24ab61f0866f15da7f480800b100000000050000be5d2dd15b6210d53eed19bca008388e736e518b98d91c22def1125d7b1e821039a85ad8b91ceaf3e0b5556a98590000000000000000000003d12f2b0126790748260fcb8831", 0x108}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000007480)={0x18, 0x1, 0x2, 0x101, 0x0, 0x0, {}, [@CTA_EXPECT_MASTER={0x4}]}, 0x18}}, 0x0) 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1792.420356] binder: 32631:32634 ioctl c0306201 20000540 returned -14 [ 1792.511357] ptrace attach of "/root/syz-executor.3"[32637] was attempted by "/root/syz-executor.3"[32640] [ 1792.519118] binder: 32639:32641 ioctl c0306201 20000540 returned -14 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) mount$overlay(0x400000, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB=',lowerdir=.:file0']) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1792.680616] overlayfs: fs on 'file0' does not support file handles, falling back to index=off. [ 1792.766466] overlayfs: fs on 'file0' does not support file handles, falling back to index=off. 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_SWBIT(r0, 0x400c55cb, 0x0) ioctl$UI_SET_PHYS(r0, 0x40045569, &(0x7f00000004c0)='syz0\x00') 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x4d, 0x0, &(0x7f0000000040)) 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "fd3cdd01db4569cf"}) 14:58:44 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], [], @local}, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa0}}}, 0xb8}}, 0x0) 14:58:44 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:44 executing program 1: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x0, 0x0, 0x3}, 0x40) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) 14:58:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x24, 0x1, 0x4, 0x401, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x24}}, 0x0) 14:58:45 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:45 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_tables_names\x00') r1 = socket$inet(0x10, 0x80803, 0x0) sendfile(r1, r0, &(0x7f0000000040)=0x1a, 0x9b1) 14:58:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r1) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @multicast1}}) 14:58:45 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:45 executing program 3: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = dup2(r3, r2) dup2(r4, r1) 14:58:45 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1793.599727] binder: 32714:32718 ioctl c0306201 20000540 returned -14 14:58:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480), 0x0, 0x0, 0x0}) [ 1793.692503] binder: 32723:32725 ioctl c0306201 20000540 returned -14 [ 1793.717942] device Y4`Ҙ left promiscuous mode 14:58:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1793.780307] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1793.804221] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1793.826647] binder: 32732:32733 ioctl c0306201 20000540 returned -14 [ 1793.839449] binder: 32729:32735 ioctl c018620c 20000500 returned -22 14:58:45 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1793.885933] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:58:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) dup3(r2, r1, 0x0) 14:58:45 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1793.990295] binder: 32736:32739 ioctl c0306201 20000540 returned -14 14:58:45 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:45 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}, &(0x7f0000000040)=0x10) ioctl$int_out(0xffffffffffffffff, 0x2, &(0x7f00000001c0)) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x1c, 0x17, 0x209, 0x0, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @ipv4=@rand_addr=0x6ac0f00}]}, 0x1c}}, 0x0) ioctl$UI_SET_SWBIT(r3, 0x400c55cb, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_SWBIT(r5, 0x400c55cb, 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$LOOP_SET_DIRECT_IO(r9, 0x4c08, 0x6) ioctl$UI_SET_SWBIT(r6, 0x400c55cb, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYRESOCT=r6, @ANYBLOB="f885b6c52b56f2121e14692c99b76c79c572c2a7c75d789359578d599bb314a771b322ebd68537aa9a56b1a64f7518f1d5e0e075675860dfac70be41e65e7bc639b76cb4cfd1e248e2e25d8564aacbd49e365d6c48e048683988cc7de6620767beea0dcbd7009e1742a399775533866274a38a410a32a72e871ad116392c4a9a3122fd94e68aa9309b0d47916907214c7733280f89b6434be8b1285294ca74a16a1bc321dfabf6b9dbd374a1d69a3e14e73f29f020d974447bcd9b76ec6858c5399289241d88134fab95df849b5ac19f6559998ac45c1d728d14161d7e5a8291c952b3ac03672092dc6192f99b80412c178a9bfe8d05f4e6b9c7b2785c81e1e5ca44511adc803eb93e094529b8fce8b64537f35d8caa07a5e9f4b236dc65a3b499591787a7bb3d0ed388b9028744888e8c650d288750c211fa200a34e1186622a0c35b56796e80b2821812ca483cb09f12a5442bfd5c047a1cf7f0242c17a8220f43f3", @ANYRESOCT=r7, @ANYRESDEC=r1, @ANYRES32=r0], 0x60}, 0x1, 0x0, 0x0, 0x24000014}, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000080)={@loopback}, &(0x7f0000000100)=0x14) [ 1794.099530] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1794.125409] binder: 32749:32752 ioctl c0306201 20000540 returned -14 14:58:45 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1794.166878] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:58:45 executing program 3: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000080)='threaded\x00', 0xfffffe58) 14:58:45 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1794.273942] binder: 32758:32760 ioctl c0306201 20000540 returned -14 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1794.463646] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1794.516111] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:46 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:46 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000240)={0x7, 0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000280)={0x9, r3, 0x10001, 0x1048}) gettid() r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_DQEVENT(r5, 0x80885659, &(0x7f0000000180)={0x0, @data}) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1794.890222] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) [ 1794.987081] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:58:46 executing program 3: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000080)='threaded\x00', 0xfffffe58) 14:58:46 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:46 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:47 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:47 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:47 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0xffffffea, 0x7ffffffff000, 0x0}) 14:58:47 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:47 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 14:58:47 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1795.657649] binder: 370:374 ioctl c0306201 0 returned -14 14:58:47 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:47 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 1795.972683] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1795.990148] binder: 389:391 ioctl c0306201 0 returned -14 14:58:47 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 1796.045948] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1796.165372] binder: 395:397 ioctl c0306201 0 returned -14 14:58:48 executing program 3: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000080)='threaded\x00', 0xfffffe58) 14:58:48 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x7ffffffff000, 0x0}) 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x7ffffffff000, 0x0}) 14:58:48 executing program 4: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x200, 0x1c5) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000200)=0x19, 0x4) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(0xffffffffffffffff, 0xc00464be, &(0x7f0000000600)) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000640)=0x1, 0x4) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) recvmsg$can_bcm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)=""/202, 0xca}, {&(0x7f0000000340)=""/159, 0x9f}, {&(0x7f0000000400)=""/235, 0xeb}], 0x3, &(0x7f0000000500)=""/251, 0xfb}, 0x2040) connect$vsock_stream(r0, &(0x7f0000000180)={0x28, 0x0, 0xffffffff}, 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0x8c, 0x0, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'netdevsim0\x00'}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8001}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xe90}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xffffff7f}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2f}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x33}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) [ 1796.457689] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x7ffffffff000, 0x0}) [ 1796.535706] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1796.588373] ubi0: attaching mtd0 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x7ffffffff000, 0x0}) 14:58:48 executing program 1: socket$inet(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1796.666881] ubi0: scanning is finished 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x7ffffffff000, 0x0}) [ 1796.761013] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1796.835972] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x7ffffffff000, 0x0}) 14:58:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:48 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000180)}}], 0x0, 0x7ffffffff000, 0x0}) [ 1797.008371] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1797.057658] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1797.092531] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1797.115646] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1797.148744] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1797.197513] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1797.242707] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1797.275184] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1797.344957] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1797.382652] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:58:49 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x3e0, 0x1f8, 0xe0, 0x1f8, 0x2f8, 0xe8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@remote, @empty, @private}}}, {{@arp={@remote, @dev, 0x0, 0x0, 0x0, 0x0, {@mac=@dev}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'erspan0\x00', 'bond_slave_0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "d1dbd400a8e91e7d955cea6df948809a0731d3cf4b87cade63280e95df77"}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x430) [ 1797.416702] ubi0: background thread "ubi_bgt0d" started, PID 440 14:58:49 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000180)}}], 0x0, 0x7ffffffff000, 0x0}) 14:58:49 executing program 1: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1797.510900] ubi0: detaching mtd0 [ 1797.534820] ubi0: mtd0 is detached [ 1797.562390] ubi0: attaching mtd0 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000180)}}], 0x0, 0x7ffffffff000, 0x0}) [ 1797.589340] ubi0: scanning is finished 14:58:49 executing program 1: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, 0x0}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0x0, 0x7ffffffff000, 0x0}) 14:58:49 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_buf(r0, 0x0, 0x12, &(0x7f0000000000)=""/143, &(0x7f0000695ffc)=0x8f) [ 1797.705771] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1797.734702] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 14:58:49 executing program 1: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) [ 1797.760959] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1797.776273] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1797.794884] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, 0x0}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0x0, 0x7ffffffff000, 0x0}) 14:58:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 14:58:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x11, 0x65, 0x0, &(0x7f0000000040)) [ 1797.814282] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1797.833308] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1797.881452] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, 0x0}, @fda}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}], 0x0, 0x7ffffffff000, 0x0}) [ 1797.928219] ubi0: background thread "ubi_bgt0d" started, PID 470 [ 1797.938666] ubi0: detaching mtd0 [ 1797.949016] ubi0: mtd0 is detached 14:58:49 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x121800, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000240)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000200), 0x5, 0x2, 0x4, 0x0, 0x5}) perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:58:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 14:58:49 executing program 3: 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, 0x0}}], 0x0, 0x7ffffffff000, 0x0}) [ 1798.063485] ubi0: attaching mtd0 [ 1798.092959] ubi0: scanning is finished 14:58:49 executing program 3: 14:58:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, 0x0}}], 0x0, 0x7ffffffff000, 0x0}) 14:58:49 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000680)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000380)={@flat=@weak_handle, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/159, 0x9f}, @fda}, 0x0}}], 0x0, 0x7ffffffff000, 0x0}) 14:58:49 executing program 3: 14:58:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 14:58:49 executing program 3: [ 1798.288000] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 14:58:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) [ 1798.330058] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1798.364844] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1798.386908] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1798.414418] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1798.434619] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1798.464910] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1798.493675] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1798.520891] ubi0: background thread "ubi_bgt0d" started, PID 518 [ 1798.524347] ubi0: detaching mtd0 [ 1798.561750] ubi0: mtd0 is detached 14:58:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 14:58:50 executing program 3: gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x10, 0x0}, 0x30) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000300)}, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465c4d4049fc564e0b9cc7553358380b3a1f59916ffc9bf0bdf81509f07fb2ea80e5cf8dcf819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6e39f403ff065fd3072aae80677eeba68562eaeae2bcd87cef9000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2f9, 0x300, &(0x7f0000000040)="b90103600000f000009e0ff008001fffffe100004000632177fbac141414e0000005be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000, 0x0, 0xfeb9, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7"}, 0x28) 14:58:50 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001e40)}, 0x40) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001c00)}, 0x87, 0x7fff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socketpair(0x29, 0x80000, 0x31580000, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305839, &(0x7f0000000040)=0x3e00) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0xa, &(0x7f0000000000), 0x4) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r3, &(0x7f0000000300)="406b809319223e70480e3dc82a05ccd0436acaa91911b87f0ad30104d9a69b7cbe7ac3fcf5534c1e84457683869e76b60fabc0c6"}, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000028c0)=[{&(0x7f0000002740)="fc131d88732438108034086d8eb474db0cf8e0f60881d0663f0b5f68c27c4c", 0x1f}, {&(0x7f0000002780)="f02704c8588ab9359f12f53c3bc26a077c3e145797c260c41f166bc9a5d615e7b437b4c6d6bfaeef4e7399b75336fb457eaf5554a8621acb177cc2df228aaef1834a31822ebc11baf5dbfc48a4fb39b80e24595951", 0x55}, {0x0}], 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1440444f1bca5242000000000000000000000700000000000000000000021c000000000000000000443c7b6f4bacea18a14db7311363b95b6d7b218b4cde93b7e1d123f09792dcafb3a954fc73a9bd5e1dbf5d96d5b2a75aa48b35112678424af313", @ANYRES32, @ANYBLOB="ffffffffe00000010000000011000000000000000000000001000000040000000000000044000000000000000144149c70fffff7f300000040ffffffff000000e6071bbdac1428aae0000001ac1e000100000000e0000002ac1414aa0100000000000000386d29b772e0a23aabc0896682e51330f61e0614af537fd7c0dff287ad34bac51939bca78c817b96d7bcb1ceb1ce09fff8817e24c26190052092d4e4c675b0031286b167cb38ee8eb86f47b67e"], 0x98}, 0x4000040) close(r0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001bc0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) close(r1) 14:58:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x28}}, 0x0) 14:58:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x28}}, 0x0) 14:58:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x28}}, 0x0) 14:58:50 executing program 3: 14:58:50 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001e40)}, 0x40) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001c00)}, 0x87, 0x7fff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socketpair(0x29, 0x80000, 0x31580000, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305839, &(0x7f0000000040)=0x3e00) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0xa, &(0x7f0000000000), 0x4) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r3, &(0x7f0000000300)="406b809319223e70480e3dc82a05ccd0436acaa91911b87f0ad30104d9a69b7cbe7ac3fcf5534c1e84457683869e76b60fabc0c6"}, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000028c0)=[{&(0x7f0000002740)="fc131d88732438108034086d8eb474db0cf8e0f60881d0663f0b5f68c27c4c", 0x1f}, {&(0x7f0000002780)="f02704c8588ab9359f12f53c3bc26a077c3e145797c260c41f166bc9a5d615e7b437b4c6d6bfaeef4e7399b75336fb457eaf5554a8621acb177cc2df228aaef1834a31822ebc11baf5dbfc48a4fb39b80e24595951", 0x55}, {0x0}], 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1440444f1bca5242000000000000000000000700000000000000000000021c000000000000000000443c7b6f4bacea18a14db7311363b95b6d7b218b4cde93b7e1d123f09792dcafb3a954fc73a9bd5e1dbf5d96d5b2a75aa48b35112678424af313", @ANYRES32, @ANYBLOB="ffffffffe00000010000000011000000000000000000000001000000040000000000000044000000000000000144149c70fffff7f300000040ffffffff000000e6071bbdac1428aae0000001ac1e000100000000e0000002ac1414aa0100000000000000386d29b772e0a23aabc0896682e51330f61e0614af537fd7c0dff287ad34bac51939bca78c817b96d7bcb1ceb1ce09fff8817e24c26190052092d4e4c675b0031286b167cb38ee8eb86f47b67e"], 0x98}, 0x4000040) close(r0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001bc0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) close(r1) 14:58:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0], 0x28}}, 0x0) 14:58:50 executing program 3: [ 1799.263089] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:50 executing program 3: 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0], 0x28}}, 0x0) 14:58:51 executing program 3: [ 1799.444449] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:51 executing program 3: 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0], 0x28}}, 0x0) 14:58:51 executing program 3: [ 1799.595772] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x44, 0x0, &(0x7f0000000480)=[@transaction={0x40086310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:58:51 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0xc004743e, &(0x7f0000000680)='&@[\x00') ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x40047459, 0x907100) 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) [ 1799.786075] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 1799.811375] binder: 582:584 unknown command 0 [ 1799.821135] binder: 582:584 ioctl c0306201 20000500 returned -22 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) 14:58:51 executing program 5: 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) [ 1799.920329] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:51 executing program 3: 14:58:51 executing program 5: [ 1800.008224] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000"], 0x28}}, 0x0) 14:58:51 executing program 5: 14:58:51 executing program 3: [ 1800.138982] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:51 executing program 5: 14:58:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000"], 0x28}}, 0x0) 14:58:51 executing program 3: 14:58:52 executing program 3: [ 1800.317394] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:52 executing program 5: 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000"], 0x28}}, 0x0) 14:58:52 executing program 3: 14:58:52 executing program 5: 14:58:52 executing program 3: [ 1800.504744] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:52 executing program 5: 14:58:52 executing program 3: 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008"], 0x28}}, 0x0) 14:58:52 executing program 5: 14:58:52 executing program 5: 14:58:52 executing program 3: 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008"], 0x28}}, 0x0) 14:58:52 executing program 3: 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008"], 0x28}}, 0x0) 14:58:52 executing program 5: 14:58:52 executing program 3: 14:58:52 executing program 5: 14:58:52 executing program 3: 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a600000000000800"], 0x28}}, 0x0) 14:58:52 executing program 5: 14:58:52 executing program 3: 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a600000000000800"], 0x28}}, 0x0) 14:58:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0352a600000000000800"], 0x28}}, 0x0) 14:58:52 executing program 3: 14:58:52 executing program 5: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 3: [ 1801.450474] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:58:53 executing program 3: 14:58:53 executing program 5: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 3: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 3: 14:58:53 executing program 5: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 3: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 3: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 3: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 5: 14:58:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:53 executing program 3: 14:58:53 executing program 5: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba0000", @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 3: 14:58:54 executing program 5: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba0000", @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 3: 14:58:54 executing program 5: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba0000", @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 3: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00000000000000", @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 5: 14:58:54 executing program 3: 14:58:54 executing program 3: 14:58:54 executing program 5: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00000000000000", @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 5: 14:58:54 executing program 3: 14:58:54 executing program 5: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00000000000000", @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 3: 14:58:54 executing program 5: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/18, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 3: 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/18, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/221, 0xdd}], 0x1}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/141, 0x8d}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)=""/109, 0x6d}, {0x0}, {0x0}, {0x0}], 0x4}, 0x6) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000600)=""/160, 0xa0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x2) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xbf9d, 0x0, 0x0, 0x800e0053e) shutdown(r4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3806cfcb4148b6ae, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x52, 0x0) shutdown(r5, 0x0) shutdown(r3, 0x0) 14:58:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/221, 0xdd}], 0x1}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/141, 0x8d}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)=""/109, 0x6d}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000600)=""/160, 0xa0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x2) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xbf9d, 0x0, 0x0, 0x800e0053e) shutdown(r4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3806cfcb4148b6ae, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x52, 0x0) shutdown(r5, 0x0) shutdown(r3, 0x0) 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/18, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/19, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/19, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/19, @ANYRES32=0x0, @ANYBLOB="0352a6000000000008001b"], 0x28}}, 0x0) 14:58:55 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/221, 0xdd}], 0x1}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/141, 0x8d}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)=""/109, 0x6d}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x6) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000600)=""/160, 0xa0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x7}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xbf9d, 0x0, 0x0, 0x800e0053e) shutdown(r4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3806cfcb4148b6ae, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x52, 0x0) shutdown(r5, 0x0) shutdown(r3, 0x0) 14:58:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x22b41b9a8748b1b5, 0x0, 0x0, 0x800e00510) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000100)=""/237, 0xed}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0xe}, 0x2) r2 = dup(r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0x6, 0x0, 0x0, 0x800e00840) shutdown(r2, 0x0) r4 = socket(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f00000000c0)={0x10, 0x2}, 0x10) shutdown(r3, 0x0) 14:58:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x22b41b9a8748b1b5, 0x0, 0x0, 0x800e00510) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000100)=""/237, 0xed}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0xc}, 0x2) r2 = dup(r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0x6, 0x0, 0x0, 0x800e00840) shutdown(r2, 0x0) r4 = socket(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f00000000c0)={0x10, 0x2}, 0x10) shutdown(r3, 0x0) 14:58:56 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000e3a333a0daf2f73451c0e17a606fec68cb7d67514fe60077d4dd90123d27e7cf43548ee85857ad4a77cb56e0fcb3dfd4e70ebec677d6ac14c2c794f72cbf5fe31789e70227bfd8115efd90c8c48258f8dbe82e16cf0000000000000000000000000000000000000000000000000000790ae2fd45d54b107c8c8a14195e32f13799d6707432ff48bc085760314166443ce72c74f3db890e1ff15a10d91f27e9a232fe2238fff867ba8fd41b29caad2a986e0e244bd11747ffda1a869db7e632df4de8572344b419c45c2170fe873692d8255170c16822bdffd3135480dae93c7e33bdef00000000d8fd8c79a5d0967ab7e43686b4d1e03e326beea7905ef7de375ef8bc8143df20d13c37db269971210fab7071cc3094078a044777aab9d86cf50afefd7b72a0950d389bc9cb43aa607b7269561dd50b22bd2491331818a10f2ac8c3249582a20d4e04fd1ab7883f656b84137d5f7a6edba86a7b9a4c2f3b3a8abf93b280ea53ce01dcc2d30f4310e8281b0cdc017f9759060ea88a2f6597e966a85c9a74ca196700218f919746bb4b84c16fd56ee450e411d75ab7613b644ba7580b2a0942394ed1737517eed1c892422f54d5a2e1cf1a60fe2dcc1a465aa8d54cb4000053c3f01ea714a7bd4fad615ff6e2991589bbdd1ae0d1bce65c620c4a2527a82afe16e019a5e0b5ec1b1b8aafba090000c3630488edcc4a8cbd3246e962b773a75b28a51cd09cbcb3577fea6f1e9fe8cd2b532c084cbd051b4aeaf0e7813354f14a453b093948d49bca31a7170419bb1d32f256ff3010e69b2f0482c63ab78a74dec8b19ca76e7fdf29766d96e4c2f57ba917f0abd5253e87fbe5b86a4b9151c316df3925d86899ab3e2036f4866e277d82829165922f8aeb4ea2b9db2dbb6a6b157d4019545e00028d09608ef2e186fd216ce84d913813e1be50f5b6b98d5dab8d5fe3dc100d8b6cf41c29b550f45d68a627db8335fd97bd633694ebb6173d9474c50c0360daa387ba5da3e092463a4c08f2c686ca2ab5f8c62353b8f2c81700000000297c8161e5c939855271fe95df690f658da38153646e660e9ba212986cd3628a500d14d378d4af508f428ecb0e85322f9fd317b29ec23b193b1ded2824dc90eeea4c56a676609d2f9e6b925cc413cde5414869387f23a309fe29c7e63101fec34b22aae77bd5df5f6181f5b4639119fc5446893479e7907e2eedfd728963537e45e01cd99203cc1f28fb06e5f5a6c96ef934e8"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x24f}, 0x48) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x1800000000000060, 0x1b, 0x0, &(0x7f0000000100)="280e003f4305607e5bc5795e6558000800ffffffba0e7200ffff81", 0x0, 0x100, 0xf2ffffff, 0x0, 0x1, 0x0, &(0x7f0000000380)='q'}, 0x40) 14:58:56 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002700)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/4096, 0x1000}}], 0x1, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) listen(0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f00000000c0), 0x0) r1 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r1, 0x1000) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x806, 0x0) sendfile(r2, r1, 0x0, 0x40801001) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x4030582a, &(0x7f0000000040)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 14:58:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="1b"], 0x78) 14:58:56 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000880)=@acquire={0x16c, 0x17, 0x1, 0x0, 0x0, {{@in6=@remote}, @in=@dev, {@in6=@private1, @in=@remote}, {{@in=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@tmpl={0x44, 0x5, [{{@in=@dev, 0x0, 0x33}, 0x0, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}]}]}, 0x16c}}, 0x0) 14:58:56 executing program 5: syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @dev}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) 14:58:56 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 14:58:56 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000004300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:58:57 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020feffff7a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000006458c2c62fc2868f0399d909a63796c113a80c19aab9d607000000b6cd483be3f0d3253730e711f5969f62c28b22756bedf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa7323f18468766af540439fce41f144631ac262dcae18c3d1a1fbe96dd87235b44175f7c0343185089a0f119e31975e551558050800000000000000135d67857f290870093f38153608561a2128a79cce912d1f85de33ca20a9f5426b932a0d8b23d400f0930c2bce8ca49166f6a587f2f593775afcd971efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac06c537e9737828e5afba9479bba2f2ab405085058dc35fb2c579e3234a5692021d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a7df76214d74eee8fc9f4189a789cd0a81d0d927606ff8fa2e1ff9195d52457f445f2e43011d8f1ef531f2a7a7fa75e57fe6b24b6ae1440906f0a811aa8e22cb458bb02fbcad764784622128c3f791a3c94b2047f66c5fc6ae5f9a8302bc99e80848b1b70315cf63700913a2d92629aca1e9628db70b4f86a5a4bec0e30810176c93dd98890c1c9bfac1526139cb018a5a0d75e2b3e712731e0b51012f269472915ae805830afbe9b5d"], &(0x7f0000000280)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4) recvmsg(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 14:58:57 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000040)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) socket(0x0, 0x0, 0x0) poll(0x0, 0x0, 0x204) futex(&(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0) 14:58:57 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x8a8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$DRM_IOCTL_MODE_ATOMIC(r4, 0xc03864bc, &(0x7f00000002c0)={0x0, 0x1, &(0x7f0000000180)=[0x101], &(0x7f0000000200)=[0x4, 0x3ea3d7d2, 0x7ff, 0x1f, 0x1f, 0x40, 0x10000, 0x1], &(0x7f0000000280)=[0x10000, 0x0, 0xff], &(0x7f0000000240)=[0x2, 0xc921, 0x7ff, 0x2], 0x0, 0x6}) r5 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f00000000c0)={0xa2c, 0x0, 0x2, 0x1ff}) ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000140)={r6, 0x4}) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x0) [ 1806.063361] ubi0: attaching mtd0 [ 1806.087715] ubi0: scanning is finished 14:58:57 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:57 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x102}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000180)={0x0, 0x7, [@local, @multicast, @local, @dev, @empty, @broadcast, @broadcast]}) [ 1806.288403] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1806.316031] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 14:58:58 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) [ 1806.356501] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1806.388272] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1806.428308] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1806.453896] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1806.497802] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1806.529392] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1806.550212] ubi0: background thread "ubi_bgt0d" started, PID 868 14:58:58 executing program 1: 14:58:58 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:58 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="50010000", @ANYRES16, @ANYBLOB="200028bd7000fcdbdf250100000024010c8024000b8008000900f8a8560c08000a001976000008000a00ed780000080009001366db150c000b80080009009af17a3324000b8008000a004fe6000008000900e5d9c31808000900872b521508000a008aaf00000c000b8008000900c039b61d04000b800c000b8008000900e782840f1c000b8008000a009070000008000a004e6a000008000900cf8161491c000b800800090028915d2c08000900b1ba554a08000900ad0df56eff7f0b800800090024de747a080009004180ab229feab01527cb48fb15ad6f4208000a004c03000008000900b797391208000900a1d1d9200800090070d498770800090062808a630800090063f0650008000a006fd600002c000b8008000a006ba80000080009001f68dd7108000a00125d000008000a001fa10000080009002b28770a08000100010000000800010066f2b482be78387c4b7a261045851b47e5a79c01659d5ae6d8ed13374f839b8d842b7fe5f677f16cdae8a0915fc7cc17c49d22b3d3c7b8d874e5e9a221eab9f018b671b6fd6942fe435b66c530bb6dd8d102a8c9f3d8c87d6779ecd0cb58c471b70853abb0554e71f29105a620dad007dd252b7a35a67ba43e6f5bec8060b8d53fd08570d1ffb16284226e471797d88cb417187e61cbdcca69b4d04bf341029072846b9a7f5e6d232ad8c25c60c50d449df48eee93140953ef275a673ebf436553ad52b08c9ea3ed5604d7c1927908c062bec07b101551399ebe8490"], 0x150}, 0x1, 0x0, 0x0, 0x2004000}, 0x4) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60010000", @ANYRES16, @ANYBLOB="00022abd7000fcdbdf2502000000b8000c8034090b8008000900699c0e1908000900cf58dd1d08000a000700000008000900a8b1e70a08000a006b30000008000900b42368e8c5864024000b8008000a005116000008200900e388046508000900c86ba32108000a65463d00002c000b8008000900ae600c5908000900fc4d6f1508000a003b7d0000080008009cc6df3808000900782291530c000b8008000a00c5cd000024000b8008000a009d70000008000a00a1cf989608000900fe12196508000900fe63cc3f0800020001000000d493397251ccbcb9c69945c9d0bee5513097c6ef0800020003000000080002000200000014000480050003de060000000500030001000000040004803423086591000300050000000500030000000000050003000500000005000300010000000500030000000000050003000600000008000148a44edcff2400ee7f050003000500dd77440003000100000005000300070000000500f35bd5aac01d17b5c0126fafff7ca32abc9078a008358ba43499d1d9096e558eae52008e539ff05a5d7eb6af6799d458bb3e3154b8b2af6024103104c3d0570a7e88e3786cf22d4855dc56514ffcbf6194e07151870c4f5dd04dc87663000320e89ad65aa0fe0a12abdb0a760aceb04153249c25d99e5b9ddee09c7e7fc6113d9d6488bbf637143ad3db653d1b2e43ea89d6494695cad791c1a129afbbeb0629559d1e60d7fdaeb913af5c84e106743f4a338fa99da5f8ceed82674de4aa89"], 0x160}, 0x1, 0x0, 0x0, 0x24000090}, 0x4000817) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800e3ff", @ANYRES16, @ANYBLOB="100027bd7000fddbdf2501000000240004800500030000000000050003000000000005000300020000000500030000000000"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x40) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f0000000700)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x4}, {0x5}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5}, {0x5}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000081}, 0x240088d0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000a80)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="000328bd7000d80ee49d80fe4cfe"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x40001) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="d4020400", @ANYRES16, @ANYBLOB="000128bd7000fddbdf25020000000800020002000000b8000c8024000b800800090090d20e0c08000a0052eb00000800090078e1d11108000900d806bf633c000b8008000a00bcb80000080009000f10993608000a00f914000008000900f770d97b080009004ceb223608000a00acd4000008000a00020000003c000b8008000a00f1320000080009008d3a8950080009009ea9156c08000a000c5b000008000a000967000008000900c026ee5d080009003ba7ab2704000b8014000b8008000a00c486000008000900a1086d76"], 0xd4}, 0x1, 0x0, 0x0, 0x8080}, 0x801) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000780)={0x5c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x40, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x759}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x347f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4c928864}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xab54}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5395}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x61025057}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x303e4459}]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20004810}, 0x80) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x2dc, 0x0, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x20, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x452c54a1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe5}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4c, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7759b27f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x48}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f70ce95}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x83}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x52c673c1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1d}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x98, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x39219a34}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x58fb9ebb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x92e53ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x33a15412}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x75114e6d}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4c71cd2c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x55981905}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6fdb3ef5}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x48}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x40fc318}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x52}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x263d57e3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x31206442}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x154, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7b94}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7c4e79c9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7e9dd67d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1602}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x629547e9}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfbc2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6621}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xccc2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x681b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6792}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7713d2e8}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa9c9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7423df12}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5d33b0d2}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x87b5}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x559ed13}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x461ab3c3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x51e7a9bc}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x91e84c5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4bd9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1df202be}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59279e7f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8c50}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5800}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3d5d}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x82f9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6971f5d1}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4f971de2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7460}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x33b4b1f0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xc691a96}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2e528fe1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa0ef}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x148bc867}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5c02}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x11787a8b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x759c5129}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x12ed1244}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}]}]}, 0x2dc}, 0x1, 0x0, 0x0, 0xc895}, 0x20008000) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x138, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x2c, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x54a5af05}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1585df6a}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x54}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0xe4, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4311}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe45}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa4fe}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf851}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4629d2ea}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7dfc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3ab41247}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1dc5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x122}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x541659cb}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x278e9aa2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5bf}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6700}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa5fa}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bb91b1d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6b2820bb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdc22}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xae448de}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2552a67d}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7e5361d9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1f8}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe56b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x13a70b8d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7fd66ae4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4e27413c}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x138}, 0x1, 0x0, 0x0, 0x80}, 0x40080) sendmsg$NLBL_CIPSOV4_C_LISTALL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000425bd7000fddbdf2504000f00080001000200efff07000100ffffffff"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0xc000) 14:58:58 executing program 3: perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000007961e62273faa6884c44827ffe33732b0d27517495db22c369fc01b191533df23e4a10cbd4dfb403d80912aa8ef860dd81e221f886dc0154419e857178e246297048629c6326bfe8f81c360dd7c9efafb9ff34fedbb2ca4d35f6b5f65e8894425d22dce799b0a5d65dee16bffed85ac530e49bbe2cc6e0745503aa6c636e4b0d78e3d530d91e8213cc3f3aa07295e86df0557be41f4f982eb553b1b9e36d77174f29c57c0db60076f5ab193325dbfa90e0edab3ddb5ed8fa984bb0fcb52ad14988f58de2ec276e5d9d9464ede6deb474604da29f1b7d924c96d8c04e5ff44ca849a436284bc99d4b03487b4c221a26c27228aea193cb831124187765d3c1b162bd4e64b2ca92c22afa1ecff1edecd4de1e8d2c88b2b03ad75e3774a70363ad121331b0988b9fa3fd3bdd1f48369863e3c2bc37067a1fe90d7cc733eb753fc3fbe8fa03ed9c061732486e68b39e02a63cbff4af35dd8a17dd33dfa196911b654e60fa881a77b295a8ed9374cb784e9afcfd308b51b6f00b359d41bfe0240f5aaa9e037891216b4c02291f122c51c1e3291195615f13acdbe142541ba3ba10abca64f1cb9d9c819422bf2cf04699902d8e19a9ba1afc6edc2e615a527698f2f84fec0380be7c3eb1ae1576f0e7e88e57dc1c3f7639768e84dda015f8fa0ecfba22ade43e667d8cc897bec4921aa03227085a7b6ccf4b17ce6e26b345f1cbc0b16312ec7fc71724fcde39982c720fbad55be728acdc4acb8ce24c6fc3bf21e7f2f9c1916f77d6db064ab7ba34debf9fd2d0dd40b341afc6a1be00d1910c024351e926f30153cadfbeb9110ff0696fde63973c0a1d85e37c34d1842d50af6e53ec269554a765414221200100000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x18000000000002e0, 0x69, 0x4300, &(0x7f0000000280)="b95b03b700030700009e40f008001fffffe100004000638477fbac14143fe0004301c699da153f08a0e6e380f6010ef683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b33", 0x0, 0xfd, 0x6000000000000000}, 0x28) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) 14:58:58 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x6}, 0x0, 0x10, 0xffffffffffffffff, 0x3) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:58:58 executing program 1: [ 1806.774401] ubi0: detaching mtd0 14:58:58 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) [ 1806.807708] ubi0: mtd0 is detached [ 1806.811369] ubi0: attaching mtd0 [ 1806.829154] ubi0: scanning is finished 14:58:58 executing program 1: 14:58:58 executing program 3: 14:58:58 executing program 5: ppoll(&(0x7f0000000080)=[{}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:58 executing program 3: 14:58:58 executing program 1: 14:58:58 executing program 5: ppoll(&(0x7f0000000080)=[{}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:58 executing program 1: [ 1807.011798] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1807.033089] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1807.072464] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1807.104710] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1807.122245] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1807.141794] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1807.163398] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:58:58 executing program 1: 14:58:58 executing program 3: [ 1807.192022] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1807.227226] ubi0: background thread "ubi_bgt0d" started, PID 922 14:58:58 executing program 1: 14:58:58 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x3018c0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, r1, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa, 0x634}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000f00)=ANY=[@ANYBLOB="60010000", @ANYRES16, @ANYBLOB="00022abd7000fcdbdf2502000000b8000c8034090b8008000900699c0e1908000900cf58dd1d08000a00a377000008000900a8b1e70a08000a006b30000008000900b42368e8c5864024000b8008000a005116000008200900e388046508000900c85aa32108000a65463d00002c000b8008000900ae600c5908000900fc4d6f1508000a003b7d0000080008009cc6df3808000900782291530c000b8008000a00c5cd000024000b8008000a009d70000008000a00a1cf989608000900fe12196508000900fe63cc3f0800020001000000d49339bee53d3097c6ef080002000300000008000200020000001400048005000300070000000500030001000000040004803423086591000300050000000500030000000000050003000500000005000300010000000500030000000000050003000600000008000148a44edcff2400ee7f050003000500dd77440003000100000005000300070000000500f35bd5aac01d17b5c0126fafff7ca32abc9078a008358ba43499d1d9096e558eae52008e539ff05a5d7eb6af6799d458bb3e3154b8b2af6024103104c34855dc56514ffcbf6194e07151870c4f5dd04dc87663000320e89ad65aa0fe0a12abdb0a760aceb04153249c25d99e5b9ddee09c7e7fc6113d9d6488bbf637143ad3db653d1b2e43ea89d6494695cad791c1a129afbbeb0629559d1e60d7fdaeb913af5c84e106743f4a338fa99da5f8ceed82674de4aa89e91c2b9f33ce77d6735e"], 0x160}, 0x1, 0x0, 0x0, 0x24000090}, 0x4000817) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800e3ff", @ANYRES16, @ANYBLOB="100027bd7000fddbdf2501000000240004800500030000000000050003000000000005000300020000000500030000000000"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x40) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x4}, {0x5}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x2}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000081}, 0x240088d0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000a80)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="000328bd7000d80ee49d80fe4cfe"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x40001) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="d4020400", @ANYRES16, @ANYBLOB="000128bd7000fddbdf25020000000800020002000000b8000c8024000b800800090090d20e0c08000a0052eb00000800090078e1d11108000900d806bf633c000b8008000a00bcb80000080009000f10993608000a00f914000008000900f770d97b080009004ceb223608000a00acd4000008000a00020000003c000b8008000a00f1320000080009008d3a8950080009009ea9156c08000a000c5b000008000a000967000008000900c026ee5d080009003ba7ab2704000b8014000b8008000a00c486000008000900a1086d76"], 0xd4}, 0x1, 0x0, 0x0, 0x8080}, 0x801) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x573c025bcd791308}, 0x80) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x2dc, 0x0, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x20, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x452c54a1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe5}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4c, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7759b27f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x48}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f70ce95}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x18f2ddbb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x52c673c1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1d}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x98, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x39219a34}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x58fb9ebb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x92e53ca}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x73}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x75114e6d}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4c71cd2c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x55981905}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6fdb3ef5}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x48}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x40fc318}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x52}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x263d57e3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x31206442}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x154, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x68668d3f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7c4e79c9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7e9dd67d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1602}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x629547e9}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfbc2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6621}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xccc2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x681b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6792}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7713d2e8}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa9c9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x61f4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5d33b0d2}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x87b5}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x559ed13}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x461ab3c3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x33a9a8e0}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x91e84c5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4bd9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1df202be}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59279e7f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8c50}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5800}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3d5d}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x82f9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6971f5d1}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4f971de2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7460}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x33b4b1f0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xc691a96}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2e528f61}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa0ef}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x148bc867}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5c02}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x11787a8b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x759c5129}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x12ed1244}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}]}]}, 0x2dc}, 0x1, 0x0, 0x0, 0xc895}, 0x20008000) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x138, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x2c, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x54a5af05}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1585df6a}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x54}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0xe4, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4311}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe45}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa4fe}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf851}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4629d2ea}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7dfc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3ab41247}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1dc5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x122}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x541659cb}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x278e9aa2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5bf}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6700}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa5fa}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bb91b1d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6b2820bb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdc22}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xae448de}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2552a67d}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7e5361d9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1f8}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe56b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x13a70b8d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7fd66ae4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4e27413c}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x138}, 0x1, 0x0, 0x0, 0x80}, 0x40080) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x104, 0x0, 0x704, 0x70bd27, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x48, 0x8, 0x0, 0x1, [{0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5841c9d0}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7a2236f7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6666f53c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7115270}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3e696c43}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x43}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7526d943}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4d293055}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x4c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x5c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x556beee1}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5d770167}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x10c16c47}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6f44c71e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x52}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x88}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5bad2208}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x32304ac7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x82}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70feafd0}]}]}]}, 0x104}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 14:58:58 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9, 0x0, 0x1eaf}, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x10}, 0x0, 0x0, 0x0, 0x5, 0x2, 0xfffffffe}, r2, 0xfffffffffffffffe, 0xffffffffffffffff, 0x10) r3 = socket$inet6(0xa, 0x2, 0x80000004) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$RTC_WIE_ON(r5, 0x700f) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) ioctl$KDMKTONE(r0, 0x4b30, 0x1ff) 14:58:58 executing program 5: ppoll(&(0x7f0000000080)=[{}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:58 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000140)={0x1}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_config_ext={0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0x7fff, 0x6, 0xfff, 0x0, 0x2}, 0x14) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_GET_PIT2(r4, 0x8070ae9f, &(0x7f0000000180)) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) ioctl$VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000200)={0x6, 0x9, 0x4, 0x400000, 0x7a4, {0x77359400}, {0x1, 0x8, 0x3, 0x7, 0x5, 0x1, "0de5b0a5"}, 0x0, 0x3, @userptr=0x80000000, 0x9, 0x0, 0xffffffffffffffff}) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) 14:58:58 executing program 3: 14:58:59 executing program 1: [ 1807.363070] ubi: mtd0 is already attached to ubi0 14:58:59 executing program 5: r0 = syz_open_dev$usbmon(0x0, 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:59 executing program 1: [ 1807.388234] ubi0: detaching mtd0 [ 1807.405846] ubi0: mtd0 is detached 14:58:59 executing program 3: 14:58:59 executing program 1: 14:58:59 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000140)=0x14) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x2, 0x5}}) 14:58:59 executing program 5: r0 = syz_open_dev$usbmon(0x0, 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:59 executing program 3: 14:58:59 executing program 2: r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x6a, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) keyctl$set_timeout(0xf, r0, 0x3) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:58:59 executing program 1: 14:58:59 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000140)='trusted.overlay.origin\x00', &(0x7f0000000180)='y\x00', 0x2, 0x3) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x10001, 0x6, 0x1002, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x4, 0x2000) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:58:59 executing program 3: 14:58:59 executing program 5: r0 = syz_open_dev$usbmon(0x0, 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:58:59 executing program 1: 14:58:59 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x44a000, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:58:59 executing program 3: [ 1807.810123] ubi0: attaching mtd0 14:58:59 executing program 3: [ 1807.847038] ubi0: scanning is finished 14:58:59 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000100), 0x0, 0x0) 14:58:59 executing program 1: 14:58:59 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$fb(r2, &(0x7f0000000140)="48d4243562207b93f7e903c50df4912fc6edcd2177188f14f13ece50ff5dd72790aa8573df50ae0dcc737d369ec6a64b37ce03acddc1ba1408dc6da256d3a2d33a052d04b0cca1a8050d5405aea462671af7e071377a1fe54a21eab367d0a694732a805c17a14db86721aa13d37df4b548", 0x71) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:58:59 executing program 3: 14:58:59 executing program 1: 14:58:59 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000100), 0x0, 0x0) 14:58:59 executing program 3: 14:58:59 executing program 1: 14:58:59 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000100), 0x0, 0x0) [ 1808.128603] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1808.161285] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1808.183326] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1808.214594] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1808.221404] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1808.240796] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1808.255343] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1808.275307] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:59:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x0, 0x100000000, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x200080, 0x0) ioctl$UFFDIO_ZEROPAGE(r3, 0xc020aa04, &(0x7f0000000140)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}}) [ 1808.306789] ubi0: background thread "ubi_bgt0d" started, PID 1010 [ 1808.313683] ubi0: detaching mtd0 [ 1808.333200] ubi0: mtd0 is detached 14:59:00 executing program 1: 14:59:00 executing program 3: 14:59:00 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080), 0x0, &(0x7f0000000100), 0x0, 0x0) [ 1808.421180] ubi0: attaching mtd0 14:59:00 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x40, 0x0) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x1) bind$alg(r4, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xb}) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0xb2f9, 0xfffffffc}}) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) fcntl$dupfd(r5, 0x406, r7) 14:59:00 executing program 3: [ 1808.463711] ubi0: scanning is finished 14:59:00 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080), 0x0, &(0x7f0000000100), 0x0, 0x0) 14:59:00 executing program 1: 14:59:00 executing program 3: 14:59:00 executing program 1: 14:59:00 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080), 0x0, &(0x7f0000000100), 0x0, 0x0) 14:59:00 executing program 3: [ 1808.735851] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1808.772542] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1808.791353] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1808.806990] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1808.830437] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1808.849397] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1808.873807] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1808.908095] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1808.944468] ubi0: background thread "ubi_bgt0d" started, PID 1043 [ 1808.953036] ubi0: detaching mtd0 [ 1808.972234] ubi0: mtd0 is detached 14:59:00 executing program 1: 14:59:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$P9_RREMOVE(r2, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000140)={0x0, 0xb, 0x4, 0x1000, 0x8000, {0x77359400}, {0x370ae8e12e6b431a, 0x2, 0x5, 0x0, 0x1, 0x1f, "c36afac6"}, 0x7f, 0x4, @offset, 0x2, 0x0, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r4, 0x54a3) ioctl$EVIOCSABS20(r3, 0x401845e0, &(0x7f00000001c0)={0x1, 0x1ff, 0x6, 0x2, 0xc4, 0xaf4}) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:00 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:59:00 executing program 3: 14:59:00 executing program 1: 14:59:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/221, 0xdd}], 0x1}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/141, 0x8d}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)=""/109, 0x6d}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x6) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000600)=""/160, 0xa0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xbf9d, 0x0, 0x0, 0x800e0053e) shutdown(r4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3806cfcb4148b6ae, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x52, 0x0) shutdown(r5, 0x0) shutdown(r3, 0x0) 14:59:00 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VT_DISALLOCATE(r2, 0x5608) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getsockopt$inet_mreqsrc(r5, 0x0, 0xe, &(0x7f0000000040)={@multicast1, @multicast2, @multicast1}, &(0x7f0000000240)=0xc) syslog(0x2, &(0x7f0000000140)=""/216, 0xd8) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:00 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:59:00 executing program 1: r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0xc020660b, 0x0) 14:59:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = gettid() perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0xff, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x9}}, 0x0, 0xffffffffbffffffe, 0xffffffffffffffff, 0xb) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r3) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000040)={0x80000000, 0x9, {r1}, {r3}, 0x23a, 0xff}) ptrace$cont(0x1f, r4, 0x7, 0x8) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:00 executing program 5: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{}], 0x1, &(0x7f0000000100), 0x0, 0x0) 14:59:00 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 14:59:01 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) timerfd_create(0x8, 0x0) 14:59:01 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0xa}) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = dup3(r1, r2, 0x0) getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000140)={'filter\x00'}, &(0x7f0000000040)=0x54) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:01 executing program 1: 14:59:01 executing program 1: 14:59:01 executing program 2: ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1809.690648] ubi0: attaching mtd0 [ 1809.701903] ubi0: scanning is finished [ 1809.809714] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1809.821635] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1809.831670] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1809.843075] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1809.850775] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1809.858853] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1809.867141] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1809.878546] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1809.898966] ubi0: background thread "ubi_bgt0d" started, PID 1129 14:59:01 executing program 3: openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/timer\x00', 0x6800) 14:59:01 executing program 1: 14:59:01 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) dup(r1) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:01 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r2, 0xc0845658, &(0x7f0000000140)={0x0, @reserved}) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1810.069418] ubi0: detaching mtd0 14:59:01 executing program 1: socket$inet6(0xa, 0x3, 0x6) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') readv(r0, &(0x7f0000000240)=[{&(0x7f0000000140)=""/203, 0xcb}], 0x1) 14:59:01 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000e3a333a0daf2f73451c0e17a606fec68cb7d67514fe60077d4dd90123d27e7cf43548ee85857ad4a77cb56e0fcb3dfd4e70ebec677d6ac14c2c794f72cbf5fe31789e70227bfd8115efd90c8c48258f8dbe82e16cf0000000000000000000000000000000000000000000000000000790ae2fd45d54b107c8c8a14195e32f13799d6707432ff48bc085760314166443ce72c74f3db890e1ff15a10d91f27e9a232fe2238fff867ba8fd41b29caad2a986e0e244bd11747ffda1a869db7e632df4de8572344b419c45c2170fe873692d8255170c16822bdffd3135480dae93c7e33bdef00000000d8fd8c79a5d0967ab7e43686b4d1e03e326beea7905ef7de375ef8bc8143df20d13c37db269971210fab7071cc3094078a044777aab9d86cf50afefd7b72a0950d389bc9cb43aa607b7269561dd50b22bd2491331818a10f2ac8c3249582a20d4e04fd1ab7883f656b84137d5f7a6edba86a7b9a4c2f3b3a8abf93b280ea53ce01dcc2d30f4310e8281b0cdc017f9759060ea88a2f6597e966a85c9a74ca196700218f919746bb4b84c16fd56ee450e411d75ab7613b644ba7580b2a0942394ed1737517eed1c892422f54d5a2e1cf1a60fe2dcc1a465aa8d54cb4000053c3f01ea714a7bd4fad615ff6e2991589bbdd1ae0d1bce65c620c4a2527a82afe16e019a5e0b5ec1b1b8aafba090000c3630488edcc4a8cbd3246e962b773a75b28a51cd09cbcb3577fea6f1e9fe8cd2b532c084cbd051b4aeaf0e7813354f14a453b093948d49bca31a7170419bb1d32f256ff3010e69b2f0482c63ab78a74dec8b19ca76e7fdf29766d96e4c2f57ba917f0abd5253e87fbe5b86a4b9151c316df3925d86899ab3e2036f4866e277d82829165922f8aeb4ea2b9db2dbb6a6b157d4019545e00028d09608ef2e186fd216ce84d913813e1be50f5b6b98d5dab8d5fe3dc100d8b6cf41c29b550f45d68a627db8335fd97bd633694ebb6173d9474c50c0360daa387ba5da3e092463a4c08f2c686ca2ab5f8c62353b8f2c81700000000297c8161e5c939855271fe95df690f658da38153646e660e9ba212986cd3628a500d14d378d4af508f428ecb0e85322f9fd317b29ec23b193b1ded2824dc90eeea4c56a676609d2f9e6b925cc413cde5414869387f23a309fe29c7e63101fec34b22aae77bd5df5f6181f5b4639119fc5446893479e7907e2eedfd728963537e45e01cd99203cc1f28fb06e5f5a6c96ef934e8"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x24f}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x1800000000000060, 0xe, 0x0, &(0x7f0000000100)="280e003f4305607e5bc5795e88a8", 0x0, 0x0, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x40) [ 1810.091073] ubi0: mtd0 is detached [ 1810.108179] ubi0: attaching mtd0 [ 1810.122392] ubi0: scanning is finished 14:59:01 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 14:59:01 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) quotactl(0x40000080000100, 0x0, 0x0, 0x0) 14:59:01 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x3, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0}]) socket$inet6(0xa, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 1810.366443] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1810.373302] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 14:59:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) quotactl(0x40000080000100, 0x0, 0x0, 0x0) [ 1810.406758] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1810.437758] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1810.461922] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1810.489600] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 14:59:02 executing program 3: syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000005c000/0x18000)=nil, &(0x7f0000000280)=[@text16={0x10, &(0x7f00000000c0)="0f20e06635000004000f22e06766c7442400007000006766c7442402050000006766c744240600000000670f0114240f01c8e38336f08301dc660f38816bad0f01d566b9ae0b000066b80000000066ba000000800f30d9ed260f01c9", 0x5c}], 0x1, 0x0, 0x0, 0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, 0x0, 0x40000) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000840)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="02002bbd7000ffdbdf251200000005002f000100000008003b0000000100050037000100000008002c0009000000060028000100000008003b0081ffffff08003b00000000000500"], 0x54}, 0x1, 0x0, 0x0, 0x8010}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, 0x0, 0x4040040) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000049000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0xffffffffffffff11) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000000)={0x7ff}) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 1810.539942] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:02 executing program 1: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x33, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) [ 1810.581439] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1810.624697] ubi0: background thread "ubi_bgt0d" started, PID 1168 [ 1810.624906] ubi: mtd0 is already attached to ubi0 [ 1810.656936] ubi0: detaching mtd0 [ 1810.663811] ubi0: mtd0 is detached 14:59:02 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ptrace$setregs(0xd, r1, 0x4, &(0x7f0000000140)="02d7e88b7b9ade360dd5eac7fde4db24ec973917e04662c8a599f40dcbc7cbc4a27d43747e791ab1de8964871a7095cbe05238d3a2cd37dc9458288c7c000fabe18e945bd222d2f661735dd715addf2071c1201a525c13a1d5f330ce734ba26169e1bc78aeaa878d6c0b14b669f0c665c7002c50521a44281045") ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:02 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x80, 0x0) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r4) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x2020, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_L='version=9p2000.L'}, {@aname={'aname'}}], [{@uid_eq={'uid', 0x3d, r4}}, {@dont_hash='dont_hash'}, {@obj_type={'obj_type', 0x3d, 'lo{*.'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@subj_user={'subj_user', 0x3d, 'cpusetsecuritysystem{}'}}, {@dont_measure='dont_measure'}]}}) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x200000000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:02 executing program 1: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x33, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) [ 1810.885173] syz-executor.3: page allocation failure: order:0, mode:0x14000c4(GFP_KERNEL|GFP_DMA32), nodemask=(null) [ 1810.940670] syz-executor.3 cpuset=/ mems_allowed=0-1 [ 1810.974717] CPU: 0 PID: 1194 Comm: syz-executor.3 Not tainted 4.14.180-syzkaller #0 [ 1810.982538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1810.991890] Call Trace: [ 1810.994481] dump_stack+0x13e/0x194 [ 1810.998120] warn_alloc.cold+0x96/0x1af [ 1811.002098] ? zone_watermark_ok_safe+0x280/0x280 [ 1811.006952] ? wait_for_completion+0x390/0x390 [ 1811.011539] __alloc_pages_slowpath+0x2114/0x26c0 [ 1811.016400] ? warn_alloc+0xf0/0xf0 [ 1811.020029] ? find_held_lock+0x2d/0x110 [ 1811.024089] ? fs_reclaim_acquire+0x10/0x10 [ 1811.028422] __alloc_pages_nodemask+0x5d3/0x700 [ 1811.033095] ? rcu_read_lock_sched_held+0x10a/0x130 [ 1811.038110] ? __alloc_pages_nodemask+0x5e0/0x700 [ 1811.042944] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 1811.047949] alloc_pages_current+0xe7/0x1e0 [ 1811.052253] kvm_mmu_create+0xd1/0x1c0 [ 1811.056124] kvm_arch_vcpu_init+0x28b/0x8b0 [ 1811.060432] ? alloc_pages_current+0xef/0x1e0 [ 1811.064910] kvm_vcpu_init+0x26d/0x360 [ 1811.068790] vmx_create_vcpu+0xf3/0x2900 [ 1811.072836] ? __mutex_unlock_slowpath+0x75/0x780 [ 1811.077657] ? drop_futex_key_refs.isra.0+0x17/0x80 [ 1811.082657] ? vmx_vcpu_run+0x1f90/0x1f90 [ 1811.086793] kvm_vm_ioctl+0x49c/0x1430 [ 1811.090665] ? __lock_acquire+0x5f7/0x4620 [ 1811.094888] ? kvm_vcpu_release+0xa0/0xa0 [ 1811.099015] ? trace_hardirqs_on+0x10/0x10 [ 1811.103229] ? check_preemption_disabled+0x35/0x240 [ 1811.108228] ? trace_hardirqs_on+0x10/0x10 [ 1811.112438] ? check_preemption_disabled+0x35/0x240 [ 1811.117436] ? save_trace+0x290/0x290 [ 1811.121222] ? kvm_vcpu_release+0xa0/0xa0 [ 1811.125357] do_vfs_ioctl+0x75a/0xfe0 [ 1811.129138] ? selinux_file_mprotect+0x5c0/0x5c0 [ 1811.133886] ? ioctl_preallocate+0x1a0/0x1a0 [ 1811.138278] ? security_file_ioctl+0x76/0xb0 [ 1811.142667] ? security_file_ioctl+0x83/0xb0 [ 1811.147055] SyS_ioctl+0x7f/0xb0 [ 1811.150402] ? do_vfs_ioctl+0xfe0/0xfe0 [ 1811.154359] do_syscall_64+0x1d5/0x640 [ 1811.158231] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1811.163402] RIP: 0033:0x45ca29 [ 1811.166572] RSP: 002b:00007f1072892c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1811.174261] RAX: ffffffffffffffda RBX: 00000000004e73c0 RCX: 000000000045ca29 [ 1811.181509] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000005 [ 1811.188759] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1811.196007] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 1811.203256] R13: 0000000000000396 R14: 00000000004c62c6 R15: 00007f10728936d4 14:59:02 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 14:59:02 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_TRY_EXT_CTRLS(r3, 0xc0205649, &(0x7f0000000140)={0xa10000, 0xff, 0x2, r4, 0x0, &(0x7f0000000040)={0x9e0001, 0x6, [], @ptr=0x5}}) 14:59:02 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) ppoll(&(0x7f0000000000)=[{r0, 0xf2b0}, {0xffffffffffffffff, 0x200}, {r1}], 0x3, &(0x7f0000000040), &(0x7f0000000080), 0x8) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x800) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) 14:59:03 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10010, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$FUSE_DIRENT(r3, &(0x7f0000000140)={0x30, 0x0, 0x2, [{0x2, 0x1, 0x4, 0x7, 'user'}]}, 0x30) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x500, 0x0) ioctl$VHOST_SET_LOG_FD(r6, 0x4004af07, &(0x7f0000000280)=r0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r5, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="400000000e1420002bbd7000ffdbdf2508003c0001000000080003000400000008003c000300000008003c000300000008000300040040000800010000000000274c8be92880da02bb02d26ad119ed5dfbfb068ff68a96e23221afe041e55ec879f6d19c9527cb855362a56c1897a808b81d602a9476e1f2a2ee02eb8533c58b70f80e3348f133001b8605fefca48288c20e9481f7c24e"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1811.421585] ubi0: attaching mtd0 14:59:03 executing program 1: socket(0x10, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x400, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000200), 0x0) syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:59:03 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0x400f03, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r0, r0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)={0x4, 0x5, 0x4, 0x0, 0x0, {r6, r7/1000+10000}, {0x3, 0x1, 0xa4, 0x50, 0xf3, 0xfa, "5bef68f4"}, 0x5, 0x2, @offset, 0x9, 0x0, r1}) mq_notify(r8, &(0x7f00000002c0)={0x0, 0x38, 0x1, @thr={&(0x7f00000001c0)="1e82a37f117fd2ee5d1229", &(0x7f0000000200)="b89f82e2deb3e23870b07c3f4912aef597bac0de3c1bb6c2d33c3a11f750e4760124691d99e33b405803116b8e860e255158f926dd561a88f48e8279e9875aaee43c94fe14820df2df8f166fd38c83f8923ecebd646cf7b58b0d938e8904282fd41d07a40f2ffbe84bcd96a85db4d530af63e7c07b05ca8587f96c688fd42bde397644e5f13d59822bb949e69539edab5d740817cb299a9da8bd034183e98e8b234e26b37a8e7b4da49a"}}) [ 1811.455229] ubi0: scanning is finished [ 1811.690849] syz-executor.3: page allocation failure: order:0, mode:0x14000c4(GFP_KERNEL|GFP_DMA32), nodemask=(null) [ 1811.756671] syz-executor.3 cpuset=/ mems_allowed=0-1 [ 1811.779417] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1811.783110] CPU: 0 PID: 1204 Comm: syz-executor.3 Not tainted 4.14.180-syzkaller #0 [ 1811.794117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1811.803467] Call Trace: [ 1811.806065] dump_stack+0x13e/0x194 [ 1811.809701] warn_alloc.cold+0x96/0x1af [ 1811.813807] ? zone_watermark_ok_safe+0x280/0x280 [ 1811.818660] ? wait_for_completion+0x390/0x390 [ 1811.819401] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1811.823242] __alloc_pages_slowpath+0x2114/0x26c0 [ 1811.823272] ? warn_alloc+0xf0/0xf0 [ 1811.823283] ? find_held_lock+0x2d/0x110 [ 1811.823295] ? fs_reclaim_acquire+0x10/0x10 [ 1811.823323] __alloc_pages_nodemask+0x5d3/0x700 [ 1811.851233] ? rcu_read_lock_sched_held+0x10a/0x130 [ 1811.856243] ? __alloc_pages_nodemask+0x5e0/0x700 [ 1811.861079] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 1811.866106] alloc_pages_current+0xe7/0x1e0 [ 1811.870427] kvm_mmu_create+0xd1/0x1c0 [ 1811.874322] kvm_arch_vcpu_init+0x28b/0x8b0 [ 1811.878756] ? alloc_pages_current+0xef/0x1e0 [ 1811.880377] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1811.883247] kvm_vcpu_init+0x26d/0x360 [ 1811.883263] vmx_create_vcpu+0xf3/0x2900 [ 1811.883281] ? __mutex_unlock_slowpath+0x75/0x780 [ 1811.883293] ? drop_futex_key_refs.isra.0+0x17/0x80 [ 1811.883306] ? vmx_vcpu_run+0x1f90/0x1f90 [ 1811.883324] kvm_vm_ioctl+0x49c/0x1430 [ 1811.883337] ? __lock_acquire+0x5f7/0x4620 [ 1811.883351] ? kvm_vcpu_release+0xa0/0xa0 [ 1811.923638] ? trace_hardirqs_on+0x10/0x10 [ 1811.927871] ? check_preemption_disabled+0x35/0x240 [ 1811.932889] ? trace_hardirqs_on+0x10/0x10 [ 1811.936305] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1811.937111] ? check_preemption_disabled+0x35/0x240 [ 1811.937127] ? save_trace+0x290/0x290 [ 1811.952564] ? kvm_vcpu_release+0xa0/0xa0 [ 1811.956714] do_vfs_ioctl+0x75a/0xfe0 [ 1811.960514] ? selinux_file_mprotect+0x5c0/0x5c0 [ 1811.965265] ? ioctl_preallocate+0x1a0/0x1a0 [ 1811.969691] ? security_file_ioctl+0x76/0xb0 [ 1811.974092] ? security_file_ioctl+0x83/0xb0 [ 1811.978502] SyS_ioctl+0x7f/0xb0 [ 1811.981860] ? do_vfs_ioctl+0xfe0/0xfe0 [ 1811.982036] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1811.985825] do_syscall_64+0x1d5/0x640 [ 1811.985845] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1811.985854] RIP: 0033:0x45ca29 [ 1811.985860] RSP: 002b:00007f1072871c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1811.985871] RAX: ffffffffffffffda RBX: 00000000004e73c0 RCX: 000000000045ca29 [ 1811.985877] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000005 14:59:03 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x22480, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x4, &(0x7f0000000240)=@framed={{}, [@alu={0x8000000201a7fe3, 0x0, 0x7, 0x61, 0x0, 0x43}]}, &(0x7f0000000200)='syzkaller\x00', 0x5, 0xfb, &(0x7f00001a7f05)=""/251, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r3, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={r4}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r0, r2, 0x0, 0x7, &(0x7f0000000140)='cgroup\x00', r4}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)='\x00', r5}, 0x30) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r6, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r6, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r7, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r6, 0x84, 0x17, 0x0, 0x0) [ 1811.985883] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1811.985903] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 1811.985916] R13: 0000000000000396 R14: 00000000004c62c6 R15: 00007f10728726d4 [ 1812.014843] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1812.194804] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1812.230473] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1812.261877] ubi0: background thread "ubi_bgt0d" started, PID 1258 [ 1812.268342] ubi0: detaching mtd0 [ 1812.283325] ubi0: mtd0 is detached [ 1812.323616] warn_alloc_show_mem: 1 callbacks suppressed [ 1812.323620] Mem-Info: [ 1812.367458] active_anon:1007010 inactive_anon:19888 isolated_anon:0 [ 1812.367458] active_file:14911 inactive_file:14034 isolated_file:0 [ 1812.367458] unevictable:0 dirty:38 writeback:0 unstable:0 [ 1812.367458] slab_reclaimable:17604 slab_unreclaimable:151502 [ 1812.367458] mapped:63852 shmem:27483 pagetables:32406 bounce:0 [ 1812.367458] free:253818 free_pcp:589 free_cma:0 [ 1812.468330] Node 0 active_anon:1922924kB inactive_anon:16152kB active_file:8kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:217544kB dirty:4kB writeback:0kB shmem:22980kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 1271808kB writeback_tmp:0kB unstable:0kB all_unreclaimable? yes [ 1812.496778] Node 1 active_anon:2105116kB inactive_anon:63400kB active_file:59636kB inactive_file:57036kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:37864kB dirty:148kB writeback:0kB shmem:86952kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 1812.525736] Node 0 DMA free:10340kB min:220kB low:272kB high:324kB active_anon:4680kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:32kB pagetables:8kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1812.552451] lowmem_reserve[]: 0 2557 2557 2557 2557 [ 1812.559548] Node 0 DMA32 free:30816kB min:36272kB low:45340kB high:54408kB active_anon:1918244kB inactive_anon:16152kB active_file:8kB inactive_file:0kB unevictable:0kB writepending:4kB present:3129332kB managed:2621260kB mlocked:0kB kernel_stack:12800kB pagetables:39180kB bounce:0kB free_pcp:976kB local_pcp:596kB free_cma:0kB [ 1812.589012] lowmem_reserve[]: 0 0 0 0 0 [ 1812.593052] Node 0 Normal free:0kB min:4kB low:4kB high:4kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:344kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1812.618662] lowmem_reserve[]: 0 0 0 0 0 [ 1812.622659] Node 1 Normal free:976936kB min:53612kB low:67012kB high:80412kB active_anon:2102644kB inactive_anon:63396kB active_file:59628kB inactive_file:57036kB unevictable:0kB writepending:268kB present:3932160kB managed:3870192kB mlocked:0kB kernel_stack:32160kB pagetables:90308kB bounce:0kB free_pcp:752kB local_pcp:696kB free_cma:0kB [ 1812.652961] lowmem_reserve[]: 0 0 0 0 0 [ 1812.657069] Node 0 DMA: 9*4kB (UME) 4*8kB (U) 2*16kB (UE) 2*32kB (ME) 1*64kB (E) 3*128kB (UME) 2*256kB (ME) 2*512kB (UE) 2*1024kB (ME) 1*2048kB (E) 1*4096kB (M) = 10340kB [ 1812.673346] Node 0 DMA32: 1188*4kB (UMEH) 846*8kB (UMEH) 352*16kB (UME) 427*32kB (UEH) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 30816kB [ 1812.687797] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1812.699178] Node 1 Normal: 393*4kB (UM) 561*8kB (UM) 136*16kB (UME) 332*32kB (UME) 75*64kB (UME) 27*128kB (UME) 27*256kB (UME) 13*512kB (UM) 4*1024kB (UM) 3*2048kB (UE) 226*4096kB (M) = 976620kB [ 1812.716882] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1812.725853] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1812.734597] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1812.743461] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1812.752198] 56659 total pagecache pages [ 1812.756258] 0 pages in swap cache [ 1812.759698] Swap cache stats: add 0, delete 0, find 0/0 [ 1812.765167] Free swap = 0kB 14:59:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000fddfff)) r1 = syz_open_pts(r0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x0) 14:59:04 executing program 5: r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f00000000c0)="1c00000016009b8a14e5f407000904240a000003ff00000000000000", 0x1c) 14:59:04 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@generic={0x3}) 14:59:04 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) accept4$tipc(r3, &(0x7f00000000c0)=@name, &(0x7f0000000140)=0x10, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:04 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3f0e}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000240)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f0000000140)={&(0x7f0000000040)=[0x24eba957], 0x1, 0x0, 0x2, 0x3, 0xffffffe1, 0x1, 0x2, {0xfffffc00, 0x6, 0x1, 0x1, 0x8, 0x0, 0x3, 0x3, 0x8, 0x8, 0xffff, 0xfc01, 0x822, 0x1f, "f3fe0745280fd34e7b76b78df3b600e599cafd06eedb3098f85af1acc1e51e2c"}}) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$SIOCAX25CTLCON(r5, 0x89e8, &(0x7f00000001c0)={@bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x9, 0xfffffffffffffffb, 0x2, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:04 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r3, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x158, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x400}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_NODE={0x2c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffff0001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0xec, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb93a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xfffffeca, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_BOOT_CPU_ID(r3, 0xae78, &(0x7f0000000040)=0x1) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) r6 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r7) ioctl$SIOCAX25DELUID(r0, 0x89e2, &(0x7f0000000140)={0x3, @null, r7}) [ 1812.768193] Total swap = 0kB [ 1812.771186] 1965979 pages RAM [ 1812.774391] 0 pages HighMem/MovableOnly [ 1812.778353] 339053 pages reserved [ 1812.781788] 0 pages cma reserved 14:59:04 executing program 1: 14:59:04 executing program 5: 14:59:04 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x220, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x3, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:04 executing program 3: 14:59:04 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getdents(r2, &(0x7f00000000c0)=""/17, 0x11) r3 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x7f, 0x20690, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000200)={&(0x7f0000000180)=[0xd4000000, 0x6e], &(0x7f00000001c0)=[0x0], 0x2, 0x10000, 0xc0c0c0c0}) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r4, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x4, @perf_bp={&(0x7f0000000240), 0x8}, 0x0, 0x0, 0xfffffffd, 0x0, 0x20000000002, 0x5}, r3, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000140)=0xffffff01) r7 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r7, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r4, 0x84, 0x17, 0x0, 0x0) 14:59:04 executing program 1: [ 1812.962772] ubi0: attaching mtd0 14:59:04 executing program 5: 14:59:04 executing program 3: [ 1813.013904] ubi0: scanning is finished 14:59:04 executing program 1: 14:59:04 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f00000000c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0x40a85323, &(0x7f0000000140)={{0xf6, 0x6}, 'port1\x00', 0x0, 0x40000, 0x66f, 0x5, 0x2, 0x1, 0x1ff, 0x0, 0x1, 0x5c}) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:04 executing program 1: 14:59:04 executing program 5: 14:59:04 executing program 3: 14:59:04 executing program 5: [ 1813.258869] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1813.268322] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1813.291126] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1813.304534] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1813.319184] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1813.332777] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1813.347476] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:05 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() prctl$PR_MCE_KILL_GET(0x22) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:05 executing program 1: 14:59:05 executing program 3: 14:59:05 executing program 5: [ 1813.367091] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1813.386754] ubi0: background thread "ubi_bgt0d" started, PID 1325 [ 1813.395685] ubi: mtd0 is already attached to ubi0 14:59:05 executing program 1: 14:59:05 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:05 executing program 5: 14:59:05 executing program 3: [ 1813.478236] ubi0: detaching mtd0 14:59:05 executing program 1: [ 1813.525570] ubi0: mtd0 is detached [ 1813.541064] ubi0: attaching mtd0 14:59:05 executing program 3: 14:59:05 executing program 5: [ 1813.570998] ubi0: scanning is finished 14:59:05 executing program 1: [ 1813.790021] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1813.798190] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1813.806454] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1813.813373] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1813.821715] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1813.829245] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 14:59:05 executing program 5: 14:59:05 executing program 3: 14:59:05 executing program 1: 14:59:05 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000300)={{{@in=@multicast1, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@private2}}, &(0x7f0000000400)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000680)={&(0x7f0000000580)={0xc4, 0x0, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKSTATE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_LINKSTATE_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_LINKSTATE_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKSTATE_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x24000090}, 0x1) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0112000000009ac70000090000003c00030014000600ff090000002e000000000000000000010800030000000000140002007663616e3000000000000000000000000800010002"], 0x50}}, 0x0) sendmsg$IPVS_CMD_SET_DEST(r5, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f00000007c0)={0xcc, r7, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x60, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x31}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x36a}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x34}}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'sit0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xeb}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010101}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xe2a4}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20040090}, 0x20000055) r8 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r8, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r8, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:05 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000480)={0xa, 0x4, 0xfa00, {r4}}, 0xc) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x800, @local, 0x8}, r4}}, 0x30) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1813.839009] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1813.849489] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1813.860388] ubi0: background thread "ubi_bgt0d" started, PID 1364 14:59:05 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0xc}, 0x50400, 0x7f}, 0x0, 0x0, r0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:05 executing program 5: 14:59:05 executing program 1: 14:59:05 executing program 3: [ 1813.955800] ubi0: detaching mtd0 [ 1813.961727] ubi0: mtd0 is detached 14:59:05 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000280), &(0x7f00000002c0)=0x4) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) ioctl$VHOST_SET_LOG_BASE(r3, 0x4008af04, &(0x7f0000000240)=&(0x7f0000000200)) ioctl$EVIOCSREP(r3, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) fstatfs(r4, &(0x7f0000000140)=""/190) r5 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000000), 0x4) kcmp(r2, 0x0, 0x2, 0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r3, 0x84, 0x17, 0x0, 0x0) 14:59:05 executing program 5: 14:59:05 executing program 1: 14:59:05 executing program 3: 14:59:05 executing program 3: 14:59:05 executing program 1: [ 1814.076632] IPVS: Error joining to the multicast group 14:59:05 executing program 3: 14:59:05 executing program 5: 14:59:05 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7f, 0x21009, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x1}, r1, 0xffffffffffffffff, r3, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000040)={0x8000000000000000, 0x10000, 0x6aec, 0x4, 0x9}) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r6 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(0xffffffffffffffff, 0xc06c4124, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$SOUND_OLD_MIXER_INFO(r0, 0x80304d65, &(0x7f0000000140)) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:05 executing program 1: 14:59:05 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x42001, 0x0) gettid() r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={{0x1, 0x0, @descriptor="1b4c9a351760dc8e"}, 0xc4, [], "10646abd4149e6d18fd03838d5e4deb1baa1f2c34931a87c490e42c7fd10e804f5bdc8f182fe0fbc1c2571eb80a77581221dc42c49765a4cc06931a34f6d8a66b9c421bd901849f0f9c25ab341eb2ba1ab69c765c1741e8c0a5be85479ee483b37b75311c5ab4187ddae0536e0736c56dadc438e0a0953cd9f8c76a0d0d07af42744cc98376d81e8e893ea378952068847a7dd2d77d8ef8f06dee6774d8927884aa8dccb63f6d17e65634a582547ac1db179bdd771e64dd1ec7666f483ff7d02e46624fa"}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_int(r1, 0x0, 0xe, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:05 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, @perf_config_ext={0x4, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, r2, 0x6) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:05 executing program 3: 14:59:05 executing program 5: 14:59:05 executing program 1: 14:59:05 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x40, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:05 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:05 executing program 3: 14:59:06 executing program 1: 14:59:06 executing program 5: 14:59:06 executing program 3: [ 1814.388278] ubi0: attaching mtd0 [ 1814.400084] ubi0: scanning is finished 14:59:06 executing program 1: 14:59:06 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140)='NLBL_CALIPSO\x00') sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x100, 0x70bd2d, 0x5, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4000040) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32=r4, @ANYRES64], 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x8080) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240), 0x10, &(0x7f0000000300)={&(0x7f0000000280)=@canfd={{0x2, 0x0, 0x0, 0x1}, 0x33, 0x1, 0x0, 0x0, "5211987b83dd03a0a75c58036bfd61a52be878f7343f5ca42891c0b415553f19b1103adf4905d65d3babb3658d8fecc69a976ceab1cb5decbbc3ef1816b711ba"}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x240040c4) r5 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r6, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r6, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffff}, 0x0, 0x0, 0x3, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace$cont(0x7, r5, 0x60b9f73e, 0x0) r7 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r7, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r6, 0x84, 0x17, 0x0, 0x0) 14:59:06 executing program 5: 14:59:06 executing program 3: 14:59:06 executing program 1: 14:59:06 executing program 5: [ 1814.590524] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1814.597605] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1814.605338] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1814.611677] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1814.631733] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1814.641326] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1814.650122] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1814.660044] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1814.670528] ubi0: background thread "ubi_bgt0d" started, PID 1446 [ 1814.681468] ubi0: detaching mtd0 14:59:06 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() prlimit64(0x0, 0xe, &(0x7f0000000240)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000006040)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)=""/8, 0x8}], 0x1, &(0x7f0000000480)=""/144, 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000005c0)=""/10, 0xa}], 0x1, &(0x7f0000000640)=""/91, 0x5b}, 0xc}, {{0x0, 0x0, 0x0}, 0x8001}, {{&(0x7f0000005f40)=@generic, 0x80, &(0x7f0000006000)}, 0x1}], 0x4, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f00000006c0)={0x800, 0xed1, 0x5, 0x1f, 0x5, [{0x5, 0x8, 0x101, [], 0x1000}, {0x2bda, 0x400, 0x2, [], 0x903}, {0x8, 0x400, 0x400, [], 0x1000}, {0x80000001, 0x6, 0xb7af, [], 0x600}, {0x996, 0xffff, 0xffffffffffff0001, [], 0x2000}]}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000400)='/dev/fuse\x00', 0x2, 0x0) write$P9_RLOCK(r3, &(0x7f0000000100)={0x8, 0x35, 0x2}, 0x8) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002780)={&(0x7f0000001040)=ANY=[@ANYBLOB="d4050000", @ANYRES16=0x0, @ANYBLOB="00032cbd7000010000000200000008000100", @ANYRES32=0x0, @ANYBLOB="400002803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="400102803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f74785f686173685f6c6f5f706f72745f6d617070696e67040000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000100000008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f706f72745f7374617473000000000000000000", @ANYRES32=0x0, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000e00040062726f61646361737400000008000100", @ANYRES32=0x0, @ANYBLOB="9c01028040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000300000008000600", @ANYRES32=0x0, @ANYBLOB="6c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000003c000400a809837b400e000081000608018000004000dcfb0700000006000501080000000100660603000000f7ff080000020000ff000101355afe3b40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000600000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000050003000300000008000400b00000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000568d20003000300000400030000000800929da10efae5df4e29280ea9548a4e24f8bff0bf0c47072501c0a19da0c9ba6da16d75ecafee30b3f859380d31c03d5265204f509ff749a8371e0715cdfed506045ea3cbf7537c5ae99f04d5fa1ecff13ddc10e15a03c78000bd2dfcb4867adf40710d24cf93add2017cd049d3b1ad84a551822b3cc3183270e6b5b42a9019bc8f83330c248b3027d181290c009ddeff806a69047ea877df8affce84900149125605d9fd8d0d05b489020d62a30ebf6c1400d5833249263e0beb99a5b829672d1cc4fdc9df5148407e0ab6353ca3d624a148b62092e9fc868659291dca5f001d4f79b3b9", @ANYRESOCT=r2, @ANYBLOB="8800028038000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000050003000300000008000400030000004c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000019000400686173685f746f5f706f72745f6d617070696e670000000008000100", @ANYRES32=0x0, @ANYBLOB="2801028038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400040000003c9c7f82ba000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000000000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004008000000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400060b000008000100", @ANYRES32=0x0, @ANYBLOB="7800028074000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b000000440004000180090908000000ff7f01080300000002008100000000000b0008240700000001f000003f000000000207090300000033d3064d08000000090000000100010008000100", @ANYRES32, @ANYBLOB="44000280400001002400010071756575655f696400000000000000000000000000000000000000000000000005000300030000000800040001fcffff08000600", @ANYRES32=0x0, @ANYBLOB], 0x5d4}, 0x1, 0x0, 0x0, 0x800}, 0x8044) [ 1814.688854] ubi0: mtd0 is detached 14:59:06 executing program 1: 14:59:06 executing program 3: 14:59:06 executing program 5: 14:59:06 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x9) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000180), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:06 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x20000, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x4, r3}, 0x10) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa, 0x2, 0x8}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1814.777859] ubi0: attaching mtd0 [ 1814.787177] ubi0: scanning is finished 14:59:06 executing program 3: 14:59:06 executing program 1: 14:59:06 executing program 5: 14:59:06 executing program 1: 14:59:06 executing program 3: 14:59:06 executing program 5: 14:59:06 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x80002, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x1}, 0x406, 0xfffffffffffffffe}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000280)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) r4 = getpid() getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f00000001c0), &(0x7f0000000200)=0x4) sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$FUSE_LK(r7, &(0x7f0000000240)={0x28, 0x0, 0x4, {{0x20, 0x1000, 0x1, r1}}}, 0x28) 14:59:06 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f0000000040)) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:06 executing program 3: 14:59:06 executing program 5: [ 1815.007614] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1815.029899] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1815.106765] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1815.113024] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1815.148058] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1815.155684] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1815.162987] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1815.175327] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1815.187145] ubi0: background thread "ubi_bgt0d" started, PID 1490 [ 1815.187255] ubi0: detaching mtd0 14:59:06 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r2, 0xffff, 0x20, 0x1, 0x3}, &(0x7f0000000140)=0x18) 14:59:06 executing program 1: 14:59:06 executing program 3: [ 1815.203307] ubi0: mtd0 is detached [ 1815.208525] ubi0: attaching mtd0 [ 1815.223730] ubi0: scanning is finished 14:59:06 executing program 5: 14:59:06 executing program 3: [ 1815.360864] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1815.368660] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1815.378308] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1815.386604] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1815.393655] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1815.401416] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1815.411455] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1815.422511] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1815.444458] ubi0: background thread "ubi_bgt0d" started, PID 1519 [ 1815.450989] ubi: mtd0 is already attached to ubi0 14:59:07 executing program 1: 14:59:07 executing program 3: 14:59:07 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x8, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x3402}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:07 executing program 5: [ 1815.457431] ubi: mtd0 is already attached to ubi0 [ 1815.467026] ubi0: detaching mtd0 [ 1815.483946] ubi0: mtd0 is detached 14:59:07 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x281, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x200000, 0x0) sendfile(r3, r4, &(0x7f0000000040)=0x7, 0x8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:07 executing program 3: 14:59:07 executing program 1: 14:59:07 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) ptrace$cont(0x7, r1, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) r4 = getpid() r5 = getpid() sched_setattr(r5, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r5, &(0x7f0000000200)={0xfffffe11, 0x2, 0x0, 0x80, 0x9, 0xfffffffffffffffc, 0x6, 0xfffffffffffffffc, 0x100004}, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1e0000003701000004000000000000000900000000000000", @ANYRES32=r4, @ANYBLOB="a81e"], 0x1e) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, 0x0, 0x0) [ 1815.571420] ubi0: attaching mtd0 14:59:07 executing program 5: [ 1815.596887] ubi0: scanning is finished 14:59:07 executing program 3: 14:59:07 executing program 1: 14:59:07 executing program 5: 14:59:07 executing program 3: 14:59:07 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa6175037958e271f60d25b7977f02008b5e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07f34e4d5b318e2ec0efd49897a74a0091ff110026e6d2efe31ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e368d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a17e3c184b751c51160fbcbbf35b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e711327ef01fb6c86adac12233faa1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227db6436303767d2e24f29a5dad9696ec5697a6ea0182babc18cae2ed4b4390af9a9ceafd07fd00b0100002cab154ad029a119ca3c97278087001460af81c5f4adaddd1410e80207c14140c427dc16e8b00d5ee4e5e3ae703f8ea4c3dab45f912191f9df3d7c0cf0ea4f31d062d3d6e1d09f0479c9fb41c8da4d9f118caa80bd17557d8ee655010840331c9825f9386cb5c8f7e49348d27d915b8e9349b17f7aab0d75690d78d5f14805e127ca2aa3beea073a77127fbe389324001aaae7efad93aa48d33a01e41fb31722c8e3b4e7d7bfa6415c000000e71db299396591fb8197e4e84aa17ae2f75f4c49b552748a54d1ef8ee18449a2dbf3c778e86cc74307267206abb801426c3e956d42014a0bd51815e17b489de1461f3d79b87c3ac774f9bb79d88a089cddf2155073000000000000003dd380a1af2486d6ccf4918aa275000000000000586f29b0d012620e7f847daa3a0eebea812c70a0a7111a62ef04723649a40e134a70c0873643e4a6632d605e450d36ee321e02c6c17aa5dd18f6652bae1b3512ac48c8479966ca333a3bbc3f20b693848458f8fe20a6f3263b4b1f96f08aa3b4c92fa4fa9f0569c0ec8395f95187e72a9e700352a3d46462ef3eb5beb7aec0b09f45b2f0ac6b494a822e0096dc6ee996b7f66eaa0922004bbc9d40cb94072c865214a3e921408d6b3f6d000aa7955729ac9098e28d733b930000000000000000000000000000000000000000000000000000000000007811e78852648ed31eb461bbf29a0633853bee0b86748c746b530dbe5ab44995dd7806f5483e300bd2c182848a23e25bac0e27e43b62166ad0ec2235513e9950eab32c53e104f989e408586a9a9209317bd2f077166c51798bbbccfd6a7d96ce147fd504d47fef4e0b36fa5373a71fa973efa67c4b862408889860dcb6f33d812ed83edecf942544f8aa39d19de948a7a5439070cf5a435a411b8610f4edea993d4e5a19063307476c4803e832083f3d17f78a188c5efa72b68dbd09ceb62ececfa4f5675d5d9cdceb0b000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0xfffffffffffffe7f, &(0x7f0000000500)="b9ff0300600d698cb89e14f043051fffffff00004000632f77fbac14140ee0f0000162079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x102, 0x60000000, 0x0, 0xfffffffffffffe48, &(0x7f0000000000), &(0x7f00000000c0)="61ae793cb58796e98bec67538e015077de7e272f4c58590e0a49abbb02864ce87f29c55242edc400de0f90b385e2f9c937fd3b232ab7c99460628f97e6d6f935e88684d642fd966756e2d8b5af7a9002d71c203c4dd9b55ae6eb91e77d823ca1a2de2496a532933552dfb5907808176243ef5971c1a9c84ebfbd113d1a233ed5490f124afc9b88bc97d734a20b1e"}, 0x28) [ 1815.747008] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1815.756897] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1815.765669] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1815.774855] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1815.792372] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1815.822551] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1815.856248] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1815.920532] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1815.953256] ubi0: detaching mtd0 [ 1815.953324] ubi0: background thread "ubi_bgt0d" started, PID 1548 [ 1815.970093] ubi0: mtd0 is detached [ 1815.974179] ubi0: attaching mtd0 [ 1815.978995] ubi0: scanning is finished [ 1816.075431] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1816.084746] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1816.092059] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1816.100387] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1816.108216] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1816.115197] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1816.122603] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1816.133037] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1816.143262] ubi0: background thread "ubi_bgt0d" started, PID 1563 [ 1816.151504] ubi0: detaching mtd0 [ 1816.172664] ubi0: mtd0 is detached 14:59:07 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = gettid() perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x200}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) uselib(&(0x7f0000000040)='./file0\x00') ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x5, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:07 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000e40)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002f3753a9c3b630bf92dd696125265586f2043649b89eb3b91dc174d5701424fa24052b2fe97409000000058e4bf0391702519694cd73608fadb119a5ffc8f1460c55bcce412bc1cc14a1f64ad78f7efc6f2251217bae2233bacac999cbb0468424c2e8ab6cafc7bed22704254d5e3e970ab940986c4ef20a09f4a46c382c1e7016a71a704c7b3cddf5306b500fda7b4a72bcdb7c33a4c7e1f0c42819df5c26d28b450e2a9980b62fe2a57ac040892270e005a2e4ead36494a405cb04000000b544edf5491d98896b66851b823d3dc390934ea9062dd57a13ddb0ce78dbf6619bb0148e4dbb7ac738e4eb6e8061fa9d376fd0a4abf451611aa4aca0816a07a126f3a4453f7c12035ab1b2b55c098a78182c4651c0c3b019f94858fb0dc2ebd1ec689d889bf0839369cf226260dbed7b9493f9c8c764310e79aa8bd1e9e2371ed3ab91e6a53d265a75ec4fcd4d8b2d06c73ca7efec28b59fbeccfa1dbcd25032f328223bc33acc2449b6e9da679198772e8e84f4cf1cc7f3886628dcc16c8ff17ff6ca528ef87741fc3e0f242a1037df395cbf0a99070700c17f704441360695072ca871e4c957552588ffe778b60794a8eccd0000887fad5755245963cd49619b6f87c86689c0e098ea15e8cc37f91c0d8fbe61e4ff8c85a2afba06844f5cad1ea6c07d5acd741b6442884dd99c95c41e180093a9f129db50c1e6ac5653fcf0b3c8fc57d51754bbeea6c676de473f5ed80b539dc9382faa75c7183de5de8b821433923feefe4457bfaad2e64a2cb3bd293dc991718b48e2502e8656a4f09cb67746496e4500000000000000000000000000b0990670db219d5b3ee8db3096ca6aee1264b6e004af0ebe6f39a2e080476c2e82f755eaf3f8f92f55b3cfcaf05893c6fb80e8ebaf01132fee3e6b55c2a5509243799f88c4b53d0e4e812b3e88ea5aee9e7c2e49cb7c55d211631130ff3c6fbc2bd09eb001cc6c81a3eb0bb48ba89bc03e91ffc567ed277001b9b587c6bbd708556af31aa5d3d7f6cb7d9f977702f5ab58d887"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0xe, 0x900, &(0x7f00000006c0)="b9ff0300000d698cb89e40f088a8d501890600de0500000077fb7f11c72be9", 0x0, 0x100}, 0x28) 14:59:07 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x1, 0x3, 0x101}, 0x14}}, 0x0) 14:59:07 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000040)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) socket(0x0, 0x0, 0x0) poll(0x0, 0x0, 0x204) clock_gettime(0x0, &(0x7f00000000c0)) futex(&(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0) 14:59:07 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext={0x3}, 0x80000, 0x0, 0x0, 0x3, 0x100, 0xfffffffe}, 0x0, 0x6, r0, 0x2) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r3, 0x40bc5311, &(0x7f00000001c0)={0x20, 0x1, 'client1\x00', 0xffffffff80000002, "e1d444e79a327be9", "092944bad187830a43c40279b49fe039bd0acbe6556fb4e1f1294ed0384e71a0", 0x80000001, 0x5}) r4 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:07 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/btrfs-control\x00', 0x80, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e20, @remote}}, 0x0, 0x8, 0x302494e6, 0x1000, 0x99}, &(0x7f0000000240)=0x98) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000003c0)=@assoc_value={r3, 0x2}, 0x8) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r5, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xb0, 0x4, 0x8, 0x5, 0x0, 0x0, {0x1}}, 0xb0}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xb, &(0x7f0000000400)="52cf31e4f314c92c0e79293ec45c6f183a540ddfbc5e10dcd81aa0347a62216a27f531a23ade1a3bd10a5e68084e27e77be11e7dbbb104ac6fe648eadce45e49582e98d3dac0ebdd79c768de3051a1", 0x4f) gettid() perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r6, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r7, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1816.268253] ubi0: attaching mtd0 14:59:07 executing program 3: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0, 0xfe}, 0x20) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1816.304999] ubi0: scanning is finished 14:59:08 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x0, 0x8]) 14:59:08 executing program 3: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ttyS3\x00', 0x86c01, 0x0) [ 1816.430080] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1816.440706] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1816.453467] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1816.460148] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1816.468828] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:08 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa6175037958e271f60d25b7977f02008b5e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07f34e4d5b318e2ec0efd49897a74a0091ff110026e6d2efe31ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e368d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a17e3c184b751c51160fbcbbf35b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e711327ef01fb6c86adac12233faa1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227db6436303767d2e24f29a5dad9696ec5697a6ea0182babc18cae2ed4b4390af9a9ceafd07fd00b0100002cab154ad029a119ca3c97278087001460af81c5f4adaddd1410e80207c14140c427dc16e8b00d5ee4e5e3ae703f8ea4c3dab45f912191f9df3d7c0cf0ea4f31d062d3d6e1d09f0479c9fb41c8da4d9f118caa80bd17557d8ee655010840331c9825f9386cb5c8f7e49348d27d915b8e9349b17f7aab0d75690d78d5f14805e127ca2aa3beea073a77127fbe389324001aaae7efad93aa48d33a01e41fb31722c8e3b4e7d7bfa6415c000000e71db299396591fb8197e4e84aa17ae2f75f4c49b552748a54d1ef8ee18449a2dbf3c778e86cc74307267206abb801426c3e956d42014a0bd51815e17b489de1461f3d79b87c3ac774f9bb79d88a089cddf2155073000000000000003dd380a1af2486d6ccf4918aa275000000000000586f29b0d012620e7f847daa3a0eebea812c70a0a7111a62ef04723649a40e134a70c0873643e4a6632d605e450d36ee321e02c6c17aa5dd18f6652bae1b3512ac48c8479966ca333a3bbc3f20b693848458f8fe20a6f3263b4b1f96f08aa3b4c92fa4fa9f0569c0ec8395f95187e72a9e700352a3d46462ef3eb5beb7aec0b09f45b2f0ac6b494a822e0096dc6ee996b7f66eaa0922004bbc9d40cb94072c865214a3e921408d6b3f6d000aa7955729ac9098e28d733b930000000000000000000000000000000000000000000000000000000000007811e78852648ed31eb461bbf29a0633853bee0b86748c746b530dbe5ab44995dd7806f5483e300bd2c182848a23e25bac0e27e43b62166ad0ec2235513e9950eab32c53e104f989e408586a9a9209317bd2f077166c51798bbbccfd6a7d96ce147fd504d47fef4e0b36fa5373a71fa973efa67c4b862408889860dcb6f33d812ed83edecf942544f8aa39d19de948a7a5439070cf5a435a411b8610f4edea993d4e5a19063307476c4803e832083f3d17f78a188c5efa72b68dbd09ceb62ececfa4f5675d5d9cdceb0b000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0xfffffffffffffe7f, &(0x7f0000000500)="b9ff0300600d698cb89e14f088481fffffff00004000632977fbac14140ee000000162079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x102, 0x60000000, 0x0, 0xfffffffffffffe48, &(0x7f0000000000), &(0x7f00000000c0)="61ae793cb58796e98bec67538e015077de7e272f4c58590e0a49abbb02864ce87f29c55242edc400de0f90b385e2f9c937fd3b232ab7c99460628f97e6d6f935e88684d642fd966756e2d8b5af7a9002d71c203c4dd9b55ae6eb91e77d823ca1a2de2496a532933552dfb5907808176243ef5971c1a9c84ebfbd113d1a233ed5490f124afc9b88bc97d734a20b1e"}, 0x28) [ 1816.476591] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1816.484271] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1816.495287] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1816.505781] ubi0: background thread "ubi_bgt0d" started, PID 1598 [ 1816.512264] ubi: mtd0 is already attached to ubi0 14:59:08 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000040)={0xc, @multicast2, 0x4e23, 0x4, 'lblc\x00', 0x15, 0x10001, 0x72}, 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_ASSIGN_SET_INTX_MASK(r2, 0x4040aea4, &(0x7f0000000140)={0x7fff, 0x9fb, 0x7, 0x2, 0x8}) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000180)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:08 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$packet(r1, &(0x7f0000000140)="477423072ebff76355137641d7cb67c7a6932ae408e0ea760e37d230c8479c3561c1752d66acbfe7e1b84bcbfe5c6d387175a321c1563fdc87d9c633e9601a37406efa73871573b4da80db6d66cbbfb0cf408cf4fd2014dd243555a975be5b8eba61393428fa160ca4e4801e52aa06c573bed7142344d404df4e6efdaa14405ab502dbf084610aa85d1f0328372e983161273d707267de189048ac7734981fff056ea0720b8fc929c20b0eaed996f5ad8f14be2f0c4644885256a15e59e38b808efdbf31c389c8c74ea63b8135bd37442418554b2613545b447f67f77470e8134a276152c56eb46e0dfb8b3f6e2fb41eb664d4e6dc37934206aaf3c6046d12aa62e056136b4b713fd7c3269292c26a943bd7e2663504d85931fcc169da898d69b3d26c429f10821380b310d8cf337fd07bdb018498c49dbb6ddb6655872ff4c0437b7ed38b9502bc0bc67c25942632cc17998f26ee00e63f5be4b419d5024d8229302fed0260ca9b6e99781a16ae7019b178ee3fe5d11146c756306928147020b092abd68e76d670e2db29bfcbfe102d0cf96e48ab5d5975d39a9bb5831a07a086fb7d0551aca9d4c56c3b00c3ee86d3ecdd096f7806b65770584b7a5a1c17d3c389cd84b74c43507942c0ee0f8b5850182f47533fe4fb5a7a9b77cfc1e74a90908a863ac8923dfe7805c2eb21b9c7d1c050c1d4d58edd671b5875d0470f82606687089ee9c4a53abdf4cf076a4a7ca5c7f3574efc637a4562e11ef69c7ed9a64e8a7e5eb3f57db6f0a79236df40c783184f894d70e2fa6013232cc4e09036247fdbd0d9b58fd0d9a626368e6a21c9c92d0370b002842a556e004e11dc4a0f79403ba1bee5e6643b53d2268be53ccaf316541438ceedd6d8d240c94162b2e4d2db26a655eca4b8f2ff12212ec5964ce29654b46c2cce535d4aa90f121fe636509b076df55d1e1233f5af08028142cad7e012f07a256689ce091b16b1bf1f7c40342512316a8f125b3bf1769e2560e28a929a9ef0c88b50229fe83f6b0350e50e52f420cbb44a8d597a7ec4affe5a19acb7cefaf9a2a6abce46247df68440b8cd3f60c2cc639eb7a0722a074f673cbd117524b614e52d4cf8905f5229ebf6ca0ba287251bd7c42bc8ec9e6253b3d3c2fdbfa3d6a4710850c235579e07a6c85311aa7aa14fbb2450075c9f639bf495afec8853c1ad1149d1d7839aec3afc7dcb2ca98417dbfc73c302199593e0d447df4b5123a1d7c2be3f9537143b011472a57dc68296b4495100578ce3189874e18360adddab3e1a8a5f25ce6568a95dba57905d152840022e8b5e24c6cea33852b24eea2a2d5cf6435e6e18a9c9dd04cec5f4080f00f2dbf001f76781352c5f30392db82365f7027bd5d9b16c5a9fb29681931c3e712d679ffc32fec8a70b6a137df107c03ccb290ebf60f4153348c906fa9fa735d34ca54b7a703b822540e40a14a4aa49d03bd21af628f8bea5616c7e10819b43a96d60287ec53a514e61b44346e23be9da64ffd31fa564636e233bfe64538746de9e37af06c9c8f843c0c06e9a14616c4e76dd998c6c60d170aaab76f6157390f2ab71b6838fcb53a257847922931f00d2133e76b925e3378b305fadee2ed6d08155cc4075303cca4a1b41dbf6bdcc50cf069743b2137bb9a8f828aa05023c7db661ceeb63064b04f4d3ca27838493cdc62ac42d84f95f72d8abee48ccf28a8be913425b7eb1403e35ae19cec2db491d48cee0b2c9d33730c297df440215545f79519cbb6ed4ecd39b2035ff7818e7d0aa9dfbbafc46db0ddbc6f1a06319f974b699e93b41b410fc17b48a94dddbb297aff9b22f19848b5133e560614a49c9bd7a3bcae57531196f5ccac24e08a31c3a3471f9b04b1dad79bc51b29a5199d65bb48fae8c2d992429136c7e54ab1b2182408045e27e4dee45eec700783bd9752438b2159539fe966721d7e768886b3a29a5d8d8beae14ef1d7d8d4d4f84c41a451baad86a3fa5c3468a3f0422aaaed1ac75f35d1d03ab87dbd2f1e395eda0376e9f8b2be84a0eb3de549d8dd7978e56fd2ac7aaa0c2e7a0383ff15096542c09aaa9c29d872f9d8ff253acf3ce941e162c63abd182f0b6c57b3f4a20bf4c885de0d29120e00955b750c9377862a5b0f2009e93dcfbe03c3a557df9da8d8fd62d0f10accc8618210daab11319a3ef4e4426d1addd47a9595dd9d91c835088e6ebb28a8beab3278105c17e9316998f036d2eb47db6a0bf279e740f0f6144e125e18d679b10f5e349e6558526642f8c585a1327dd9d6eed21ae5871dc7278f45351f5cee6ccc053b9cf1486d3d1151de623455f0bcd0bbd32bc3bc98d56f7ea24afe39705015783e8653d7f31d09431c0adf5a91b7df710a409316ac63e687632f5af4baca364e6cba3ca9b93607da94e0d86e47d24b854aadf2389ff1484ec0a1f49a89c7e2e2f8d3a428fc36a7229742ddbbee83957ac13d41a23b35ae1fc6aee98812fec47b22d8110968126177d19d92ce669d4d2f4850e5f49f1e17e65e12da8626c7e3f022c412f2848215e1223a4f339d5d950807793e6559f5ce5967ada2d3913085cf9ea989388f3ea452bd20333816b3db4875fb2c8585dd818aee462e68050392575abfb3994450ed95cc9f68b2b62550d3cbf57c11b76c6c84985cd11ac1119df22fe1dc60dfc715054a6ea01ef8015e544df0b03f9e6351c5ee6a49d812af0433dd7a219068bdb5f9a065ee35590b64d753162218e32cc212e081b628458a8aa9134cd1c9ee81ae98497b53530918f21b1d41192929c0c9c571e724539f9125eb6eb1201fb70689cf02634c422815a2d421fabb7cfdd12ef3744b94985965278fc6f595f5a27d50590cd16638cdf4cf0f2390854027a1613b7b58778b812511ee0a86363fcd7c9790cbcde58700c0c4127a264802078de758a1bce4db6d75c09ee0f6ae793486df003aca63dd90b95f913bf65d8dda9b237ce88b2d5c4a14c47093eaf7bffd0c07dc8a0e500795c4c1961af0078326fd29eb08ad80738f7e96e2e4a6908d5341ab6178dab9fbe8a59c33880d8f6e2904cfa364059758cd9343c674aa089960f80c51fcb15581b38cab06adb4bb12867cfbd847b93c57f658699965b86e848f361587a881b433f22c795cb408c3ff910610e3cd58c831bfc51e2da81e8976663b129837a64d2510605d0917327db8e516752c19f09ccca23d8de16a85c2be9a07244afe4396264038e621d06a1c426988f4c37857d62102f4333bb9604a4e863f7c061c43b6cf6ddcba6c9c0cbed63115bb6842b0687f4ef3a3cce61e5f4448beb08e9b8f78c35ef2f081cc32a8d9aed2a6a5af144276cc652482794cffc5903c02f51a7b5993f997440cc189ef86de14f265ef649476df89c4e45a3df29c053cde4c1547e12dc114869e6c230bfa7311ab030f1bae5b2c7e652add11360eacdd577cc3973dae0c98dbb9b1913f8e66e282ea982b196a9545d3f5b6514dff637412c867b07be27d573c258ed1da25f0fbcabde489ac8555901e994e806993b6a61b6b527d67c0431e296c2e684e27d9b800f102718e5fc424942a7338d2d6769b002581f835e5c80704d0f78caeb5db6c1a04dcb46bebb0cad2096ea233fac408114e3ecbbaef39f50f507cc289640f4ff4edfd40a7566093c8191dbc1c65dcbae4bdcb9f028094f1c7d5b7a19b4d2577a224ca2017c2388682c78762384b570f2bb377155d107b9b6458130e9d276701678e4d8206eac90b754e9307c9bcf375b5be23d4fba537a39c3f1aa2300a29fc858008fa134ea381a367851aac40815211d5dd62e94f048c1fa1113a9f00a9d04a4007e0f387c2c1097fa4b9513c9a6ebf1cf8e832bf3f66ebfef5cde464ec8d5f2b75e823fb51043a20dc2f6f2d779c5d33889e75953ae1c3a6a6cdfe929876497f60e9d6256386e49e1626f1bf2fd609fdb2580341ec6f2b41df3e4b5953727357eece402c4e21a07a9966012debf0f3c29680f86e082a2796023291c500e4fbee97070d6aa45822b77f0648efaf11e83c944a75c7b6bd9cdf5b8b64f18c51e6feae685ba4ce22d3226b8a60354449b2a0785056680b2ea8532193a491c45bc2a41b5d465004aec71db86d4d1366e30783d2045164b77378015b41ddfac2beddf87e9c544a98eb70825d69e678b8da7b110f71bd724194037faa2de44b1327f7c0fa2fe9b5a4390e88fe10f02f4cacd554bb5174ed1f16dddb0984303f518cd4ae718d5f0248f45b462cf869f991cad964635715e51fe7a2a643e819d24f22af6c4f36e9a203901c90b7ecdcab6ffff30d16ae97d2ce4f40963f55a55891b2c0a228cbc2a897b064e1a31d2daedd763adb085aa0cd738a573f5c639bf219b6aed84c43164e0e26c366166bc6586b1c404e5c0ec75088cdc4411fbd3e12a7b012eabe12aa39ec5ad810082e61db9c9c7778e6e45e13bbd303dabf0a303ba16e5e8f54e44c0732dd281705558e78a9e59a017fc63c7055140f43e041d15c636bc104c4895ab2087f9c85cd77b7aab5a76ca987712ce93c50b12833f8b70be06b0f45412743f5f8c45b8ad1d2693b5a4eeb7ee657306541089121978b486730a43b22e6c23c3df8946560d2c33133a5073af8836d2296b5d53375e85cf283e6174ad25e76a5b976c35f27b0e0289b3450f87cdf3875fe2e23413dcb56fd767baa3ffafe0a265aa3d7bee55f90824fc750cfb99a5b8af21f73af6aaf87721a3c2c91a0c33c4601d1bdab235ebb91139e76fa3766b1d8413fc1cd7a3414fe6edeb49ba12822242ad76d6bea68116c6df8b1adc542b16486a907aca74e4387b54e0ff456373700ac455c4d9d40b0382c3c9520f5104d5254315a632a59971a8f6d95c421087d30e0d877db7e5a2921807e4b98654f4a41116fa54ee811227933fcac961b01d315eb1c0f731cb2942dfb55a30b77a5978f4f14a1278d2e86643d872ce2f6dc2ca735041826499ee49eaf4a38280d273836f3b160a5b0b2a0ce03e282ffa994d7a7cb72266780dfded5ab5e61385a441be8f75d8a32f955a53b4bc32c21f2acc8ee2a373cbc3f5ecb763a23410efb5c72f7457181a2c8699fcfd3cc9c0f4146e96dc3f67ab9cc53097113e50590f507d92155e97453ff1b689dd0363dd3496e5063ebe15c62855700b06e6ec1c1b25fc004f26a17f3ab301d6a0e10c953d6910569fc370de94fc47bf2552b88eb0cb0e7f484269c8b9a00dcb251e2db6d7d38269b507af4c089961fef85abade4202fdfcdb9be9cb8fb3b884bd93081364687e9742d7c37b55716730e05d074158cff6ff6c1be1fda3226e2cfdf69a432605be19eb21c3cb82cd2ad0f0e13213e62bd189d0c59135c068b6031020b1b4cfc8681ea3f734df663287a5b83ab5f2c772ab1c0e41c335e9b7986eac6065da679718811e1cbb91514cbbed0958aaeab0849dd2e3f22c85e43ba9722a6de5e63e5bd98b0efe9d6f2759baac374db079482ae798023a929e0a229458d572b2fe7ff7bbd929819489c04ef3403c2313ebaa271e45e820f228a3ddc54873c08aeccbfcc761ab8ca28fd533bb25d316ed082ee322c07796fd67898c736963e81cd39ae38f6f9c631d1cfea55a1e050c8dd12c42f0067cb22486ef4ae948ebe4a475f1c42540aa5172a87210ca7e6448aee567907ec702d3518ef03aa9e385c15c4da5cb4000c3c2e0bbd1af26f1f0c648a9942bdae45c01c8f6711b3fd3c6ca3e75246dfedf975742481a63fbcf0af4d93708c36d7a349d4c226179591ae4820416a2e5a3", 0x1000, 0x54, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, 0x0, 0x0) 14:59:08 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x3c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xd, 0x24, 0x4, 0x1, 0x0, r0}, 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r1, &(0x7f0000000040), 0x0}, 0x20) 14:59:08 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x40000, 0x0) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x10000, 0x0) ioctl$PIO_UNISCRNMAP(r4, 0x4b6a, &(0x7f0000000300)="74ce117fda26fcdedb10a56dce54a237fe8bf2a78dfcd330ed0b7b22e1f848fa897e84ea409fbb8b5cb9379beaedb82c0908c995f285ad5761c97704b75002a21f5ccbf366d9279454f533c86906a5e88f6c8213bd10f6631b4a470cdb7df02926a1db8a79d7e947dffe3df5f4d72dd7ea8e97eabacea11bdfaf5616862f7b23bf3211844294b8421a68fe41fce339793d8aac5337e77bb789c8e40b56b9645b52788fe97963866830d4b05b25a70f8424e43ca75a90dfbc1474ec05ebc8dc54fdf4fde205c223c34b5ea17949b5f44c79632092257901b6be027b796071576eb3a19bd9d648a6e016c1bbde768f1b91529a") perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = dup(r6) sendmsg$IPSET_CMD_SWAP(r7, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x6, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x10044050}, 0x4) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:08 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockname$unix(r0, &(0x7f0000000140), &(0x7f00000000c0)=0x6e) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) [ 1816.654396] ubi0: detaching mtd0 [ 1816.679367] ubi0: mtd0 is detached [ 1816.698533] ubi0: attaching mtd0 [ 1816.752401] ubi0: scanning is finished 14:59:08 executing program 5: socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x0, 0x10000}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) socket$inet_udplite(0x2, 0x2, 0x88) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 14:59:08 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x80044501, &(0x7f0000000000)) 14:59:08 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa6175037958e271f60d25b7977f02008b5e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07f34e4d5b318e2ec0efd49897a74a0091ff110026e6d2efe31ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e368d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a17e3c184b751c51160fbcbbf35b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e711327ef01fb6c86adac12233faa1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227db6436303767d2e24f29a5dad9696ec5697a6ea0182babc18cae2ed4b4390af9a9ceafd07fd00b0100002cab154ad029a119ca3c97278087001460af81c5f4adaddd1410e80207c14140c427dc16e8b00d5ee4e5e3ae703f8ea4c3dab45f912191f9df3d7c0cf0ea4f31d062d3d6e1d09f0479c9fb41c8da4d9f118caa80bd17557d8ee655010840331c9825f9386cb5c8f7e49348d27d915b8e9349b17f7aab0d75690d78d5f14805e127ca2aa3beea073a77127fbe389324001aaae7efad93aa48d33a01e41fb31722c8e3b4e7d7bfa6415c000000e71db299396591fb8197e4e84aa17ae2f75f4c49b552748a54d1ef8ee18449a2dbf3c778e86cc74307267206abb801426c3e956d42014a0bd51815e17b489de1461f3d79b87c3ac774f9bb79d88a089cddf2155073000000000000003dd380a1af2486d6ccf4918aa275000000000000586f29b0d012620e7f847daa3a0eebea812c70a0a7111a62ef04723649a40e134a70c0873643e4a6632d605e450d36ee321e02c6c17aa5dd18f6652bae1b3512ac48c8479966ca333a3bbc3f20b693848458f8fe20a6f3263b4b1f96f08aa3b4c92fa4fa9f0569c0ec8395f95187e72a9e700352a3d46462ef3eb5beb7aec0b09f45b2f0ac6b494a822e0096dc6ee996b7f66eaa0922004bbc9d40cb94072c865214a3e921408d6b3f6d000aa7955729ac9098e28d733b930000000000000000000000000000000000000000000000000000000000007811e78852648ed31eb461bbf29a0633853bee0b86748c746b530dbe5ab44995dd7806f5483e300bd2c182848a23e25bac0e27e43b62166ad0ec2235513e9950eab32c53e104f989e408586a9a9209317bd2f077166c51798bbbccfd6a7d96ce147fd504d47fef4e0b36fa5373a71fa973efa67c4b862408889860dcb6f33d812ed83edecf942544f8aa39d19de948a7a5439070cf5a435a411b8610f4edea993d4e5a19063307476c4803e832083f3d17f78a188c5efa72b68dbd09ceb62ececfa4f5675d5d9cdceb0b000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0xfffffffffffffe7f, &(0x7f0000000500)="b9ff0300600d698cb89e14f088481fffffff00004000632f77fbac14140ee000000162079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x102, 0x60000000, 0x0, 0xfffffffffffffe48, &(0x7f0000000000), &(0x7f00000000c0)="61ae793cb58796e98bec67538e015077de7e272f4c58590e0a49abbb02864ce87f29c55242edc400de0f90b385e2f9c937fd3b232ab7c99460628f97e6d6f935e88684d642fd966756e2d8b5af7a9002d71c203c4dd9b55ae6eb91e77d823ca1a2de2496a532933552dfb5907808176243ef5971c1a9c84ebfbd113d1a233ed5490f124afc9b88bc97d734a20b1e"}, 0x28) 14:59:08 executing program 1: syz_emit_ethernet(0x3e, &(0x7f00000002c0)={@local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x5, 0x0, 0x0, 0x2c00, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @broadcast}}}}}}, 0x0) [ 1817.024290] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1817.049055] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1817.097960] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1817.122863] ubi0: VID header offset: 64 (aligned 64), data offset: 128 14:59:08 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r2, 0xffffffffffffffff) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000940)=@filter={'filter\x00', 0xe, 0x4, 0x350, 0x98, 0x98, 0x0, 0x1f0, 0x1f0, 0x2b8, 0x2b8, 0x2b8, 0x2b8, 0x2b8, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f0}}, {{@uncond, 0x0, 0x130, 0x158, 0x0, {}, [@common=@unspec=@conntrack2={{0xc0, 'conntrack\x00'}, {{@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, [], @ipv6=@dev, [], @ipv6=@mcast1, [], @ipv4=@multicast1}}}]}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@unspec=@cluster={{0x30, 'cluster\x00'}}]}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x3b0) sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967480a41ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044", 0x39, 0x11, 0x0, 0x0) [ 1817.157789] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1817.180491] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1817.208796] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1817.247755] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1817.274755] xt_conntrack: cannot load conntrack support for proto=2 [ 1817.289231] ubi0: detaching mtd0 [ 1817.290188] ubi0: background thread "ubi_bgt0d" started, PID 1645 [ 1817.345951] ubi0: mtd0 is detached 14:59:09 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0112000000009ac70000090000003c00030014000600ff090000002e000000000000000000010800030000000000140002007663616e3000000000000000000000000800010002"], 0x50}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x6c, r4, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x14}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffb}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x40}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x240400c1}, 0x800) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7f, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:09 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsa\x00', 0x40000, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000140)={0x3, r1}) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000300)='/dev/input/mice\x00', 0x4140) getsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000340), 0x4) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, 0x80000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x228, 0x0, 0xfffffff9, 0x0, 0x50793dd4}, 0x0, 0x3, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x10200, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1817.508923] IPVS: Error joining to the multicast group 14:59:09 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1817.585190] ubi0: attaching mtd0 [ 1817.589603] ubi0: scanning is finished 14:59:09 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000c40)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c00)={&(0x7f0000000580)={0x670, 0x0, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [{{0x8}, {0x1ac, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x240000}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x7f}}}, {0x84, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x54, 0x4, [{0x2, 0x80, 0x48, 0xc1}, {0xfff, 0xa2, 0x8, 0x6}, {0x40, 0x5, 0x0, 0x6}, {0x0, 0x8, 0x4, 0x3}, {0x0, 0x70, 0x23, 0x400}, {0x8000, 0x9e, 0xfc, 0x1}, {0x9, 0x5, 0x1, 0x1e6e}, {0x7, 0x9, 0x2, 0xa}, {0x8001, 0x2, 0x6, 0x3}, {0xac10, 0x8, 0x1, 0x7}]}}}]}}, {{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x3ff}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0xff}}}]}}, {{0x8}, {0x1ac, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x1ff}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0xfffffff7}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0xc4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8, 0x4, r3}}, {0x8}}}]}}]}, 0x670}, 0x1, 0x0, 0x0, 0x4004850}, 0x10) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:09 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1817.849222] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1817.867588] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1817.874861] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1817.881389] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1817.890328] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:09 executing program 5: socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x0, 0x10000}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) socket$inet_udplite(0x2, 0x2, 0x88) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) [ 1817.898495] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1817.907068] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1817.919746] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1817.930179] ubi0: background thread "ubi_bgt0d" started, PID 1688 [ 1817.937668] ubi0: detaching mtd0 [ 1817.960261] ubi0: mtd0 is detached 14:59:09 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) mknod(&(0x7f00000000c0)='./file0\x00', 0x200, 0xffff) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:09 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1817.995667] ubi0: attaching mtd0 [ 1818.000010] ubi0: scanning is finished 14:59:09 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1818.067791] xt_conntrack: cannot load conntrack support for proto=2 14:59:09 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1818.178463] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1818.194169] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1818.221850] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1818.222437] IPv6 header not found [ 1818.231987] IPv6 header not found [ 1818.263336] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1818.295132] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1818.320797] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1818.334759] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1818.344323] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1818.354778] ubi0: background thread "ubi_bgt0d" started, PID 1725 [ 1818.361786] ubi0: detaching mtd0 14:59:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:10 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1818.380171] ubi0: mtd0 is detached [ 1818.385557] ubi0: attaching mtd0 [ 1818.396396] ubi0: scanning is finished 14:59:10 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="03000000db0001800900c6ab760f4e0227f1e9170f1c57868d6afd78fb3a711dfe746e879e33a69bd64c15dfc4e7ab1f3b2624758f2f7e7db50ed76e"], 0xa) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1818.498400] IPv6 header not found [ 1818.501886] IPv6 header not found 14:59:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1818.631363] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1818.660320] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1818.677854] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1818.696412] IPv6 header not found [ 1818.700000] IPv6 header not found [ 1818.707641] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1818.728848] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1818.738947] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1818.749125] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1818.767079] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1818.803699] ubi0: background thread "ubi_bgt0d" started, PID 1760 [ 1818.810773] ubi0: detaching mtd0 [ 1818.818642] ubi0: mtd0 is detached 14:59:10 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCL_SCROLLCONSOLE(r2, 0x541c, &(0x7f00000000c0)={0xd, 0x81}) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000040)={0x4, 0x2, 0xfffffffc, 0x4800}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00') sendmsg$BATADV_CMD_SET_VLAN(r6, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14a349091adef3e}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r7, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x1c}}, 0x20000000) 14:59:10 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:10 executing program 5: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semctl$SEM_STAT(0x0, 0x0, 0x12, &(0x7f0000000080)=""/52) 14:59:10 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$TCSETS(r0, 0x5402, &(0x7f00000000c0)={0x0, 0x2, 0x6, 0x3, 0xf, "c3680115118063d020cbb6f313fa3d26b19d5b"}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:10 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PPPIOCGMRU(r3, 0x80047453, &(0x7f00000002c0)) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xa, 0x100010, r4, 0x10ebf000) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f0000000240)={0xa}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="8ae3c769650a0df5a6a5e67ee4b30df005dc831f84a19302bfed7fcd673f85b4851870a79dce215d57d56a2f5ceecc8deb8b059c85041623a5dc8ddbe70bdfbc5e8dd97fd2a4582593b99c84bbc662653480b464663a6dca64cd082f18a2d262be01607101bf174cb7df730822267b8c4f29e9c25042eac89dc599631603cdb172142b2fbfe44acb76534b1098ab27f9781868b1814aac3181d6549581358b8eb4e1616782821cfd79541546884f2d5ab2e704111f9f5f86bd64fe021cfd8ba3d17152a539e111473335d30f2622858dbe4d1d4dccd7f2c7d267c1bed5a5ab4c6798b41e87df7b2cfeb4216fe9efb1a3fda3a439a0241f55c835201e15b74065457f3e27de96e58a32bb4dd37f47561c5f82334ed73c386d97a3fc50777d0e34071d5bd2b6e25a7fbfc2c518100073260d281b76c2173c8faf8f15773132d53fb29f6843e3e159b23451d21ae472dbf4c616d322da61a29d0fcc6eb656298d3d235109294ca1871645d1e21adcc55ede66cadd75cea331b2b4f0e3ae9246c8043c06c42779a90a31915a7fbfb7c47aa0c3a2e1420ff103c0b05389e206849ad81bdf66198dbca05762438260e0183d42d35027de41ae9e845f54329d05385f4bfd06ee8612dca4dad210a5686444f59943e4a19d1e93c065c80a2e86c0a3949d82318abf806313026aad67b9e076bcb07d2d84162db5baf5", @ANYRES16=r8, @ANYBLOB="0112000000009ac70000090000003c00030014000600ff090000002e000000000000000000010800030000000000140002007663616e3000000000000000000000000800010002"], 0x50}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c009800", @ANYRES16=r8, @ANYRES64=r5], 0x1c}, 0x1, 0x0, 0x0, 0x20008851}, 0x4000000) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1818.939892] IPv6 header not found [ 1818.943439] IPv6 header not found 14:59:10 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, &(0x7f0000000140)=0x8) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) ioctl$IMHOLD_L1(r1, 0x80044948, &(0x7f0000000180)=0x1) [ 1819.016857] ubi0: attaching mtd0 14:59:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:10 executing program 5: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semctl$SEM_STAT(0x0, 0x0, 0x12, &(0x7f0000000080)=""/52) [ 1819.061188] ubi0: scanning is finished 14:59:10 executing program 5: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semctl$SEM_STAT(0x0, 0x0, 0x12, &(0x7f0000000080)=""/52) 14:59:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1819.302780] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1819.310648] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1819.319546] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1819.327808] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1819.340734] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r1, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) connect$inet(r3, &(0x7f0000000500)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 1819.348655] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1819.358602] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:11 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1819.394716] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1819.416760] ubi0: background thread "ubi_bgt0d" started, PID 1819 [ 1819.423151] ubi: mtd0 is already attached to ubi0 [ 1819.432267] ubi0: detaching mtd0 [ 1819.446254] ubi0: mtd0 is detached 14:59:11 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000240)=0x1, 0x4) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x28, r3, 0xc573de0d27bdfe6f, 0x0, 0x0, {0x3, 0x0, 0x2500}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="7800000020c2f8eeec40ebf85c1624257b3d8af14e2da470eedc5241ad6872420748d431ce7e941d058e62f5a3dbbe18362e597c41900000000000000056ace1e9680a7819aa6496ac6e89ae294bd4cc", @ANYRES16=r3, @ANYBLOB="00082bbd7000fbdbdf250c00000044000380080002005d06000008000100400000000800020007000000080001000600000008000200030000000800010001000000080002000700000008000100060000002000068004000200080001000100000004000200080001000900000004000200"], 0x78}, 0x1, 0x0, 0x0, 0x4000810}, 0x4004000) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:11 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x8800, 0x0) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x7) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10}}, 0x0, 0xffffffffffffffff, r3, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:11 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:11 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r3}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r3, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000140)={r3, @in6={{0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1ff}}}, &(0x7f0000000040)=0x84) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40088, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x2, 0xfffffffe, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000940)='/dev/dlm-monitor\x00', 0x70b003, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000009c0)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x1c, r5, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x10) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) prctl$PR_GET_NAME(0x10, &(0x7f0000000300)=""/28) 14:59:11 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:11 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r3, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1819.810577] ubi0: attaching mtd0 [ 1819.830270] ubi0: scanning is finished 14:59:11 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1819.874166] Bearer rejected, not supported in standalone mode 14:59:11 executing program 5: [ 1819.989690] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1819.997111] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1820.009285] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 14:59:11 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1820.036404] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1820.052747] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1820.062288] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1820.070137] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:11 executing program 5: [ 1820.088429] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1820.102018] ubi0: background thread "ubi_bgt0d" started, PID 1892 [ 1820.108808] ubi0: detaching mtd0 [ 1820.112859] Bearer rejected, not supported in standalone mode [ 1820.119613] ubi0: mtd0 is detached 14:59:11 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:11 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:11 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0xfffffff9, 0x0, 0x4, 0x40000, 0x6, {r1, r2/1000+60000}, {0x5, 0xc, 0x4, 0x5, 0x1, 0x5, "c05a3bab"}, 0xfffffffe, 0x4, @fd, 0xffffffff, 0x0, r3}) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xd) ioctl$EVIOCSREP(r4, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000000), 0x4) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x28, r6, 0xc573de0d27bdfe6f, 0x0, 0x0, {0x3, 0x0, 0x2500}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c6660df58d46c7c85f8883405eec748d7e63d24e9241b92a05d9f6f5460c65590dcc033297fc6c2badf58aeea669c46164f44324a55a9d5b69f5a1ba7496e00a6bfbad15c64fe9f0cc8b995b2e0a6cc21cb64a8ec9cafd49518ab3eb063757430e1fd5be5bf90762e57c3ad92b8c1f508416903c3b79b3837c50e89307eb8553830ade1ae5501ccae2b7bfa4655e3961aaa5e11bb2dc7710ddfaf96269ffa0d662547082d655f749e7fed4c269fec4db6baf3276f2184767bc5a03a631616edb58bc54f32f6d753c39bf93e512973f64af6d107955e9f18c4c0d125290e2b36aa593f7e4227ce8be549ccf39fff9ed926d00a3c170500fe511d70e28d590043f9a61ab384cf021038ffa5718bc431e2521d202c32319b77197b88f68ed78d98decbffb8743cb310b160df9da10de78d4c0a6f19b9fadd3a86a10d367320dcc448dbd4e662f5a8aba24d8b82854e7d019ab17c2ca2af6ad04d4f917e819473e8ae6", @ANYRES16=r6, @ANYBLOB="000229bd7000fcdbdf250800000034000980080002000002000008000100a1b900000800020047560000080002000600000008000100f95ed13a08000200000000005c00078008000100000000000c000300ff01000000000000080001000100000008000200fffeffff0c0004000000010000000000080001000100008008000100030000000800020009000000080002000400000008000100010000006000078008000200090000000c00040082000000000000000c00040007000000000000000c00030001000000000000000c00030005000000000000000c0004004c000000000000000c00040000000000000000000c0003000400000000000000340006800400020004000200080001000600000008000100e805000004000200040002000400020008000100030000000400020064000480440007800800040007000000080004000104000008000100160000000800030000000000080001001c000000080004006b8600000800030006000000080001000b0000001c0007800800030001000000080002000500000008000200080000000c0006800800010008000000"], 0x1a8}}, 0x4000000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r4, 0x84, 0x17, 0x0, 0x0) 14:59:11 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x0, 0x3, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:11 executing program 5: [ 1820.256860] ip_tables: iptables: counters copy to user failed while replacing table [ 1820.306753] Bearer rejected, not supported in standalone mode [ 1820.325096] ubi0: attaching mtd0 [ 1820.342243] ubi0: scanning is finished [ 1820.376455] Bearer rejected, not supported in standalone mode [ 1820.401670] ip_tables: iptables: counters copy to user failed while replacing table [ 1820.515942] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1820.522951] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1820.537980] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1820.547219] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1820.559112] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1820.568201] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1820.577860] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1820.587957] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1820.597887] ubi0: background thread "ubi_bgt0d" started, PID 1942 [ 1820.607793] ubi0: detaching mtd0 [ 1820.630485] ubi0: mtd0 is detached 14:59:12 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:12 executing program 5: 14:59:12 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:12 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3820, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x9}, 0x0, 0xfffffffffffffffd, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0xb4a0a04637dfe6e7) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000d533c24cd936031e6be4d8169e902654ffc870067f125c69c15c1c2ca5db0a49511e85326490e7d9a4536d0407dd9b6c2c7d8ce53c79814b907c6c46c472523721fe748d7f57d54dddd0b5530709b7c8a0f668b63aa53a0750a4178de1b782106097982cf66d7e0c3a436dc67ec06300bb9032e907c7284b2036536afde9029b4b660217c0f0751f7b7ec72bc495b1f29bbae6507b870629affbfe2a54a8b79faf83ba6f010117a88fb3424c428e3529305c0b143d47f8be796a7c2580ca7b905d13fa04319df25af5452acd5e73472f83e17d2a31a0b62f6bf33bdd69dae81a0cfddcc7dd22cc518ef21c59dc16285ee34dcbc5895c27430feaca8fd7896fc94bc8fbe129bebc3288e85ff4c4b157163fa18d53147623c8d23261ba308580b5f85cff3d3f92e5c37ba2439515d0602cb73eb5237acdc0a6cf2222d7db4de1a4d3f0dbaeee6e59b15607d94d4d94a93eb725d4bd1a49b867cdc177bbbe79557ff53117fe71defd25f2751d4fa2f4457c573c4284d2504357f9f5d201e79f0e6836f903bdfa657ed6acc6985829a142fb433000eb2247a61c18069e", @ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv0\x00', r3}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000400)={@loopback, r5}, 0x14) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r6, 0x29, 0x1, &(0x7f0000000000), 0x4) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x240, 0x0) ioctl$LOOP_GET_STATUS64(r7, 0x4c05, &(0x7f0000000140)) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:12 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) waitid(0x2, r4, &(0x7f0000000140), 0x4, &(0x7f00000001c0)) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) r5 = socket(0x4, 0x4, 0x40) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r5, 0x800448d3, &(0x7f0000000280)={@any, 0x2, 0xe157, 0x5, 0x8, 0x40, "ea43b8bd3184e8e99eae29c2aaa48a0407885a9a05f0106559d977cf0de186eca1bea5340c7bb10d664d477b33be14d66948cedf93377d2f10ee4aad9ced57186adb174e989df04a9ed072c98f78899fd5e62b30733a428085d6f80af6aef4c93eb14e0eb917932e3ccd3b6fd835a030a45787ee3ca320d9d3f65664b1f72b96"}) 14:59:12 executing program 5: [ 1820.727480] ubi0: attaching mtd0 14:59:12 executing program 5: [ 1820.756582] ubi0: scanning is finished 14:59:12 executing program 5: [ 1820.804243] nla_parse: 14 callbacks suppressed [ 1820.804249] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.0'. 14:59:12 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:12 executing program 5: [ 1820.897400] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1820.922213] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 14:59:12 executing program 5: 14:59:12 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x6000}, 0x0, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000900)='/dev/nvram\x00', 0x20001, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000a40)={&(0x7f0000000940)={0xf4, 0x0, 0x10, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r1}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x1c}, 0x40005) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) pipe2(&(0x7f0000000280)={0xffffffffffffffff}, 0x4000) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r5) sendmsg$netlink(r3, &(0x7f0000000740)={&(0x7f00000002c0)=@kern={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000700)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="940200004100000327bd7000ffdbdf25736c3112c2331106a2ff31d88de067f7fcd411ee89830ed82727187cec720ed4e11b4f536c9bb21d944f3c25466a76baae5a25f7106e041d836ec42a474dfd523c0ab7deefa20953803f5ec00b00320090981b658ee6490024014a80d6b96499e67e3785e76418afac5dee8f57a8c6ffff2c78951ef12717b90062ad9f7b792ce90dc4e91f30e76ad10067e943c98f9032cbb36b8739767af5ee1c9726303d9e41ed53c7b47ceed3d07e1120db8ae686ecd747274ea485493cd7f3f5161d679e8c4f2033b4234d7c2128fdbb76c8b14b3f1f34db32086e6a6fcf30adfea357b16bebb13955568899f663cdb8d81d1c5664dc4299f84349279b4293e483e2f423c21a393d7175adc59406c533d889b845ae509fec08003a006401010108008e00040000000b0073005449504376320000c2f4a8d48d05038668fff41f18d47f105fe98125c3bd1fdaaddcb8454a8cccd16a7cf9c943597c13d1b02cba18b638e8d1003b4e2bd9346e8991930dbe8f4833309ce3147d1d75978d4734b7d12c614b1dbe45a085b91dfbfee5fb7bf747004f76b7dc32f8b3ceefbd9225bcefafc765efc5de00ca52cf80021808ca9b3bdac41b397f6133ea82ccee40fdd954d25181076fce7d3fd960b38b62fab6b851d0fad782c2b5ede743d9bfd2a1037c1da01aed6e751393e0b6fde5fd60327280fd11bb5da031b0113180010fdf8889937b4a2919b70fc5a866b7cb09490575cd860eea4c9ba20d6fc2823f928a4112c003282d8afcb02f1b325b377cc128c6825a88f7251dce25a3c07ab935d9a25c9fd06217f10f04006c0008003700", @ANYRES32=r5, @ANYBLOB='1\x008\x00mime_type&Fwlan1procproc/nodevwlan1proccgroup\x00\x00\x00\x00'], 0x294}, {&(0x7f00000005c0)={0x10c, 0x2b, 0x300, 0x70bd28, 0x25dfdbff, "", [@generic="e44be315e0e6a0fe1db5ed24a7ca358522f9798be9019420c04c017751b13e961b46158f783ef28cf92e48806a75d6a411792338f133db89946d9db0b4843abf7e3c9f548ae947da7a9fab7a5f01b9f705e6e0392d0f43f00797e07bcc2f23c237ea3eed799ecfab9afdb5a69de259d3b41706c3e8637beb4e57d80aa8fecf82b4b5cea412c0910982b9ed1c1a15f21683d2a3f82c3e0f2f2da50c1af8c0a060314c18dffc69e6d0cedcb33a66e0d78e0b0762c4ae3ae52cfd1383201e9a0ebc4fd6279c250d9974ea7b7ec2fa4f49b475d8fdf4a237496f156bed62cdf81664f7f9241e3b1da07eb87d6c832ea7a98ac85f4c7d4125dc666287"]}, 0x10c}], 0x2, 0x0, 0x0, 0x24040001}, 0x48885) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x2050, 0x0, 0x8, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@random={'osx.', '\x00'}, &(0x7f00000001c0)='mime_type&Fwlan1procproc/nodevwlan1proccgroup', 0x2d, 0x3) fcntl$getflags(r2, 0x40a) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') [ 1820.947184] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1820.970236] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1821.029248] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1821.052797] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1821.062522] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1821.078104] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1821.092292] ubi0: background thread "ubi_bgt0d" started, PID 1976 [ 1821.099903] ubi: mtd0 is already attached to ubi0 [ 1821.108244] ubi0: detaching mtd0 [ 1821.114182] ubi0: mtd0 is detached [ 1821.125096] ubi0: attaching mtd0 [ 1821.130089] ubi0: scanning is finished [ 1821.155142] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1821.183581] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1821.190357] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1821.204621] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1821.210898] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1821.228466] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1821.238802] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1821.246252] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1821.257489] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1821.267284] ubi0: background thread "ubi_bgt0d" started, PID 2001 14:59:13 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:13 executing program 5: 14:59:13 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:13 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x4, 0x40, 0x0, 0x4800}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:13 executing program 0: ioperm(0x0, 0x100000000, 0x3) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x2202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000140)="6e7f3169b3f4f2c1fdebd5fff375097192dd8d6a128d158b4e8f7e0bdddfa28bf40ea5e38b376b3e792f4a547f802b7916ab997b48b0aa65da00694895b88ba36ac556f0b76df10a3006b74e947412757527d08b7a320e2f010b4b5b7961605afa5b8c66d5f1f1a4983a81f6be57648ece5a02ae28a69dea3bf56a2dc7604964d284a5d610f6389bd7485f7b9630c8d967fc806c0fa70df715749a2553c751545d0ec248ffb815454af7565fba39752fb826ec448ec263837f0a454a6c7d06957c01695810a742fe024ea761b191cc0f8cefe87bbfc2ec976829a607a2f6329972ea67c0dc168646e7574fc87098656fd355b471ae34e37e8a54bfde5ce89355") setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:13 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8280, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext, 0x0, 0x0, 0x3, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x4801, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, r3, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x156f}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}]}, 0x3c}}, 0x48810) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@private}}, &(0x7f00000003c0)=0xe8) r6 = getegid() fchownat(r2, &(0x7f0000000280)='./file0\x00', r5, r6, 0x1000) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:13 executing program 5: [ 1821.647401] ubi0: detaching mtd0 [ 1821.660942] ubi0: mtd0 is detached [ 1821.669771] ubi0: attaching mtd0 [ 1821.696728] IPv6 header not found [ 1821.698056] ubi0: scanning is finished [ 1821.700247] IPv6 header not found 14:59:13 executing program 5: 14:59:13 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1821.852444] IPv6 header not found [ 1821.855973] IPv6 header not found 14:59:13 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1821.969943] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1821.980761] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1821.990640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1821.990784] IPv6 header not found [ 1822.000481] IPv6 header not found [ 1822.000509] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1822.011027] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:13 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x19) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1822.019504] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1822.027360] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1822.037908] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1822.048434] ubi: mtd0 is already attached to ubi0 [ 1822.049591] ubi0: background thread "ubi_bgt0d" started, PID 2053 [ 1822.055120] ubi: mtd0 is already attached to ubi0 [ 1822.134922] ubi0: detaching mtd0 [ 1822.155086] ubi0: mtd0 is detached 14:59:14 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:14 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet6_tcp_buf(r1, 0x6, 0xb, &(0x7f0000000140)=""/222, &(0x7f0000000040)=0xde) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:14 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:14 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e24, 0x6, @loopback, 0x9}}, 0x7, 0x2}, &(0x7f00000000c0)=0x90) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000280)={r2, 0xb8, "4d97beff73c68144e7e11777e133446424f82838d330e10819b66a864b210ee4c000f7ed7a1b6a0d9830fece63323c784c9125bd78bb81f7e189973f5445ae29c7c5abef0273e0e8a58d3f25c99a36c37fb22bb33968dc21f87815d14b941d475552290a6161b9c88d6256b4c5342e0421f27ceba5f9f5df28978fcf8af0001f691d418a73bc079623f23f2bcbf61d133655bdba28d42e43c33f209b746ed2967df29c51b52c8c7ea535f8cbf74d0c810dc6f21716aa9ab5"}, &(0x7f0000000340)=0xc0) gettid() perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0xff, 0x0, 0x401, 0x8cc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x80, 0x0, 0x80000000}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r3, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r3, 0x84, 0x17, 0x0, 0x0) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) 14:59:14 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_S390_UCAS_MAP(r3, 0x4018ae50, &(0x7f0000000040)={0x5, 0x2, 0xfffffffffffffa7e}) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:14 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffbffffff, 0xffffffffffffffff, 0xa) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000180)={0xa, 0x4, 0xfa00, {r3}}, 0xc) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:14 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = accept$inet(0xffffffffffffffff, &(0x7f0000000580)={0x2, 0x0, @remote}, &(0x7f00000005c0)=0x10) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000600)={'filter\x00'}, &(0x7f0000000680)=0x44) socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f00000000c0)={0x800, 0xfffffff9, 0x4, 0x7, 0x4, "7fd6fe855ec41c455974f9bff201a0a9846a34", 0x953, 0x7130}) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:14 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x800e, 0x20000000000000, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:14 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1822.701230] ubi0: attaching mtd0 [ 1822.716152] ubi0: scanning is finished 14:59:14 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:14 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:14 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1822.895893] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1822.906180] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1822.943534] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1822.957344] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1822.979724] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1822.991095] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1823.008683] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1823.018306] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1823.028784] ubi0: background thread "ubi_bgt0d" started, PID 2138 [ 1823.033284] ubi: mtd0 is already attached to ubi0 [ 1823.050065] ubi0: detaching mtd0 [ 1823.060021] ubi0: mtd0 is detached 14:59:15 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:15 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:15 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) move_pages(r1, 0x1, &(0x7f0000000140)=[&(0x7f0000ffc000/0x2000)=nil], &(0x7f0000000180)=[0x4, 0x5, 0x8, 0x4, 0x5, 0x2, 0x6], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) 14:59:15 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000140)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f0000000280)={{0x0, @addr=0x200}, 0x8, 0x6, 0x100000001}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="10cb790e000000d678fe50c49bda944d78949c3852205d08d5d4c89d719e2c", @ANYRES16=0x0, @ANYBLOB="000200000000ffdbdf2501000000050005000400000014000100ff02000000000000000000000000000108000300ffffff7f180004000080000001000000d80000000000000093e9023814000100000000000000000000000000000000010500050003000000080004000700000014000100ff010000000000000000000000000001"], 0x88}, 0x1, 0x0, 0x0, 0x4000}, 0x11) 14:59:15 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f00000000c0)={0xa}) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0xc) fcntl$setownex(r0, 0xf, &(0x7f0000000180)={0x2, r2}) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r3, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x2, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r3, 0x84, 0x17, 0x0, 0x0) [ 1823.460766] ubi0: attaching mtd0 14:59:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1823.487353] ubi0: scanning is finished 14:59:15 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f00000000c0)) socket$inet6(0xa, 0x3, 0x9) r2 = socket(0x27, 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$SIOCGIFMTU(r2, 0x8921, &(0x7f0000000180)) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000140), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:15 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x5, 0x0, 0x7f, 0x5000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$cgroup_int(r1, &(0x7f00000000c0)=0xfffffffffffff800, 0x12) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = epoll_create1(0x0) dup3(r3, r0, 0x0) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, 0x0, 0x0) 14:59:15 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) fremovexattr(r1, &(0x7f00000000c0)=@known='trusted.syz\x00') setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1823.730824] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1823.763430] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 14:59:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1823.798593] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1823.808961] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1823.821818] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1823.840701] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1823.859000] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1823.871089] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1823.881377] ubi0: background thread "ubi_bgt0d" started, PID 2201 [ 1823.888149] ubi0: detaching mtd0 [ 1823.907365] ubi0: mtd0 is detached [ 1823.911938] ubi0: attaching mtd0 [ 1823.934648] ubi0: scanning is finished [ 1824.028533] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1824.042776] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1824.057804] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1824.064380] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1824.071113] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1824.079088] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1824.086851] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1824.097058] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1824.107183] ubi0: background thread "ubi_bgt0d" started, PID 2225 14:59:15 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:18 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:18 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:18 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:18 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x76, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa, 0xfffffffd, 0x9}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140)='batadv\x00') r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x10001}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xffff}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffff8000}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc5}, 0x84) 14:59:18 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1, 0x0, 0x3ff}, 0x0, 0x1, 0xffffffffffffffff, 0x11) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1826.438861] ubi0: detaching mtd0 [ 1826.445829] ubi0: mtd0 is detached [ 1826.464368] ubi0: attaching mtd0 [ 1826.481862] ubi0: scanning is finished 14:59:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1826.603149] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1826.618534] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1826.626124] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1826.639272] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1826.646616] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1826.652680] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1826.676245] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1826.688451] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:59:18 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:18 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$NLBL_MGMT_C_LISTDEF(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x26}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x404c001) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000040)) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1826.710924] ubi0: background thread "ubi_bgt0d" started, PID 2281 [ 1826.710940] ubi: mtd0 is already attached to ubi0 [ 1826.804773] ubi0: detaching mtd0 14:59:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1826.826019] ubi0: mtd0 is detached 14:59:18 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r2) syz_mount_image$afs(&(0x7f0000000780)='afs\x00', &(0x7f00000001c0)='./file0\x00', 0x200, 0x7, &(0x7f00000006c0)=[{&(0x7f0000000200)="8915bdb62fdedb310662ac1185ca8ecfbea02564ee69c044d9cadb39de7edce957185c26a4c5788337ac693d303ff694d10bc4c65cf1a033c2999fe0fb84b7c0b72a7bca575e93fb398ad0c7efaf69856712e976282722e239cfb710d9fa6ed17e9783990869ee4e313c75ab18ce7dd51f99dbfb20d4c96c331733e940839e4eba43f3ed4c2e6777166ccb4347d8c7e6188034ec42567b618ef91e3e379309ff8b14adec3c22bee5bb5e1d23", 0xac, 0x1c}, {&(0x7f00000002c0)="a8d38de91859e2adfd3a9e1ff94bf2f3aeb5c0b7550a01d822b0292e16fb41bc808db081b22d2f23801555dea8020b2e7cdcaed8ea018cb128b01ade5c51bb9c1d1eaa8ffee7871aa2fd76542cfa59a180bc53bd8d15fbcf46ea30090bb57f503e06a3b7b88a6f3b9c22b55561c16712574550cccfc40dfb19f241", 0x7b, 0x1000}, {&(0x7f0000000340)="4683cd7fd8a7c413c1f71e239e80050e63b9", 0x12, 0x40}, {&(0x7f0000000380)="70508f562b0bea085dc95a68217e53c84fea9e4c4443e265ace3aa795d11416b50af4169ddf90b8439497656b3223992ceadbbb6ff9a", 0x36, 0x7}, {&(0x7f00000003c0)="cacac896d9f12df04c9d7aeebe15198b59b9e57d0555c042968fb8efe0e36185bf872e775eebb919ab1cd6bd7c7c531172ba9bfe9d4e1f61e465eb6e5f47cb2c9cbf45ab1aec67ac2db0d769a5f9c7fef8325bf8c2544f3f4d8af595235c9c9299585173955ae58f62cbcf7a34e406ca88623ca55f9bd843a858911ccb2ce376cbb9906b8e6c6bcce05a9ecf864c0cb5b36e13ccdbc14a3ce7783a84ea5f6ea065eefba70524fa3b8cfc260ba6889ef521fb3486bf16e523b5c23ab79ed1c03aebe3e93accf1002ed4e29bb63801922ee181ee154b8296b8d71d70f5eb98190846e34231102f77161f7cc1e388cc0291ba38e630c9", 0xf5, 0x7ff}, {&(0x7f00000004c0)="476178e995836ee07e509e7af04fdf2320a57194222729d42bb8c1138c2a58437c2b74d0e20d9fe78e8ffaa769b35db161f808588f9866ad1df68e5635a53a529ceced6dda6fc80a823694cea66e0dad020e208a0c74139102d47871f7b0308c114832e574b17324e3485e8cc2889e22e8b03f859473327b1643ad8504aa5798bca9addbdde579ec84f09c8b058e56694cddc2beac3f204f23c0d6e132c17faf7b22b0f42b945a8c42fc6a169bba99403e16a3711d7783b4fce43d18ad4fbcc167fa46dc9752a569a6e40a3ddddcb41426ec3445856af61faf8e43cfb1e1", 0xde, 0xffffffffffffff0a}, {&(0x7f00000005c0)="394e4347590c18a0ee7acaadf59a7660fc47db2d78dbd6c93666260b522b2ec546bf9914b5156cf4f20947eb64a80572b67fff36a3eb715685c064fb7f3c1fcdabeb2cd27260534c5dd70f733974a93fdad08a170113907e1b9005be267f3c872a7f091c2b5ff50ad888a3ccd9e920e56641824f71f35fb5c54a176b0218627a0633677ad7167ba26b00a8a7376efdf35fec94c15f84428027aaaa2e6448da7b33984e695687f964d52196e89d076ac62b87fc5170ae4bd8ba47ad74550becede9a9cc90875facbe1736d2d76ef4e4b2d268447eb40c93e134c38cef5c8381f7ed", 0xe1, 0x2a8d}], 0x2120482, &(0x7f0000000900)=ANY=[@ANYRES16, @ANYRESDEC=r3, @ANYRES64=r0]) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) r5 = getpid() sched_setattr(r5, &(0x7f0000000180)={0x38, 0x2, 0xc, 0x0, 0x100109, 0x10, 0xf0, 0xffffffffffffffc4, 0x40000000}, 0x0) write$FUSE_LK(r4, &(0x7f00000000c0)={0x28, 0xfffffffffffffffe, 0x7, {{0x6, 0x8, 0x2, r5}}}, 0x28) ioctl$EVIOCSREP(r4, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x36fd, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r6, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r4, 0x84, 0x17, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000840)=""/97) [ 1826.853921] ubi0: attaching mtd0 [ 1826.884560] ubi0: scanning is finished 14:59:18 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nvme-fabrics\x00', 0x40000, 0x0) ioctl$DRM_IOCTL_GET_STATS(r1, 0x80f86406, &(0x7f0000000180)=""/157) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f00000000c0)) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1827.056202] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1827.067376] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1827.078641] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1827.089012] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1827.101420] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1827.111815] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1827.126496] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1827.141161] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1827.152527] ubi0: background thread "ubi_bgt0d" started, PID 2323 [ 1827.158960] ubi: mtd0 is already attached to ubi0 14:59:21 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:21 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:21 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000140)={r1}) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x50}, 0x0, 0x4, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4008af14, &(0x7f0000000040)) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0)='batadv\x00') sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="00012cbd7000ffdbdf258162ec1273eb568200040000"], 0x1c}, 0x1, 0x0, 0x0, 0x4044011}, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-control\x00', 0x200000, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:21 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x525, 0x701440) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) epoll_create1(0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:21 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x129440, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:21 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:21 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffff7fff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) perf_event_open$cgroup(&(0x7f0000000180)={0x4, 0x70, 0x0, 0x3f, 0xe0, 0x80, 0x0, 0x0, 0x201, 0xa, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1000, 0x2, @perf_bp={&(0x7f0000000140)}, 0x200, 0xc2a, 0x1, 0x0, 0x6, 0x7, 0x101}, r0, 0x9, r3, 0xe) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1829.568146] ubi: mtd0 is already attached to ubi0 14:59:21 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f0000000140)={0x3, 0x70, 0x0, 0xfe, 0xfd, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:21 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:21 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0x0, 0x410400) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nvme-fabrics\x00', 0x280040, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f0000000180)) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1829.659289] ubi0: detaching mtd0 [ 1829.680489] ubi0: mtd0 is detached [ 1829.698692] ubi0: attaching mtd0 [ 1829.704857] ubi0: scanning is finished 14:59:21 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x10000, 0x0) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x1401, 0x2, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x40080}, 0x4000014) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:21 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1829.865285] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1829.872243] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1829.880445] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1829.887754] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1829.911992] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1829.922275] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1829.945726] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1829.957397] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1829.968054] ubi0: background thread "ubi_bgt0d" started, PID 2390 [ 1829.975941] ubi: mtd0 is already attached to ubi0 [ 1829.980896] ubi: mtd0 is already attached to ubi0 14:59:24 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:24 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:24 executing program 4: fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa, 0x0, 0x0, 0x84000}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:24 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0xfc4e68d23d24ef61, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x7dda) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:24 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$AUDIT_LIST_RULES(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x10, 0x3f5, 0x4, 0x70bd2a, 0x25dfdbfc, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4008080}, 0x2a1ed2a510a4f40) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendto$inet6(r5, &(0x7f0000000040)="648b816874b851be87dfb48e64c5644264cd27d27167956b3a76c43265c8a1b4fc5d51031731108ecf603bdf0b442128e12313a15e", 0x35, 0x44000, &(0x7f0000000140)={0xa, 0x4e24, 0x1000, @private0={0xfc, 0x0, [], 0xfc}, 0xffffffff}, 0x1c) ioctl$RTC_EPOCH_SET(r5, 0x4008700e, 0xffffffff80000000) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:24 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1832.577636] ubi0: detaching mtd0 [ 1832.593562] ubi0: mtd0 is detached 14:59:24 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x450083, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet6_dccp_buf(r1, 0x21, 0x2, &(0x7f0000000140)=""/221, &(0x7f0000000040)=0xdd) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f00000002c0)={0x1, 0x1, 0x1000, 0x1f, &(0x7f0000000240)="f3cda9f4b44dc91e6c565f278973b050ecfc245ea8bb3256830ccb50d9304a", 0x40, 0x0, &(0x7f0000000280)="03d1cb2ed60788c77c2dbe80a52fc4d686f8648e9c653a9fee14d6a2ca5604531c6abccd1479e21810ea75a912367146792d0d0f695c7c5c8fcd13155a1d0416"}) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f00000005c0)={0x800, 0x4, 0x4, 0x100, 0x0, {0x77359400}, {0x3, 0x2, 0x80, 0x1, 0x6, 0x2, "7215e7c3"}, 0x0, 0x1, @offset=0x1f, 0x5226502e, 0x0, r4}) ioctl$KDSKBLED(r5, 0x4b65, 0x8) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, &(0x7f0000000640)=0x7f, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1832.628817] ubi0: attaching mtd0 [ 1832.652412] ubi0: scanning is finished 14:59:24 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:24 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x9, 0x101000) read$midi(r1, &(0x7f0000000140)=""/28, 0x1c) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf3e, 0x4}, 0xa820}, 0x0, 0xffffffdfffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:24 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1832.790133] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1832.799711] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1832.830972] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1832.844092] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1832.854518] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1832.860877] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1832.871238] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:24 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1832.885152] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1832.912672] ubi0: background thread "ubi_bgt0d" started, PID 2446 [ 1832.919173] ubi0: detaching mtd0 [ 1832.927963] ubi0: mtd0 is detached 14:59:24 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() fremovexattr(r0, &(0x7f00000000c0)=@known='security.apparmor\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) [ 1832.936603] ubi0: attaching mtd0 [ 1832.941030] ubi0: scanning is finished [ 1833.060837] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1833.074951] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1833.086440] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1833.095741] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1833.109223] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1833.116311] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1833.125137] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1833.135674] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1833.146437] ubi0: background thread "ubi_bgt0d" started, PID 2471 [ 1833.152932] ubi: mtd0 is already attached to ubi0 [ 1833.168302] ubi0: detaching mtd0 [ 1833.175201] ubi0: mtd0 is detached 14:59:27 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:27 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:27 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) pipe(&(0x7f0000000240)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000140)={0x3, 0x70, 0x9, 0x40, 0x5, 0x40, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x5f5a, 0x4, @perf_config_ext={0x0, 0x7}, 0x501, 0x6, 0x5, 0x3, 0x0, 0x2, 0x81}, r4, 0x1, r5, 0x6) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r6 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1, 0x400000) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r6, 0x111, 0x4, 0x0, 0x4) 14:59:27 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x20, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xa16e, 0xfffffffe}, 0x0, 0x0, r0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000740)='/dev/input/mice\x00', 0x101000) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000000780)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000f0000000f83582cd471428f3dbab1685719075b4d519b5dff6ad5f06b0b6f929f010981d8c96a37a015c48cff26b3055c148e188ec61e26dd07ae22eef9f801c3a6c3aed95c9951185901f4ad781e4d018ac9937bdd732771d47be381b3cd5c1a85336d163f4f9f1447529495de9c258f97210c5918d871bd2c1cb9c19b6239a072425ce78023f4bda79bb130fe28b7bc8952478c80fe4632bb57235a8132ee8bd6e4622f41415bb2717c601ef5fb8a3e40b8ba3be89e7a090e515be3ad615cf46ea1a3455929ae205571406000000fc58aabe38fabc1fe229e99b6e8d1f6b4cdc0395028579c900d585410012143315698fdb9e"], &(0x7f00000008c0)=0x114) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000700)='/dev/dlm-monitor\x00', 0x6441, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, 0x7, 0x1, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x804) prctl$PR_SET_SECUREBITS(0x1c, 0x13) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000180)={'filter\x00', 0x7, 0x4, 0x408, 0x0, 0x100, 0x100, 0x320, 0x320, 0x320, 0x4, &(0x7f00000000c0), {[{{@arp={@remote, @dev={0xac, 0x14, 0x14, 0x37}, 0x0, 0xff000000, 0x9, 0x7, {@mac=@multicast, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}}, {@mac, {[0x0, 0xff, 0x0, 0xff]}}, 0x63, 0x8048, 0x8000, 0x7f, 0x8, 0x4f50, 'vlan0\x00', 'ip6gre0\x00', {}, {0xff}, 0x0, 0x82}, 0xc0, 0x100}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x30, 0x5, {0x4}}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x36}, 0xffffffff, 0x0, 0x9, 0x1, {@empty, {[0x0, 0x0, 0xff, 0xff, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0x0, 0xff]}}, 0x401, 0xff, 0x6, 0x1, 0x9, 0xe180, 'veth0_to_bond\x00', 'wg1\x00', {}, {0xff}, 0x0, 0x100}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @private=0xa010100, @local, 0x4, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x458) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:27 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$MON_IOCG_STATS(r5, 0x80089203, &(0x7f0000000040)) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0x1, 0x1000}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:27 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1835.670399] ubi0: attaching mtd0 [ 1835.690780] ubi0: scanning is finished 14:59:27 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1835.805092] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1835.812580] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1835.820198] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1835.829872] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1835.840721] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:27 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:27 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f0000000040)=0x2) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:27 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040)=0x8, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1835.850931] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1835.861218] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1835.876146] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1835.887621] ubi0: detaching mtd0 [ 1835.887753] ubi0: background thread "ubi_bgt0d" started, PID 2525 [ 1835.899795] ubi0: mtd0 is detached 14:59:27 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1835.978919] ubi0: attaching mtd0 [ 1835.989819] ubi0: scanning is finished 14:59:27 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f00000001c0)=0x5) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000180)) getsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f00000000c0), &(0x7f0000000140)=0x4) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000029c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000002980)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x5c, 0x18, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x1c, 0x6, 0xa, 0x5f15bd57517a3345, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWSETELEM={0x2648, 0xc, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x25bc, 0x3, 0x0, 0x1, [{0x25b8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc8, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x72, 0x1, "9b050be1d80eb986d52aa79d21c8d4fe0887cf6394b1b2368fca231a04d785f94fcdff6e035f037b15abe1584104439447c7a1cd38866c0931aff4b4a4703679011e3a63787ca4069367e5e82f83c3778eb40ffbab218c9ed33b0b726e867be15a29e6f97b111d969873a27030e1"}]}, @NFTA_SET_ELEM_DATA={0x2410, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1004, 0x1, "f0ba2fe2eb34561409afe98894fceaa84280f5f5b5a6cfedb8e22e32c014314ed944a5e3d94f1f370b2a324702ad7340c0d3b152114d8919af047681bc54268bccca54a775ed2a2566e6f053a181e5a98ec3dd42704df1d46851f4cf06ff98c9bf599636d60132a138998cefaab7f33be244d6785b22e3182e6c1bca3880de6c3be0239a76dd352a47483f792ff3659870d611f9b7537332b18c3e9319e38c7cb6a29d06a65b30ff2dd11f8470b9b6474617fb9d589a6d9b1ac256bfb594e3d58e6cdbac1c4e05171e1aeb1f0d354c43509125aa89440ed01adac85448ca0403f1efede45722c8b9df86302e9f1ddf625ebb7e7c22a78c753658791f538e11056913e7d60421c37a4aee5b85678dcd1f6f619e9831497a81d5db490a8b995f8b3a5e5384d3de4698cd1ea78095b09579028ac532fa3faf83acd76aaa124eeea07287eae7d94864502f4c4a1905af068f02c894ad6c8d6982c3b3a46bb574fc5055efc4903a97bc1d2e60cdcb6fc98a39844713a241cbe48bbd188ac33973c6a30f784dc952ef6e87eacc3f5e2ac9515d1db4b2f8a7503db67e00b78b1a0c0f1105af90d2ceb0ccdd6aa7ecf0754eac9900898e6eaa74da42c6059c72a4a85588c1bee2db93d4283dd714dec7dabfc2b56c6335f9b194ffe499d5016bcb40bf8e55db74eeddf7e014dcfbb2d60ecf9f2eab8e10b6b8562b4f89431ae1e1d6ada98678c056011bf65a75a45cd923cfa3bce6c254eb1a98698b1c1827e2f171be7c1423050fcfaa4b98bb3954c5ae912cc670228ed7484a6cfba7c8c9c90d3384d08475f94baddc9ad869a5527bc7a9e76242e3b7cb6837f777aa231dca84958bf64931ab7fe1c3a27331ac3c39679f1c3fd14ae479360a8575005d938edfa018647e2a2aedf16003efb6ef608d71acb48677c0cb5e17db081e8b614dfbb350551e28725c28e5d276a49d6e53590c00b59dd4e2f1001fc085342f5f77f2ef0d176bf397bf6470dd1613db53f4472998e438cd97373dfe76ec57aaf3df1747b92bfd9590feabd7e7bf472cd84f305e30d92f6467d42c42512a92a11a8fccb99a4b55d04895b711e9555820a8c78b9b971df3c1811619f06eb7111ccc64126d06a43229c26f70391faf87a6073734173eb40f0e3ace8e54de7b6672838e9c8fb2951db55d07e5f910044c82d8f769e6ec96e28c03f11bf23a52d031e2c4a609d8ae517529babced2cb2416505a9855851b4fa57e8caddc95b44774f7bb6c8d2c62a569d24cfb7587da25293a7de293e741a1aef435c252da0e4afc7209a72dc5f4c270d61a8a4a77c2b386bd67b52aab9df57e7bc1fc9b54e54395842da08cd09500a8d99732c98dbdeb494fc2be6bc7a469cb2073901305468d42c66172ebbef3cf3b01a61892d6dfdd723e95109e0991649b24888a6fc159e3d48e4646a3d6e41dedef439a3dd0e2e95398d0a041a66334cdf5fb73f2bec2c1c5dbd1b6c34f11fdfb1a35da9ed19ac8e25fb933fd230bc11965fbc20053904495ca7720375d6cc0aea8228ac8634f25762255a9c6c2ee140acc613c03c24608e8f9cbad84093961c5b4c59f237e995c7758ebce775ad959513ca14d45456b7ce598de79bf616cec81e5cf8998814f4ffb1a3406559ff8d9b792cfb1802c479491a5d70eb5dc3459f8fe98e0a02c7794d54199c611cc4c18f0ac52c11dc9ef3d65c88a1ffe835af2988933c018c58c286e5947b41a8e94822557213a9361d50de11278a0a87d4dfc4c6ddf42b6133441fc38cf488da7076b3b47b797865368b893971e4055935b83fbb0e706d7873b93bab9b3d706af20c16c1d0f5596362425df4b080fa1232d126e39fc4281d42ff086f510544041829ed76e8e15c20da7156820412daf9fe2e51a1950b9408c4813122acd8d1344f053071bfaf6bfdb1c69371f1f21436b784b289427d25a9917c80365628556f5d87579e71654a61eefab194daa029ee19e0bf58833a4ef404dd5ed691c2fed9aa26dc02eceb4c77037b67833f40d018ef1d42f88012f5290711fb2111c757d8f3a5d1a2810581455497aa3019bfa63acb1537b8c4811a3d8ee059db050df9519c3007115370055dd1d011019c5c4e08d33fe646242a6b27d86fe486f050c97fa1efcf07230322cb45e20b405effd0e8279783145d1f20f4916ef660b4c38fbe398d9ffbdbd826bbcdac117d85a40a7abbfd99af34fc8d344116d65a20973c7559ce842d1da0f47c86162c6e8680c034400bd907d7720ec91eb1953fd30df3741047e199293b07a9a601c91586161540762ee425ab628c792b4700217cf60c7a6a0464114181a911d5add93e52c35c468f3d39fbfc1b53640e7d20ad2719735aaa2b761e15a34088f84e3a06499437d5a5b5105f2b9872806a5add8ddedcacfff930ca090c404e198995a098dbea08ea6e10011dfc733c6bda1c0d38ec013553d0602901cd99d670f55d39e6c3a0041020654f6309edf91a51d181b54102b64d956eb813423d2c30a0228a42f6dbae8cc5407fb8962e05e945933725dcc01b94aab7a148416efbbfe867cb7f01b4acc46e62163338dc647f7e5392a6f8c74df3c3dd520bc3de33ab852028fee42b1e11551d956222480227c1a5dab8630f5a31aaf4bf558150d84455a8ea0624d867282c4f03ef0a96b47a62e1ad6552f781084c8cefb51b04c6eebb893bb1a177083e4c90e703d5699fec11dd1c2b4396c774707db321dc583c2dd664ff25c001137188fccc0b29a9ac05092970e7de1bc886dbd627cf0e96962347feccce7ff3126483abb90c8732eadf960accf7c031596672c6af738347d52b658cb0e7d916f04f338fb9ac3c1c8ddb4e5334caa8c27aae36fd683c4f5565fd95b955c1f6111aa66bd8673925376634419b449c0a4eb3a13296e300bd18735981efc351e482fae6a9e16f66ca5bac8a9f4143d08dfb0648f5757469a43d3a364f8f542e0347d02133aa2377352e050b1b6aa6194faeaabf012425b8664414470acce538b833f782c82d081c75a24469b34c099fcab397a0b5cc4bdec731528227745f330a5d713c05e63c24b2a939080592e35c48deed620dd1be04a3c9e625033e4ca3ab04ca08804a858b94eb215bde6ba4d333b37623b96a96f64731525207d33ef6fef45b3eb4c0fcd2329b0fc26b481f48c58c6e7c68e7bcfa8e3144c08d70481eba1c78e9a3abc1ab8ed6abe3a88639d7014c709a7aaaadce507ca4852989597d5fe0971f64475c93d5c1d6cf587246339da21013d635e274797350efcae1332086123922b233b4df74fa834d768e28b0531ad6cb47d3e23dffa0cca1e8d9270671910b26ad44d97e569d588b07d0449630ba946690ecbd65b4625ea52ea5ad9df4fd3b70ff80dcbce76b2d59da42f2c2f8d3c8a1396a764a8b71612cd07ecb0a5476780503ccff83bb2cb0d0d5b91a58fb5751351958f2ff02e554bf282e91c88767f0427fa234e14da5f0a7cbddf7afb3063574fc3f9f06db6c2f7603c972c9ac9adca372bc59a08dfcacb534b43891ed7ffda8cba47517d7f989cb4ba6f9c1c0cecbbb0d50eb91632d1d559eaa9c8bb58291e86656cd9e03cb038148a8abfad914bef99747b6d777fc81adae99703898286672f68b166b2a6be51ece2441c527b00794bf8f416aa66453e7f997d9f351e078abe861a638274925e9da267501c643690a5a007f1e598c7c1bf51ca4d0c9ec404223168028d4bb9aee445c923aa84b60ff3ff725e39c1a97a0407241b7eba89f6e06e3809ad45ac5af489e93d745f3ba7283a9d041a637fb016e144f59055bbf6d7b7735a4c1f562ff602ae81e9fcc7884df3dcf272e07f16f2ace47e0773226f166a55b9a2561edfb74b116afe3ab89fea2055c14a820d5e3c20c693c7c433b9270bd9b21d1df7ed42a93e842ee5ebb038e08c827c010028f5e2f03429fad30d88ccc558e5b49532193ea4e4790808a1132ebe261892526e2eded7cdead4f3777632d3dfd09ca4f8881ed8f6e2df4661b32f25e49063a2d5066ee6d0752952d6f7c7b8acf9bea24e15742b59410caca1b56aa0c350ed32dce6f13fd764d37dee3b408cfd09bfe11a5a44e9a03b0600ba58980a955eaaa8bf2608b902fddb95e3635216c9f57ed0a61827492c8ca24cb51a1bbc2f49458a83b3d704ee6f11cbf014565e7d0e273d8e4da951bc1eb11826db154f58b41198169d0a4c019d8333208709da3848a8dad1f15d76c3cdeb2a226714361420653bac83d66740f83ab4cc368194fe885094da6618e17beb3f4493f5e6f41574e82b0548d45ebe4993f94d55b8008cb0d14d02abdeff78aa98fefb07ac1ada2344cf11efe8a9a014ec6f48751d2f2beceb99c2aab5fb6287989f3a934bdcecafab580833db97e7cee2a9d32c0a8093543900679f760af2dd51d503bc0670deefdb940c28bf3ce6b16a1b3307223491000125576761a0dd78a0b31752b6ae046cc1cacc03e1587332b17d30230a0ecd4c1d0c95a17a250b7dfe44d1dc6768c1203aad504f85b68e4a842cfb4b248f3ea3eba418262b372152a5a261901c484415c5e8ecd017e66e4ad2c53a683327dca47dc07c6c662df6864393372009680409f212ded91568f57e57d20a909f2de369dcb020367d13db9033d1dcf6d395af51f810bbbbbb1e81d1a7261c5b79314024db182107e76638ab012c473132ba836d2fe84faf904d06ebcd0815655d55bd203224765d0153a7eacd7c4978cade69adea49c5f37159c336cb41b6367cfdf9faa7889ab1626fb6ddba92d2c3a88d0ca45451f64a8faa24fdb06f5dd0715f6693850dbd4add93b5eeba1b3e61c5585d23527f44264f3f9bb26c28395a26968e9111ca52dadce84b528923205f48eeaf20fef21304885a9a24d0d54ca99514628fd278c2c46aeef78ae725e265fbf7d02bd6c88b0966029c04c083edb22d1951f3f6e03331c9b821645b9d1dd262d886874d2cf68515792bd22c36f68946c35d72ea982af62241f597cb0cfc264cce7728e45074074b5b82ed5c23e623554093c69f866e651d672d32f9cdf131aac1f551bce1b52b53e903cbee31b3510b6af32c37f1d99d16640ae215ef7f399b7186126beea85cb4424bd29f99b2cb1dc956ca42b4afdee4fd34f27b6f37ad3a8262e225bcc17f0020a95ad6f7f89ad4253dddf1570dc53a0854cdfcab6709eb5b72bb5296fd95f48db8a24e02804b80e13538bd252a0a21a1b72451a6bb7537033629f929fe2e62c4b72dfc5c5f3aefec42d8315681890f8b37fc09e481531a73f43e23eea17201419061a61a3d149a8d07e1412e2ffcba437b4cc7e7d69460218623cec2f4248a4ceae2d18bb027d120149383e2de70aa20e72a26fe136df207f398203ad7b0bca08c89c4b64820a58b7252dd0c869f3e6cbe289fcdc4027b996669bf7c56765b7ba200083426246987767322394e1b595a7f575f2561ccc90f74e54f06daff060bd252c410701e577eeb52d28c2515709fd27fa47c908650bd2b5eeafe605afd66ceec1897baa0de7ab74dfa46b4b8e548cbba872e392b4557926db63106ae0230f411c60210c46fa88bb4dfd8f40ef99c68862e877b5b29fa9f1f7273189b53e4d8826617dd3873310dedb293db609e29a261c0df1ff7b7ec80a72a279111333478e85b57b4f2a28117894bd1297f15c7204a7ce48c026ce7a05a5095546f2c4605e764f1320d2afec297ee119dd10cd59f640601eb09067051038596e756cb4445c7ff73a7b8826487d600e30f329fa43b73afb72c341875b"}, @NFTA_DATA_VALUE={0xcd, 0x1, "1da717eac7d8fe11bcd9d5d49e2ae203e7cdffd9d160698fce00ec39018ce6384752c9b9e55aea89016725f7d7a0d0d40fba39d5fb046ccecdea7cfb346937070f37d3ea39aafe5c6e483bad549538dc22aa9c8aa09d95572d3cc642faf6218a1f904b9fc4a7f34964883ca6f9fde1d021d230a01453bac45e5cae7a37835b841357f081fd152891480c4d1d42251fd8898d753e1adb507cae613339a8412eb9137848969c969e42cf5ba720e27fcdb2987f26593c251a04e253c6a1049772dfcde697e5d0d200cf39"}, @NFTA_DATA_VALUE={0xfb, 0x1, "610e36a578e206679106128bbc1dc4000a5b4039bc0653ccaf55948925a172ff6d1f3405fac70c6c23c7692bbb4a26500743015e19deccbb6c1105708775b54c0400d1739668311e01291e15c204e17387d296fb1895d3de7c9117392a67e8968847b9f4399a1c3a0b093aea29a552ab9addd757853a7d0ec585f3174dc39e5c1ed2f1c0d0c679d2b8f3d4e33273bcfaef9642aa1fcd02e32dce946eead7dcacb63114063df5e0738441b2dc2d14a9ed428d46ff72a8153932b21389d73d89da64823b51374a057b3463fdfafd0448d4f645774ffeb9c5e937272241d7a5f3cf8246cf20ba7a2f4bf4bcf6370b304d60f1c1da9c867a48"}, @NFTA_DATA_VALUE={0xc8, 0x1, "3144860ca55548805d85849f782a192d09815f36af965d06f5b58d9aa1e5edb4fad4cde3a4825c46ad06cf4a775f072c9fb38632b4adb9ba75163794343ffee8cee218ac7a48a82c619ff28ae617ab79ddbca711645f47c2aa8804ceed539df6dbe1f140e0c9d65c3645644581a1509398dc544bcda338eb7416a46054869bf859987ca6de941252f7febf9620f985cdcd226879c5eadc88a8c48b8e91c8a9825d56bfe2bd961c7c7f3692b22ebace7076bd15f309fbcdeb98e06975ec67aab4cee47dfd"}, @NFTA_DATA_VALUE={0x19, 0x1, "e3061d2f0ebe407490e99b56258ae14962e97d9eab"}, @NFTA_DATA_VALUE={0xa4, 0x1, "e202ef9c4f1d1674ee643bcec67dee13916fe5616d79af7cf99c3108111d81c3f17bb0da350cca703b19d8478cc9996396d745958516cdacc6485c53295ae8c424d478e245323bfcd41e96f5288de15bec19f9dd4c489fa61f7feaab6c651fb2db07f5e0901b19e7fbe1037f41c1e593112d78ff626f2cacecefa323d51db64709d72ac911190ae07810bbbadceb4d801985ddb003f5b9da0bc7f106984a747f"}, @NFTA_DATA_VALUE={0x3e, 0x1, "6cca7f42e61ea9a0c0a73caef11eb36ad19c9081fa821a27694a388044b9c7c6b4ada68bad63d0dd9178b9afb1505db223ca67e535590d455cad"}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "abc8c26323c51468beddfa13566122f04bd5b5cd214b10ba7acba6c34ca4271fa06013228e3ecb7c595d3dacc389c5abd3b07ca6932828400595dd2baf370c5d26fa4e62813e4ca4a9b888c01247054d673adb918afe8402e857c519f925820bcc4da510ccdf57abbbefcd2d0a8f87bf90d0dd5f32e37f4d6c19e13767a48ccaff22398c13172f746eabc96711c836561a0850691091113d51e8470a5eb62a2b8bc892fb2acdbd95b3084b9d668f5511bd5a4f15e6f7b5a334c51afb7e12ae591200e6e9aa7fab333ff94ccfe9e883205defe8a64455381afa627f014af5c416574db7e4cfb18f42931e68e32e74cb70e95255c781058532aaa77a534ff92d6e86abd10467452f4bdf210c0df59558f45172e4bdd938a91a85eeecb853caf20b8ca1fb3faf6badfa371976f65688c91fc0826203bedd5ce2f148c2797a8a07b4be6520610801a1d7bcfe320e34c1548e211775ff3cb74b1715e4d160079f109fb1fd112127101551aeae9f216c23806bcff0211ef2121293a8900e6422331d691b7cead73d7e2c1ff38c98cbe3d309ac7cda292f6da333495c6a8dcce7528a1cea2c36c96872003de93dd8eb2d33d4e073959fbcc53be6c8752c180658437aa392d6e02cc5e9ec6f7d3f8d0c01165c22d9e59de6e28ab918fdbe3c32ee938944c8999ed9c5f8c009b68be37a84641c2d6190cdfb9d977744f03aa91647ff515de9a2010718deb8a8fc128dafad5d3e8a1c83e1390c3a31a2fcb5b15c146f14b3c9a6bf3c365d121114ba6abe14f05d55e6e8c8e744636d03b998eb9402e4b485580b8331f53e5a488dd420fe91f507b7b7d7348527def45c391625e3e92a15ff56e37b98c5511f09f40ff728c22a8f5c7566cb336c38cb901c5572ebc6944220cbe313b05cbd8f6bf1e53cd1eee8def01998237dff65bf31b5d1b74703ef3130a6cb3cab6eba48dc02e52aa013eda0f157c5bec1c7ec74e895af57d211af3fa02d18a56c9c1de7a2b743592295e0020a747036130f453759885f76f4b08ee05b441272b1fd11ff27c3c7264dfb24e9a44c1902af6bd73511f2fe954230ae8fa7f5f48cf8c85b2d2a4c3bd810a59d110fb838b8e8fecd82ec6e160d0bc15bb6518a026d8bb8b86e719c48849a45989071a3b24d04926f780d7494bcb4b3d907b4a29ecc9898d3a60021217c1a09ce559dd7aed305377a7005f0072770f7bf648d6388dc9bcb5729d37d46241b78421e67723ba154d06e6ca5f8e1c74bf2b4351bfe70a67b9f193302a9924bc8738fb303a32de6d28eb8a080b4b35fb75bf59c9c5639f92c7fa13d7b2fe7e0ec09577e52481cca7963b9d15ec1d345323f248c52ee69e6e5d2dd3e239634d0c4f5911a0e914f36977eaeb08f32c6a87c55b3491e875e4774923b652be5202b59c8ba3a5d356e42df54305b5c9251930ea08541d3d083e26b216b151e4fcbeac275058f023c95b05133af23a356644230532040a3e698657ed1ea3c002bfb220e211d7d8f3728e94f1672d06c2fd87b722dcedd590a428c13fc52792e99570e4019cf066845709a6a300f17973bcb37c3195b2b3e40d9b5ebe3ef236c177db7d4cd3649801144c2e8d6fcfa25882fa2398a8cf6e80e3277d8b2e380815f629fdc3c50091c04c657eade0c1dec9b95274dad28140c0e275fdb11e8012e54d4b1f1ac63ad54748abf210a73fd779255cbca161e57d436c3b490cb82c3c66db9fc075cce8002b8ba9c531e9d6d5a78081f975838b2e5f1a40093550e1aa1756f97966434a463b6abdb46da516d1afc9d682e49f9ebe1297219b09a9d0c5d41bcf1a7fb417698998e44aa579653aacda69dfb72b4a5bd1be2014d6e1b52dbe7b087d711562bb4131dab75c40944c45fa2f0d39c0279c2a2a9d9e7611599943356267697177329720df1f7ea32646b2d2f9a3fefa977fc5cd16863c55d3a64d313dbdd602a6ae477f9c1b3b866db9283258879308388d3837ed07ba1446d966e0dc9e8d21bfe9a9a5b3709472bf1f4151b1753b54304acbad05fefbd850d3e0e18af301c02c5ecbae22c965681edf1367c45a9b010f010dd50258a7834467bbdb670440c3586c910d71885fe3727bba73504eebc92ea7e725e353c6d51a017edc3d193260c3b5513d8778e4bf58ece55d426f38c00d0fa9db0d75be818cd9c02dc897186c74b33fdf3ec7c6a6bfbce3086ef31cc889365018074178795baeade9e6a928d8cc3370d527980fc1fab84a18f2cdd8b5a74b2125b913eb129342ae48bfcb88ed760ae30e5892e18bc712ce5c664c6fcd9eb43ad557913620050b43617f210447eacb4910d239c12e80090c815442ffda1ce507ddd77939ef466078da633aa96ae13bffc6ccee7ed71b09d6fe980f7b6af7408dc266f335cc05a8a4c245b3023bcac4a1c543b8fffd51d490946dbc98b484106c56fcd10857aee056fed5113dffa9101559f39fc877359cfaa60effad1021e94fb88afcb697eb8871d4712413fc6aeee45c94914488a3e3cac14117ebb3b184a7d72b388764d23e2a307c5d357395545845cd1e1cfe58f5ff1cda6a090dd9c81f7b283b7ff2d3269872c8e4b004c8a4b209ed393b4f5f032f3fe35c3ca3f72b5dc0de5ce8e17c021f4392590112fbe2a5deea16b8f1e4330c84dba45b179b989214a9623cb2519b2e9d76e6007737184d2f2ffd1aab6aa1e5ad41264c4ea3cc796935b92b765c3e84150ed56852855e26e29523b9ce2b8c6aa7d7ad0ad0f70b568d5532ffc8705e3f49560180f29d8e716ce1d5966c12b87b9e6634ad99bb8091c84b800ec3939f05ce5233cf4f62cb8ff87228676610c722af766819668cd1480261bda40f509c8dd7448c116cf9db9f03292f6f75a73cda2349bc884437269bfa4b9069a56c84d545b452d818127d22ca9080a0a643e595fe9b076e4474a3295aae74a1515604d156111b3d617a6ac590f3882ee27e8da9f8b1b4bdeeacbfcaa56da40e5550cdef6c4925cd00695858d539b31c41de615f51a2db291e2295bda344a89835cbb460d52be400dfcacb77d0ec7008fc6f34a39d8083ae89bd972054709876764a189bdc5679ff18821491a0f1458b163ea64776d2d78b0fadb683dff670464d00c9d51a63508a80ebea19bf1036bec6eb3ebaa595c5cf1fa6d863c90e1805ab775629eacf6a8c9854f4a173f21cbe9edca0205a11520ddc246aa95761ac07bdc699a185ea2fd2faa27c9814f0d084cf19379b15e6cff708ad879df5f66eeb751e5bff2fe65be84318e8fbefb34b8dcb79fd2932f25d076c287ed42fab98e85f86aad47b0fc907075499fd1cfa66fbd6fe50bae055ce3b6f4aca23508dba101a7ae0621b1cc5a118dd911c6f36a23ca2391b8f207434e98e85012f841db127ee7008a1dbbee84ebe627adb8ac16196f13bbad13b4f24e1da97ea46901c6c72dc12f7a77c824098673e6f910d9dabe7d57969488f28931df643efd56ffdea36f7284de9e9dfe3fa76f253856df6bf623a801d4ea0bece7826197e0ec3115cf9106219cc318b964d0627f40793c618c3604d5d037b110bb92054de5de72d2d830add50b52f3f79b4833a4b5d3e8b2b7a334a21418922f500da060909fd57f099051d5880f12767b294971ee47fdb9ccafe3d89fa555493f593d3aaa1476fb21f115a7fcb8b66c19c6a27a877564812ff0916a95a5ad3193f83e89c9c5eda9e765c737c37ff6c772b253ad9cd5c7ffd2fc7474513bbc79519e84f699b680fa05799371e5143735c4cfc0bb7cbb014ce677bc405f73cd32d2cb3519bd579ff72b2fd061d10e2568c866c456d7b3a283b5ee169bcf06931302f45270914feb19c01389358d591a4f593774e9cb50f230a2c056887af9cb4f8f21d0ca006da168ef52deee0f26a94cf9e32e1915efb431a49584505a75cc52a2ffa9d5858882c4c8f0d78e92959e500144b44e67f5f2cb843c1a114d78806ba895249be1b43aed1788afd1f3ba4e9ad75ecc42fb81a3416b78443d7fe16c6e687697d0ae7e297e13842546774b9cfe12c4a98751ea3541e50ebc17ad9dcdd749db0d4d10fd9025fc0b5a2c83f348ab613d20080a18d3f5f5d8f841e821ecf637fd8acd8dfc3bb6b623e233664fa07bfd822d13b594ea38d7bc196604153908ac8757adfd777590d1dee16a870f705ea24714d5eb8cfe0fb59a14db0fd66b091ebd12678be08f43855c9d1cbd80d2ee248fcd643685ba0ee4e4a54228949c68e7428886e20d2c04af8ac0e0a535e74f3b76497d82ad84bad8020e8b02c419f869a361d38216b57b5f66c5fec8229ad5d915e6a3e65e6241411f876c16851fd0306582b1a567d4963bf6c0f8b0ea76bf1317bb5df2c0203110c08a84bcffa7351c39f6ad2e2d9772d27199e100989bd03ecbf5d749eadfb5b51859f57d285c579118128f66c4bc0e7292e4c76aa09568207c80c220f9b047c830ae6e44152299b9019eb0a7e097dc8647ad8150fb98671f816f78148bb608669afc82d9bc98dfd53bbdd7272c900b2aec64151fbb8152cf4f02de2362f8a4806349761035410357e0d1de9bd836e5747dd2d85b059ddebb726aae3c53df6140fad1ee577afa248da986671ab67fbf8878558a5760ca6138a7fe0542e359127c6cca1f547368ba1b719007d522a4afe9a863df9a282ce25e2ef93986249a6b6a750194045c369cc92c8577f2d1782354cb5514c531d47908a44f4d0297987756917e3af27b3a06e1e3e2bbca93290f83efaf99aa654ba1184b520c9ce25e3b0756c2f456cceb3dd0e8a07a5fcbaea8a68da7ec8a1b795e9b45677985598f404a8ca43240ea0c3efe441861775be7c7cf7802a22992b0faf8854399324a210355ca852d62bc6901ddb6511df73e09ca8c8be074ce75baaba47fc20ec25d6d761ae60411b3ec93cb2edd9c12dcb388f5b0db8fcc6a58e1a34177e9dcf76ece2cbe6dbebbfa47fcd5db453ff8ab780a9685232e383df7f6f8a7bbbc3bfc04ef567ba1df5a9f916976e88f55fc7cb7742af15dd6522fc4d10a0130467b93d431594afd8472b505314a9f70958519166820c80791bf15d74a5a2c9790bcfdade05d07f90d7ea96299bcbb902b325a2f9c470116722470daca757d2a6165684e4d0211927bb25dc45eb5447a1ed523525ebea1cd548b17f0a1c453b68b87d9c20defc72df9bd72aaeca9c41df70de059efca370a85541db7aa1f55b9a10a22978cf8875afcbfa1d0c7cd34ee3272c6c9bcf374efab85c6fe8da8ccd38e9a07d7f3bfe2e6805d9d2acd4cc3b60e29d37f6bdf08feae6fb24955b348aea0bc0c8cfa51265e49d4e28df29aa5df2891bc8f4b54736cee0eb692ae1b564bbe54836181703082a507f5d6d7cb336492e4678d101a43e0b6fe1621e438c5ea6d785f755cf58d3ad4e78871c828ebd20ee253cab9a6d61cd6df7853e4edbd0a1fd2d9f978a91a99f6e8390ffbd804b2feaa737d6d68d55c8465de74c4d163ba956d16b44218b3cc36c697d894e5e60d3137870dfe36ab747116da89a6bce43eb3a5fabdbec833a36258e74d8d6bf1d92e7e5951e561ba1d42bfee4623f44e146bf9a478d1455cb64577cf57bd8b0238756c9e4ca610e836f4a725ed71e01987fbcf552505c44937e30252b13b5d906d4eed66b67f994c89d30b79178868912b2f938263c0b56cac30ee59be8754f860101718f453cac9280172679287ea1fe9795bdbdd92a01ef99a51ca20938cd2a868b6928d2b0efb11f6737db0817b4bf5735542d5032a0148f16aeaa9ed121662fd492c"}]}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_USERDATA={0xd4, 0x6, 0x1, 0x0, "277428bf32fc02ca4ae38ffdcc48d233e03007a393c0eefbaf63d4e90ab4b724f647ebad61b9b612258ade33768a1f668b68e395162d89c50bb96749342fe7271b0cd4452c7ac4cdbc63dd86d0c562772f32a8b90281962b2b39aeed5bc89bec228802df857946c62940bfd25ccedab5519acc3bb5649ddebbeb4eb8a263e8516b83a2b65b385c1e22b3e3a6929ec2faf3f4758f141cf427b073a547c7464745b565c04c86883810ed712ef7c0f1014da503dddd0d9a6b33afa4ecda24c6e8a2422f60bcd9525b402598d00790ca7e60"}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_SET_ELEM_TIMEOUT={0xc}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, @NFT_OBJECT_QUOTA=@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}}, @NFT_MSG_DELTABLE={0x1c, 0x2, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_TABLE_FLAGS={0x8}]}], {0x14}}, 0x2724}, 0x1, 0x0, 0x0, 0x24040004}, 0x40000c0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1836.111426] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1836.121518] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1836.154233] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1836.160967] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1836.176389] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1836.189302] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1836.228332] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1836.240512] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1836.253800] ubi0: background thread "ubi_bgt0d" started, PID 2552 [ 1836.261946] ubi: mtd0 is already attached to ubi0 [ 1836.280942] ubi0: detaching mtd0 [ 1836.299135] ubi0: mtd0 is detached 14:59:30 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:30 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:30 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000040)=0x2) perf_event_open(&(0x7f000025c000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:30 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x4, 0x40, 0x9, 0x0, 0x0, 0x5, 0x40000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_config_ext={0x6, 0x474}, 0x92, 0x9, 0x269fd6ff, 0x8, 0x3f, 0x30, 0x7}, r2, 0xffffffffffffffff, r4, 0x7) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:30 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:30 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1838.714408] ubi0: attaching mtd0 [ 1838.733440] ubi0: scanning is finished 14:59:30 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1838.827497] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1838.835014] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1838.842353] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1838.849378] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1838.857334] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1838.864982] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1838.873961] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1838.886074] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1838.896806] ubi0: background thread "ubi_bgt0d" started, PID 2605 [ 1838.904246] ubi0: detaching mtd0 [ 1838.913824] ubi0: mtd0 is detached [ 1838.918396] ubi0: attaching mtd0 [ 1838.943057] ubi0: scanning is finished 14:59:30 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1839.022053] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1839.028903] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1839.041224] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1839.048700] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1839.067898] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1839.079811] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1839.088070] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:30 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x8f, 0x0, 0x0, 0x4, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000400), 0x2}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000000140)={0x335, 0xc, 0x4, 0x20, 0x0, {}, {0x5, 0x0, 0x7, 0x6, 0x8, 0x80, "1661d477"}, 0x3f, 0x1, @planes=&(0x7f0000000040)={0x7c0, 0x4, @mem_offset=0x4, 0x6}, 0xbd71, 0x0, r1}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$KVM_X86_SETUP_MCE(r7, 0x4008ae9c, &(0x7f00000003c0)={0x11, 0x4, 0x6}) ioctl$EVIOCGPROP(r5, 0x80404509, &(0x7f0000000300)=""/144) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000002c0)={&(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], 0x2, 0x9, 0x6, 0x2}) [ 1839.115596] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1839.129271] ubi0: background thread "ubi_bgt0d" started, PID 2618 [ 1839.135622] ubi: mtd0 is already attached to ubi0 14:59:30 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ubi_ctrl\x00', 0x34b402, 0x0) gettid() ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:30 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f0000000cc0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f00000000c0)=0x401, &(0x7f0000000c00)=0x2) write$binfmt_aout(r0, &(0x7f0000000140)={{0xcc, 0x5, 0x3, 0x25e, 0x16, 0x0, 0x2d1, 0x3f}, "047f1a6d78344a91d237ea8dca86c9a55edb05086c1694e6a5b1e07201ae2d82173e3dd1b435762b77b6209eb997a981534cb4510b01f94dc42db876696183fa8a27c6b2aaed2253dbd7dd7dd4a2c97cc5647d1730a171214d1d9fc0158575ec5a3e4f12d40a603bc16e4c", [[], [], [], [], [], [], [], [], [], []]}, 0xa8b) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:30 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1839.233177] ubi0: detaching mtd0 [ 1839.250234] ubi0: mtd0 is detached [ 1839.263232] ubi0: attaching mtd0 [ 1839.275151] ubi0: scanning is finished [ 1839.366085] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1839.373568] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1839.380482] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1839.388808] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1839.397029] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1839.407987] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1839.430662] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1839.453423] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1839.463856] ubi0: background thread "ubi_bgt0d" started, PID 2650 [ 1839.464062] ubi: mtd0 is already attached to ubi0 [ 1839.477063] ubi: mtd0 is already attached to ubi0 14:59:33 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:33 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 14:59:33 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:33 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0xa}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat(r3, &(0x7f0000000040)='./file0\x00', 0x40000, 0x0) fcntl$dupfd(r1, 0x406, r4) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_G_STD(r6, 0x80085617, &(0x7f0000000140)) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r7, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:33 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f00000000c0)='hfsplus\x00', &(0x7f0000000140)='./file0\x00', 0x1, 0x3, &(0x7f0000000400)=[{&(0x7f0000000180)="58e489d5c062da271141e9c8834c46bf4fccf4aeb357a4527c96e3dc6dc0471ee6658afa6b6d5b844af45ce0da1494d2d4601d88722e7e1c983b53d070e0a6caf2ab806a2d62f4e84ed775e5ccfbd68d1518afc3bf3c275caab6d6bda3d517c85ec5baa849d55c4f6aeb14b6ad505050c6912c15432391b3694a59192788c376b18eae9ae88c780b6b780f0772a356", 0x8f, 0x3ff}, {&(0x7f0000000240)="5533f31ddd329f26d02d4164179b8c6f3248b48c3501435fc89752da6ee393c979b6497142020dae40cbb970e91c27854de33f5ee7d3e34c96ef884c70edc9d998b6facb5fe99474563ee0bdc1c0ef192e16a7c96591b5196f1a9f57ab65a98a47d24642d8c7f3c0104246a20565d1b041ae8c49f915e5e0394c6b411d7558b6d426925670897b891233e27656c65858665a238b5ca65d450832e1dbbffffb5e462abca3e3883cacfc624e1b6c6d54c01190ebd1225d04d77545ac2cd0cd788f6b9857c7f5d52d29", 0xc8, 0x6}, {&(0x7f0000000340)="0b2e0fa7d70eb8da00e61a3ed6beb75257a08ad61d882ac15b2668fc5c87bcbb847c03fbe78c7bc839b4eb6c2593ebb8e2718bd8d9b8770c7fb466e1da99c51aa1405aa9c2d6b914d1dd5d4b51a88724a096ced99146ea70d52c1bee1bfe326827bf388ae0a18bdf46b4c7812f87f12bcdd60061f12803ddb32793a8a2e2181a799472f79e246eb79ee2b6ff4a5f3e80084a2ececcdda0157024bf3f354aea", 0x9f, 0x9}], 0x2901000, &(0x7f0000000500)=ANY=[@ANYBLOB="63726561536f723d97e12b0300000000000000306d4db967e0c77de83030203f003030303030303030352c6465636f6d706f73652c646f1f0000000000000000092c00da143b957df590528f3b935e1ba212ec149755d7c0657115a944193c9d4b"]) 14:59:33 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r2}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r2, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000002c0)={r2, 0x81, 0x5}, 0x8) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) r5 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x3, 0x604101) ioctl$DRM_IOCTL_MODE_SETGAMMA(r5, 0xc02064a5, &(0x7f0000000200)={0x4, 0x4, &(0x7f0000000140)=[0x40, 0x3, 0x1, 0x7], &(0x7f0000000180)=[0x6b20, 0x7, 0x7, 0x32b, 0xee1c, 0x400, 0x3], &(0x7f00000001c0)=[0x5, 0x4, 0x6, 0x3, 0xbe]}) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000240), 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe, 0x2}, r1, 0x0, r0, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) ioctl$TIOCSIG(r5, 0x40045436, 0x2e) [ 1841.754245] ubi: mtd0 is already attached to ubi0 [ 1841.766856] ubi0: detaching mtd0 [ 1841.781776] ubi0: mtd0 is detached 14:59:33 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, 0x0, 0xfdef) 14:59:33 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_PPC_GET_PVINFO(r2, 0x4080aea1, &(0x7f0000000140)=""/142) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:33 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x4, 0x5d7, 0x6086}, 0xc) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:33 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:33 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$LOOP_SET_FD(r2, 0x4c00, r3) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1841.921399] ubi0: attaching mtd0 14:59:33 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = gettid() ioprio_set$pid(0x2, r0, 0x80) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) [ 1841.959068] ubi0: scanning is finished [ 1842.099157] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1842.113839] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1842.120924] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1842.135430] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1842.146632] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1842.159861] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1842.175392] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1842.197597] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1842.210062] ubi0: background thread "ubi_bgt0d" started, PID 2720 [ 1842.235941] ubi0: detaching mtd0 [ 1842.243395] ubi0: mtd0 is detached [ 1842.252991] ubi0: attaching mtd0 [ 1842.266813] ubi0: scanning is finished [ 1842.347819] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1842.355013] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1842.363474] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1842.369813] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1842.378281] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1842.385620] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1842.394601] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1842.404623] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1842.414557] ubi0: background thread "ubi_bgt0d" started, PID 2732 [ 1842.414860] ubi0: detaching mtd0 [ 1842.427403] ubi0: mtd0 is detached 14:59:36 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, 0x0, 0xfdef) 14:59:36 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:36 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:36 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0xfffffffffffffffe}, 0x20c2, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:36 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getpeername$llc(r3, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000140)=0x10) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1844.805974] ubi0: attaching mtd0 [ 1844.844401] ubi0: scanning is finished 14:59:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, 0x0, 0xfdef) 14:59:36 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0xfdef) [ 1844.975008] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1844.983212] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1844.989817] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1845.019814] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1845.028660] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1845.037111] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1845.045295] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1845.056820] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:59:36 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x2}, 0x0, 0x4, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x8000, 0x0) mq_open(&(0x7f0000000040)='ppp0self-}@cgroup:+\x00', 0x40, 0x0, &(0x7f0000000080)={0x780e, 0x7, 0x0, 0x9}) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) accept(r1, &(0x7f0000000640)=@caif=@util, &(0x7f00000006c0)=0x80) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmmsg(r3, &(0x7f0000000600)=[{{&(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x0, 0x0, 0x0, 0x2, {0xa, 0x4e22, 0x0, @private0={0xfc, 0x0, [], 0x1}, 0x3}}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000240)="9bd57e3227da9c6088ed7cec9873b908929a4f5141e4e34f17c83bfc878882080c168e62bc908238fc2700165b1187af28823e9b72ec4f62af337bf8945c2852c0ac6dab3f65d7dc51e964fb8d7951b92b32fc9a43e8cc386ea93b491763a744f3ef93a681988f4e42a21ed774fec2713a0134fe12eb20953dbf334d8e96626ef6d93b4da2b1d6969278fa0aa81a3f1fca66269e8a5c86d9a1b851a8dc6dd745ae9bd5e755681d7da717585f8f7675b6ee23d5fce296eadc343a8d5a3435fc49881dfc9bc9bca90eaf393089fc6253c30ff9", 0xd2}, {&(0x7f0000000340)="242cee18843fb81cbd934c4df1c1fae0b635a0ea5447500acdab0b82e12a551e9654db7148b44e1ff238f33d4c6c5e6335101937b5d7aee332442f85ba7730181ef289d0116436ac6e2292fbae860f0c43a70f3e876d75c7bb5084998b219bfaff6d9077f46fde12779fd55c0558955015", 0x71}, {&(0x7f00000003c0)="52e24943661ab97b800af1b72471b98c639839dd8e2899182cd3cd8c7eeaeab55335f33b3951deb583e4956909bd2e37d286898e3c47d7e165c6eb4435f1cfa50c82439ceeb48209baa81bd5802d37d19ce2b3e266c3ed7eefe431e38bf12847a8ca21b0b3f1d662f1f10517a90e23c9c2dcf23fd8badf4a162f8e48106722ae2ac584f3e381df94d02fc53067e9093029df7b8725224eaf8ca6d28b8a4bfdd8fafc8f75e569060bf8d0e99786cea78a288a12cb59cecc37bea34057fdcfd2d072440cd3ada25335672864553e67d384b9fe6fcca78a8d0dc1df", 0xda}], 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="d8000000000000000b01b9c04cf6beb9880000e2000000ecd6a12229db8daf418015c39c7a1570a5b1c07b92700bfed7cb8195b95727bda7ecf8d70ecaf9601080614b39b58ff9b232cb5385f9a6084f31ad9797ba34677e14b26fcd02b3f150bd7cbe415df444e5a126eb42b95637e8e19b16ec6f5a200139d89398a1022005169fc540752e7666e880ad5d7e203698702c341fee1f7b89271aafc360d183f2e18557f8e5c6f697739ea6f851c6e89a50f0014af4e07e15417a69a6a5e1e277541a555278b8d01ed17706fe7c812b338796c744ecb4d62a31000000000000d641da030c5ecc7841d0f72a713203f220ff4c160cb442fbd11f6a9a86f0e95114980d754e5f949a18507b16d482"], 0xd8}}], 0x1, 0x20000000) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:36 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f00000000c0)={0x8000, 0x86b, 0xff, 0x2}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) msgget(0x2, 0x2) [ 1845.067218] ubi0: background thread "ubi_bgt0d" started, PID 2779 [ 1845.081346] ubi: mtd0 is already attached to ubi0 [ 1845.092267] ubi0: detaching mtd0 [ 1845.116224] ubi0: mtd0 is detached 14:59:36 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r4) [ 1845.144276] ubi0: attaching mtd0 [ 1845.161878] ubi0: scanning is finished [ 1845.260980] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1845.267817] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1845.275694] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1845.282716] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1845.289389] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1845.296863] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1845.305200] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1845.323405] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1845.333813] ubi0: background thread "ubi_bgt0d" started, PID 2805 [ 1845.334040] ubi: mtd0 is already attached to ubi0 [ 1845.375634] ubi0: detaching mtd0 [ 1845.380893] ubi0: mtd0 is detached [ 1845.388985] ubi0: attaching mtd0 [ 1845.398656] ubi0: scanning is finished [ 1845.466828] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1845.474650] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1845.482793] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1845.489240] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1845.500659] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1845.509171] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1845.518378] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1845.529344] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1845.539445] ubi0: background thread "ubi_bgt0d" started, PID 2815 [ 1845.548912] ubi0: detaching mtd0 [ 1845.555098] ubi0: mtd0 is detached 14:59:39 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x9) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x1f, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:39 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:39 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:39 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0xfdef) 14:59:39 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1847.835154] ubi0: attaching mtd0 [ 1847.857522] ubi0: scanning is finished 14:59:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0xfdef) [ 1848.000283] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1848.013996] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1848.024350] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1848.030700] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1848.043069] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) [ 1848.049182] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1848.067664] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1848.077384] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1848.088963] ubi0: background thread "ubi_bgt0d" started, PID 2859 14:59:39 executing program 2: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7fffffff}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, r2, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$FUSE_OPEN(r5, &(0x7f0000000040)={0x20, 0x0, 0x7, {0x0, 0x1}}, 0x20) 14:59:39 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_config_ext, 0xa0c8}, 0x0, 0x4, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r4, 0xc0305710, &(0x7f0000000040)) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000140)={0x0, {0x8000, 0x2}}) [ 1848.101167] ubi0: detaching mtd0 [ 1848.110422] ubi0: mtd0 is detached 14:59:39 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) pread64(r0, &(0x7f0000000180)=""/4096, 0x1000, 0x7ff) gettid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r1, 0x4, r0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$VIDIOC_ENUMAUDIO(0xffffffffffffffff, 0xc0345641, &(0x7f00000000c0)={0xd0a, "1faa78eda4f9957a8c719c63a7a7f3e04477ad3b3c407d4481645d1106fd771c", 0x3, 0x1}) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, 0x0, 0x0) 14:59:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) [ 1848.165726] ubi0: attaching mtd0 [ 1848.170671] ubi0: scanning is finished 14:59:39 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open(&(0x7f000001d000)={0x3, 0x70, 0x0, 0x0, 0x40, 0x0, 0x0, 0x7f, 0x24305, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext={0x0, 0x40000040004}, 0x0, 0x80002, 0x0, 0x0, 0x0, 0x99}, 0x0, 0xffffffffffffffff, r2, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x7, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x401}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x40) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) mmap$snddsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc, 0x8031, r6, 0xc000) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1848.299206] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1848.307451] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1848.318878] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1848.343431] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1848.350323] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1848.363431] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1848.374183] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1848.387743] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1848.406214] ubi0: background thread "ubi_bgt0d" started, PID 2890 [ 1848.415419] ubi: mtd0 is already attached to ubi0 [ 1848.422980] ubi0: detaching mtd0 [ 1848.429783] ubi0: mtd0 is detached 14:59:42 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f00000000c0)) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:42 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) 14:59:42 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ASHMEM_GET_PIN_STATUS(r2, 0x7709, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) r4 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x3) splice(r4, &(0x7f0000000040)=0x2602, r6, &(0x7f0000000140)=0x6, 0xffffffff, 0x8) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcsa\x00', 0x200, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:42 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:42 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_XSAVE(r3, 0x5000aea5, &(0x7f0000000140)={[0x6, 0x1ff, 0x80, 0x10000, 0x4, 0x0, 0x0, 0x7, 0x800, 0x5, 0x4, 0x6, 0x20, 0x8001, 0x10000, 0xfffffff8, 0x9, 0x0, 0x4, 0x7, 0x3, 0xcd, 0x3, 0x1, 0x1, 0x81, 0x101, 0x8, 0x9, 0x6, 0xffffffcc, 0x8, 0x2, 0x4, 0x200, 0x3, 0x6, 0x9, 0xfffffffe, 0x4, 0x8, 0x0, 0x80000001, 0xfffff000, 0x5, 0x400, 0x7739, 0x2, 0x9, 0xffffffe6, 0x40, 0x3ff, 0x7f, 0x2, 0x2869, 0x5d, 0x3, 0x1b84cdcf, 0x0, 0x10001, 0x5, 0x8, 0xf8e5, 0x3, 0x7, 0x1, 0x5, 0x9, 0x101, 0x4, 0x2, 0x1, 0x1, 0x7, 0x2, 0x2, 0x7, 0xa5, 0xa4, 0x35cf, 0x1, 0x2, 0xae, 0x8, 0x8, 0x401, 0xfffffff7, 0x80000000, 0x8, 0x81, 0x10001, 0x5, 0x7, 0x6, 0x4, 0x1, 0xffffff00, 0x80, 0x1000, 0x7, 0x3, 0x5, 0x9, 0x8, 0xffff7fff, 0xffff0000, 0x80, 0x800, 0x517d, 0x2c, 0x5, 0x6b, 0x2, 0x1ff, 0x1, 0x6, 0x0, 0x4, 0x0, 0x1, 0x4, 0x7, 0x82a, 0x8, 0x7, 0x7, 0x2, 0x9, 0x0, 0xffff0001, 0x100, 0x5, 0x0, 0x9, 0xb8, 0xa7ec42a, 0x800, 0x5, 0x8b43, 0x8b, 0x7, 0x0, 0x2, 0x40b0, 0xfffffffb, 0x1, 0x4, 0x4, 0xffffffff, 0x5d56, 0x2, 0x6, 0x8, 0x8, 0x80, 0x6, 0x6, 0x1, 0x9, 0x4, 0x5, 0xa8e, 0x1, 0x6, 0x7, 0x3, 0x3, 0x7, 0xbfea, 0xd35, 0x0, 0x1, 0x0, 0x6bf, 0xa, 0x3, 0x4, 0x200, 0x9, 0x1, 0x1ad8e9b2, 0x6, 0xfff, 0x9, 0x8b0, 0xfffffff7, 0xfffffff7, 0x100, 0x445, 0x9721, 0x81, 0x3, 0x1, 0x2, 0x40, 0x5, 0x0, 0x7f, 0x9, 0x8, 0x1, 0x6, 0xa8, 0x2, 0x401, 0x0, 0x4, 0x7fff, 0x5, 0x5, 0x9, 0x1, 0x2, 0x9, 0x20, 0x3, 0x1, 0x5, 0xfff, 0x1, 0x3, 0xffffff81, 0x2, 0x80000000, 0x85, 0x5, 0x0, 0x200, 0x2, 0x0, 0x7, 0x5, 0xe03, 0x1, 0xfffffff9, 0x4, 0x1, 0x9, 0x5, 0x0, 0x6, 0x3, 0x3, 0x3, 0x3f, 0x1, 0x7ff, 0x6, 0x920, 0xfe7, 0xfffffff9, 0x0, 0xfffffffe, 0x3, 0x5, 0x4, 0x8, 0x5, 0x7, 0x3, 0x9, 0x2, 0x200, 0xff, 0x95, 0x7ff9, 0x5, 0x8, 0xd89cc203, 0xff, 0x200, 0x40, 0x8, 0xffffccb0, 0xffff, 0x0, 0x3, 0x3, 0x0, 0x8000, 0x1f, 0x4, 0x8, 0x8617, 0x8, 0x7, 0x1000, 0x1ff, 0x1, 0x3, 0x800, 0x8001, 0x5, 0xffffff80, 0xb6c2, 0x7fffffff, 0x4, 0x0, 0x1, 0x2ab7, 0x7, 0xffff, 0x8001, 0xd9d9, 0x20, 0x400000, 0x1, 0x5340, 0x0, 0x4e, 0x80000001, 0x1, 0x0, 0x8, 0x80000000, 0x80000001, 0x9, 0x4, 0x8, 0x12, 0x2, 0x7f, 0x3, 0x4, 0x45, 0x3, 0x2, 0x101, 0x100, 0xdc2, 0x80000001, 0x8, 0x2c0b1c84, 0x6, 0x1, 0x7, 0x101, 0x8, 0x9386, 0x5, 0x361, 0x1, 0x6, 0x80000001, 0x5, 0x5, 0x6b, 0x8, 0x20, 0x17, 0xffff0001, 0x7fffffff, 0xffff, 0x20, 0x6, 0x10000, 0x4, 0x1, 0x10001, 0x0, 0x5, 0x0, 0x40, 0x800, 0xadb3, 0x8, 0x8, 0x10000, 0x8001, 0x5, 0x6, 0x9, 0x9, 0x6, 0x800, 0x5, 0x100, 0x4, 0x7, 0x9, 0x7fff, 0x7, 0x9, 0x329, 0x80000000, 0x9ad, 0x6, 0x4, 0x90, 0x7, 0x5f3, 0x0, 0x8, 0x8, 0x10001, 0x5, 0xae, 0x400, 0x4, 0x1, 0x0, 0xfffffffd, 0x5, 0x80000000, 0x4, 0xb7, 0x2, 0x2, 0x7, 0x0, 0x4, 0x5, 0x2, 0x1, 0x6, 0x10000, 0x5, 0x3ff, 0x8, 0x0, 0x8001, 0x80000001, 0x6, 0xc1, 0x0, 0x91, 0x7, 0xacde, 0x100, 0x4ba, 0x2, 0x101, 0x4, 0xffffffd4, 0x800, 0xfffffe01, 0xfbf, 0x1, 0x7fff, 0x10001, 0xffff, 0x9, 0x4, 0x5, 0x0, 0x8001, 0x1, 0xfff, 0x4, 0x0, 0x9, 0x0, 0x100, 0xfffffffb, 0x9, 0x3, 0x157, 0x2, 0x3, 0x9, 0x0, 0x1f, 0x8001, 0x6, 0x7, 0x0, 0x9, 0xfffffff9, 0x3, 0x0, 0x80, 0x7, 0x9, 0xab, 0x333, 0x9, 0x2, 0x9, 0x6, 0x1, 0x0, 0x7f, 0x40, 0x3, 0x5, 0x1, 0x90, 0x4, 0x0, 0x1, 0xfffff001, 0x4, 0x80000000, 0x4, 0x0, 0x20, 0x2, 0x9, 0x5, 0x4, 0x6, 0x200, 0x9, 0x1, 0x1b88, 0x6, 0x80000000, 0x7fffffff, 0xffff, 0x4, 0x0, 0x1ff, 0xff, 0x4, 0x4, 0xd21, 0x1, 0x1, 0x3, 0x9, 0x1, 0x4, 0x3, 0x7e7, 0x81, 0x0, 0x8000, 0x356b, 0x5, 0x1, 0x3, 0x4, 0x7, 0x6, 0x4, 0x3656bd2e, 0x4, 0x8001, 0x4, 0x81, 0x9, 0x96, 0x7f, 0x40, 0x2996, 0x10001, 0x5, 0x2, 0x8, 0x6, 0xea, 0x1, 0x4, 0x3, 0x6, 0x9, 0x6, 0x401, 0x3, 0x9, 0x2, 0x2, 0x1f, 0x7fff, 0x10000, 0x5, 0xc83, 0x6, 0xc32e, 0x6, 0x9, 0x7, 0x1ff, 0x400, 0x0, 0x6, 0x1000, 0x80000000, 0x8, 0x543, 0x3, 0x39df, 0x7, 0xffffffb7, 0x9bb5, 0x8, 0x7f, 0x7f, 0x0, 0x3, 0x7, 0x3, 0x7, 0x9, 0x101, 0xfe, 0x90000, 0x6, 0x66a, 0x1, 0x1, 0x1, 0x81, 0x2935cb90, 0xd0, 0x20, 0x80, 0x4f9, 0x9, 0x0, 0x8000, 0x6, 0x0, 0xffffffff, 0x8, 0x5, 0x0, 0x9, 0x3f, 0x100, 0x1, 0x3, 0x87, 0x7, 0x80, 0x9, 0xb1c, 0x5, 0x1000, 0x8001, 0x8000000, 0x400, 0x9, 0x10000, 0x2, 0x9, 0xffff0879, 0x0, 0x9, 0x7, 0x0, 0x3, 0x80, 0x0, 0xaa723ab, 0xfff, 0x9edb, 0x7, 0x4, 0x3, 0xfff, 0x4, 0x7, 0x7, 0x1, 0xffff0000, 0x9, 0x8, 0x8001, 0xf9, 0x2, 0x71a, 0x1f, 0x394b5b3d, 0x4, 0xffff7fff, 0x9, 0x1, 0x668f, 0x0, 0x1, 0x1, 0x400, 0x4, 0x9332, 0x1, 0x1c0000, 0x10001, 0x9, 0x3, 0x5, 0xfff, 0xffff, 0xbb, 0x9, 0x4, 0x0, 0x9, 0xc1bf, 0x8f, 0x1, 0x8, 0x8, 0xff, 0x9, 0xe8, 0x9, 0x3, 0x9, 0x2, 0x8, 0x7, 0x1000, 0x8, 0x10000, 0x2, 0x9, 0x5, 0x3f, 0x6, 0x3, 0x3, 0x4, 0x401, 0x5, 0x4, 0x56, 0x7, 0x9, 0x5, 0x6, 0x0, 0x0, 0xfe, 0x94b4, 0x7, 0x5, 0xf307, 0x9, 0x2, 0x3ff, 0xa00, 0x1, 0x8, 0x0, 0x6, 0x7, 0x7, 0x0, 0x400, 0x6c82, 0x400, 0x20000, 0xf, 0xa4, 0x6, 0x401, 0x8001, 0x3, 0x2, 0x1ff00, 0x80, 0x1ff, 0x7, 0xff, 0x3, 0x5, 0x0, 0x2, 0x4b56, 0x0, 0x5, 0xa1e9, 0x7, 0x264b425f, 0x9, 0x4fe80000, 0x4, 0x7f, 0x2, 0xfff, 0x17b, 0xfffffffc, 0x4, 0x8, 0x2, 0xffff, 0x6, 0x100, 0x8, 0x0, 0x1, 0x6, 0x1, 0xff, 0x3, 0x3, 0x9, 0x2, 0x2, 0x2, 0x0, 0x4, 0x6, 0xfff, 0x2, 0x40, 0xffffffff, 0x81, 0xfff, 0x1a1, 0x4, 0x1, 0xf8, 0x1140fbb3, 0x6, 0x5, 0x6, 0x4, 0x5, 0xb8, 0x3, 0xfffffff9, 0x8002, 0xfff, 0x40, 0x1, 0xffffff7f, 0x3, 0x6, 0x889, 0x8, 0x0, 0x1, 0x10000, 0x1, 0x339e, 0x2, 0x0, 0x7, 0x0, 0x0, 0x377, 0x7, 0xfffffffd, 0x2a1b, 0x40, 0x20, 0x4, 0xffffff01, 0x400, 0x100, 0x81, 0x6, 0xe, 0x8, 0x7fff, 0x80, 0x101, 0x10000, 0x1ff, 0x4, 0x20, 0x9, 0x94, 0x36f, 0x65fc, 0x8, 0x7, 0x7, 0xffffffff, 0x9, 0x6, 0x1, 0x0, 0x2, 0x5, 0x40000000, 0x2, 0x0, 0x6, 0x18e5, 0x80000001, 0x1, 0x4, 0x101, 0xfff, 0x8c9a, 0x5, 0x0, 0x2, 0x1, 0x7, 0x88f4, 0x101, 0x8, 0x0, 0x9, 0x20, 0x1, 0x1, 0x401, 0x4, 0x7, 0x7, 0x9, 0x7, 0x2629d9e6, 0x6, 0x2, 0x2, 0x3, 0x8, 0x54, 0x18909b37, 0xfff, 0x10000, 0x10001, 0x401, 0x5c6, 0x9, 0x6, 0x7, 0x3, 0x9, 0xcd6, 0x9, 0x100, 0xc939, 0x0, 0x6, 0x0, 0xb6, 0x20, 0x6, 0x358, 0x1, 0xfffffff8, 0x9, 0x2, 0x4, 0x1, 0xffff7fff, 0x544, 0x9, 0xfffffffd, 0x0, 0x865, 0x0, 0x9, 0x800, 0x5, 0x70000000, 0x7ff, 0xfffffff9, 0x10000, 0x0, 0x4, 0xfffeffff, 0xfff, 0x4, 0x1f, 0x1ff, 0xe, 0x7, 0x2, 0x80000000, 0x5, 0x7, 0x0, 0x100, 0x0, 0x686, 0xffff8000, 0x8a, 0x2, 0x0, 0x7ff, 0x9, 0x3cec28d7, 0x800, 0x9, 0x491, 0x4, 0xffffffff, 0xfff, 0x1f, 0x50e1, 0xada2b36, 0x1, 0x1650, 0x3, 0x4, 0x10001, 0x9, 0x2, 0x4, 0x1, 0x81, 0x7, 0xfffffffb, 0x1000, 0x8, 0x6, 0x1, 0x7fffffff, 0x1, 0xb0ee, 0xbf9, 0x0, 0xfffffecc, 0x7, 0x0, 0x5f, 0x7, 0x7ff, 0x2, 0x6fc, 0xf74ef23f, 0x100, 0x8, 0x8, 0x401, 0x2, 0xffffffff, 0x0, 0x2, 0x800, 0x6, 0x7f, 0x8, 0x400, 0x4, 0x20]}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) r6 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCSBRKP(r6, 0x5425, 0xfffffffffffffff7) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x18a, 0x401, 0x612, 0x8}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1850.914198] ubi0: attaching mtd0 14:59:42 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) request_key(&(0x7f00000000c0)='id_legacy\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0xfffffffffffffffd) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1850.948002] ubi0: scanning is finished 14:59:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c70000000000"], 0xfdef) 14:59:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c70000000000"], 0xfdef) [ 1851.159557] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1851.168143] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1851.190555] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1851.197250] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1851.210157] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1851.233666] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1851.242478] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 14:59:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c70000000000"], 0xfdef) 14:59:42 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f0000000240)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x9692}, 0x0, 0xe, r0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) fcntl$dupfd(r2, 0x406, r3) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x440, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f00000001c0)={0x7ff, 0x3, 0x4, 0xeb27c71118570964, 0x1, {}, {0x3, 0x8, 0xda, 0x7, 0x8, 0x8, "a01c3f4a"}, 0x7, 0x2, @planes=&(0x7f0000000180)={0x2, 0x8, @mem_offset=0x4, 0x28e}, 0x8, 0x0, 0xffffffffffffffff}) ioctl$BLKRRPART(r5, 0x125f, 0x0) mmap$snddsp(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x7, 0x810, r4, 0x5000) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1851.264143] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1851.273899] ubi0: background thread "ubi_bgt0d" started, PID 2947 [ 1851.289473] ubi: mtd0 is already attached to ubi0 14:59:43 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000040)={0x57}) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', r4}) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r6, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r7, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:43 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) setpriority(0x0, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x28, r4, 0xc573de0d27bdfe6f, 0x0, 0x0, {0x3, 0x0, 0x2500}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r3, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)={0x180, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x2c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2e6d}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xe6b}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}, @TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x200}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0xd8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xbe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x203}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x30}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x20000005}, 0x2000c000) [ 1851.381134] ubi0: detaching mtd0 [ 1851.395317] ubi0: mtd0 is detached [ 1851.421170] ubi0: attaching mtd0 [ 1851.432668] ubi0: scanning is finished [ 1851.466604] Bearer rejected, not supported in standalone mode [ 1851.556385] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1851.564966] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1851.574047] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1851.587638] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1851.596564] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1851.609067] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1851.617680] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1851.635052] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1851.647183] ubi0: background thread "ubi_bgt0d" started, PID 2991 [ 1851.664634] ubi: mtd0 is already attached to ubi0 [ 1851.669807] ubi0: detaching mtd0 [ 1851.686603] ubi0: mtd0 is detached [ 1851.687795] Bearer rejected, not supported in standalone mode 14:59:45 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000"], 0xfdef) 14:59:45 executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:45 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000040)={0x2, 0x0, 0x6, 0x2, 0x1, 0x9, 0x3}) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r5, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000140)={0xc1, 0x80, 0x10208, 0x40, 0x7, 0x2, 0x0, 0x5, r5}, &(0x7f0000000180)=0x20) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:45 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8c000, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0xa5, 0x247]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x10000000000, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) r4 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}, &(0x7f0000000180)=0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0xffffffff) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:45 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000140)=0x8) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1853.927809] ubi0: attaching mtd0 [ 1853.941929] ubi0: scanning is finished 14:59:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000"], 0xfdef) [ 1854.088248] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1854.098008] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1854.115181] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1854.125578] ubi0: VID header offset: 64 (aligned 64), data offset: 128 14:59:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000"], 0xfdef) [ 1854.133745] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1854.140039] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1854.148501] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1854.158336] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1854.171252] ubi0: detaching mtd0 [ 1854.172872] ubi0: background thread "ubi_bgt0d" started, PID 3046 [ 1854.196683] ubi0: mtd0 is detached [ 1854.200713] ubi0: attaching mtd0 [ 1854.205753] ubi0: scanning is finished 14:59:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000"], 0xfdef) [ 1854.336742] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1854.344605] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1854.357861] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1854.364834] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1854.377890] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 14:59:46 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f0000000140)="acc17e763eb7fd5af6e09e19520a2d0a849ec92968acaee244e894c5a593a0f8ecf11af200167bd8fb0f6501f4b9c771dfc423f250b08d5b6091c2dcbcfcfd5c8accda8b1cd475056853e847c8bed911e876e940b5b232936dcafdde7bb9a8b7515d445ac187877691fee56a16a567219e2802fa4ad4ba8a955bf95416544fc47face983c7229d42337a84bd6f74276f220a1664b20945482d46eb67873c7abead3f7e8c0c106057e63e00b86f84e5871c8e2008c2c1e2c1ec78e0995599d3ee0eed83387a3b22137ec05c45c63fe4afcd02e971316be9729c6c4dd5507f", &(0x7f0000000240)=""/155}, 0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r3}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r3, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={r3, 0x65}, &(0x7f0000000340)=0x8) 14:59:46 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1854.384911] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1854.399165] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1854.409073] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1854.422808] ubi0: background thread "ubi_bgt0d" started, PID 3078 14:59:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000"], 0xfdef) [ 1854.493929] ubi0: detaching mtd0 [ 1854.507200] ubi0: mtd0 is detached [ 1854.519170] ubi0: attaching mtd0 [ 1854.535886] ubi0: scanning is finished [ 1854.668433] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1854.676393] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1854.684426] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1854.691325] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1854.698382] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1854.705156] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1854.713587] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1854.723771] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1854.733747] ubi0: background thread "ubi_bgt0d" started, PID 3117 [ 1854.742607] ubi0: detaching mtd0 [ 1854.749228] ubi0: mtd0 is detached 14:59:48 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:48 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x200000000000}, 0x4611, 0x4000000000000000, 0x8e09c9bc, 0x0, 0x0, 0xfffffffc}, 0x0, 0x4, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000"], 0xfdef) 14:59:48 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:48 executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:48 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvme-fabrics\x00', 0x22a000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, r1, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bsg\x00', 0x321481, 0x0) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000180)) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1856.994106] ubi0: attaching mtd0 [ 1857.005163] ubi0: scanning is finished 14:59:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/47], 0xfdef) [ 1857.066636] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1857.075567] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1857.083709] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1857.091123] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1857.098302] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1857.121969] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1857.131246] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1857.152135] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1857.162111] ubi0: background thread "ubi_bgt0d" started, PID 3163 [ 1857.168910] ubi0: detaching mtd0 14:59:48 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x4004c0, 0x0) sendmsg$AUDIT_TTY_SET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd2b, 0x25dfdbfb, {}, ["", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000840}, 0x44040) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1857.186338] ubi0: mtd0 is detached [ 1857.196703] ubi0: attaching mtd0 [ 1857.202985] ubi0: scanning is finished 14:59:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/47], 0xfdef) 14:59:48 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x202, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000940)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1004}, 0xc, &(0x7f0000000900)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_DELOBJ={0x38, 0x14, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELFLOWTABLE={0x178, 0x18, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x150, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xffffffff}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'vxcan1\x00'}, {0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'veth0_to_bridge\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}, {0x14, 0x1, 'batadv_slave_0\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'batadv_slave_0\x00'}, {0x14}, {0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'erspan0\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}]}]}]}, @NFT_MSG_NEWSETELEM={0x5a8, 0xc, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x580, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY={0x14, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}]}, {0x28, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_DATA={0x4}]}, {0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}]}, {0x58, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x40}, @NFTA_SET_ELEM_USERDATA={0x18, 0x6, 0x1, 0x0, "8a5d5d8746770e902fbb41a867413ce8757530b8"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x8}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xc5}, @NFTA_SET_ELEM_EXPIRATION={0xc}]}, {0x454, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0x34, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_DATA={0x2c8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x7f, 0x1, "aa24fe80eed96a4379280c0ab4a858acb0cc82cf76b03fc86eb9e56cab6a7f8042b4495a977de81cc24340c77853fce948bc3b807e884a462271b25f9c06111493b051bf8d754bde97255fde8a053ccc0de96cf9bc5970bebc12847c18a77c4dd52c8f95e60f3493251d7433ef02e66515d5252378112441eb6dda"}, @NFTA_DATA_VALUE={0xf5, 0x1, "19ef2ee4555c965d4b54e6ef8cca87a0c290250cc255e0acf4774a6c999c81d5477d0efabd75a346603545d96cedde0ad582ea6497faca2b6383c1c59d788b8b4e4b04418f2e80c54dfa2f9854333e474ecb6ef71fa99f31aceb23fb0818d1a5837d1feaf9988b73d3dec6d75bee5e8ccb05325fe57e43ff32c9526c0e3ed107d5e6e0df2577fa7b9de71d440b0f0ac72c4b6cdae1b6fcef1fe61a45ee9d91a87e8cc832d2e8cef68df4e0ca164b141bb32943ce1dad18df65b1acd6394b28a75aa0b413c9b25f863c41d9a5768ea28bb2fd74d2cb7020f8744e4c1713b81c47905d2c0633c3594dd90ef28dee8c2ffbc7"}, @NFTA_DATA_VALUE={0x69, 0x1, "d9a5e610feb3b9641099d0620738458e577c8886771ebb541367992e05c64449d728061adefec1e9b7273a6291d179adff95dacad9f540ce6a8ea1ab400ea4ecdb505f819c03876dcabf5f5e17a2870a257395d05fe39836867f84394f8ffe6a3cbd617ad9"}, @NFTA_DATA_VALUE={0x3f, 0x1, "dff8547c30e6a9bb7b52b649c038e6bf6695602a50015081f24fa1441be056b3a96ae03918b1605bd238287779ea22b9581ae80b3404d3e0ba3117"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_KEY={0x120, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x8, 0x1, "652626a3"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xe, 0x1, "0370b137955b5e3d7f4f"}, @NFTA_DATA_VALUE={0x68, 0x1, "ab657c34222170b0b302c73527fbe74968d081ff03790e6456061c7201cead2c32573df29c8ea0fb463ab2312883840a84e424e8de0ca2faedd924d317fc6875df1f201fc67e474619bcbf3593f41f9d7f8e110827014bcf1ab86512f50dce0438fd092e"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1a42}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x4}, {0x58, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_USERDATA={0x45, 0x6, 0x1, 0x0, "e3819b1b2bbd0201d9f9f113709d50be821ea4d837115f3050272a7f5bde0ece759fe1ff853fdd07cda40cfed97b70f06181013ee779361352ea10b5cb3bef0186"}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}], {0x14}}, 0x780}, 0x1, 0x0, 0x0, 0x20040046}, 0x1) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1857.378137] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1857.396468] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1857.405367] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1857.420022] ubi0: VID header offset: 64 (aligned 64), data offset: 128 14:59:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/47], 0xfdef) [ 1857.427158] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1857.434224] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1857.442800] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1857.467553] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 14:59:49 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x3db8d09778740d71, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x35}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ipx\x00') r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000480)={0xa, 0x4, 0xfa00, {r4}}, 0xc) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000200)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f00000001c0)=0xae, r4, 0x0, 0x0, 0x1}}, 0x20) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) r6 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x9, 0x20000) r7 = getpid() sched_setattr(r7, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) tkill(r7, 0x4) ioctl$SG_SET_FORCE_PACK_ID(r6, 0x227b, &(0x7f0000000140)) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1857.490571] ubi0: background thread "ubi_bgt0d" started, PID 3196 [ 1857.500301] ubi: mtd0 is already attached to ubi0 [ 1857.538901] ubi0: detaching mtd0 [ 1857.551331] ubi0: mtd0 is detached [ 1857.589483] ubi0: attaching mtd0 [ 1857.594106] ubi0: scanning is finished [ 1857.650173] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 14:59:51 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/49], 0xfdef) 14:59:51 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)=0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1880, 0x0, 0x0, 0x8, 0x9, 0xfffffffe}, r2, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 14:59:51 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x6, 0xffffffffffffffff, 0xa) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ipv6_route\x00') r4 = epoll_create1(0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r4, 0x400c6615, &(0x7f0000000140)={0x0, @aes128}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 14:59:51 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5478f0f9, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000180)={0xa10000, 0x10000, 0x4, r5, 0x0, &(0x7f0000000140)={0xa10001, 0x2, [], @ptr=0x9}}) sendmsg$NFNL_MSG_CTHELPER_DEL(r6, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYRES16=r1], 0x38}, 0x1, 0x0, 0x0, 0x40050}, 0x800) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000340)={0x0, 0x5ff2, 0x1000, 0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x0, 0xffffffff, [], @p_u8=&(0x7f00000002c0)=0x81}}) ioctl$PPPOEIOCDFWD(r7, 0xb101, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0xb000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x4}, 0xc46, 0x0, 0x7, 0x0, 0x2, 0xfffffffe}, 0x0, 0x4, r4, 0x0) r8 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r8, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r8, 0xc0305615, &(0x7f0000000000)={0x0, {0x5, 0x5}}) ioctl$SOUND_PCM_READ_RATE(r2, 0x80045002, &(0x7f0000000040)) 14:59:51 executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1860.044848] ubi0: attaching mtd0 [ 1860.058597] ubi0: scanning is finished 14:59:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/49], 0xfdef) [ 1860.193353] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1860.202390] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1860.209490] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 14:59:51 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1860.235211] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1860.242754] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1860.249025] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1860.257378] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1860.268014] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1860.277678] ubi0: background thread "ubi_bgt0d" started, PID 3257 14:59:51 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x4c, 0x0, 0x4) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, 0x0, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) unshare(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x2, 0x7, 0x0, "0000000000000000000000000000000000000000000000000000000000001300000000000000000000000000000000000000000000000000000000000000000000000000000f00"}, 0xd8) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000040)={0x1, 0x4}, 0x8) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000240)="1b", 0x1, 0x8000, 0x0, 0x0) close(r2) 14:59:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/49], 0xfdef) 14:59:52 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000000c0)={0x0, 0x7b, &(0x7f0000000140)="f2ffa6bec004df798daddc2bd18462f2c259190a9dc04b3da178a1f3943f779cc6023a86c2b5707fff038b16151f0af44f1f9f1d01f0701f907f8de1ecd6f57d91ce8c4d9a73f670bb25b22c10d2106181a3918c54f24735ee273500fdb9a3cfc1788e64411fdbbf042d6d26b16e115488d2ad50ce6984ffaa1f0c"}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1860.345238] ubi0: detaching mtd0 [ 1860.355793] ubi0: mtd0 is detached 14:59:52 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000300)={{0x8000, 0x6ed}, 0x20}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r5, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000140)={r5, @in={{0x2, 0x4e20, @loopback}}, [0x7, 0x100000001, 0xac, 0x4, 0xffffffff7fffffff, 0x4, 0xfffffffffffffffa, 0x5, 0xdc2f, 0x5, 0xc3d2, 0x7d91fe12, 0xffffffffffff0001, 0x6, 0x9]}, &(0x7f0000000040)=0x100) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1860.429484] ubi0: attaching mtd0 [ 1860.472236] ubi0: scanning is finished [ 1860.617366] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1860.624783] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1860.633108] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1860.640292] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1860.647173] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1860.655243] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1860.663495] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1860.674038] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1860.684328] ubi0: background thread "ubi_bgt0d" started, PID 3297 [ 1860.685239] ubi0: detaching mtd0 [ 1860.698811] ubi0: mtd0 is detached 14:59:54 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:54 executing program 1: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:54 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) ioctl$FIONCLEX(r0, 0x5450) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 14:59:54 executing program 2: sendmsg$NL80211_CMD_GET_SCAN(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x60, 0x0, 0xab9535e9a6578fc1, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WDEV={0x6}, @NL80211_ATTR_WIPHY={0x8}, @NL80211_ATTR_WDEV={0xc}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WDEV={0xc}, @NL80211_ATTR_WIPHY={0x8}]}, 0x60}}, 0x0) r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000}, 0x2, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010026bd7000fddbdf25190000f307000100010000000500a300010000000c0099002d6c000000000000080001000000000008000300", @ANYRES32=r1, @ANYBLOB="050060008f000000"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x40000) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r3, 0x40184150, &(0x7f0000000040)={0x0, &(0x7f0000000140)="7a0f7f4e7dfcd649ab54cdaf2745d2e86890222c275c3ede10057ca2e2cda7183ba2f73283dd2975ce3ad1b8939902cd964ed0117470f9bb7e89b042b93108995f40ccafb59444b62da19f26a2d5beff5b3c9e6dff94c014ad7b959abc1362a97da9cb84bdfec4910e81d347b96fa16120507596367139523434235bd788c344cb9d972ce520c47bd5903f465f318a66cb894a002fb3711155993072a47ba8c0e8444c0eba9548954894d805cd89169ada23424077280a6446e8bed09f2a9c5be17b3d1a3941ce0038df3778fa31a1060eaf7919b12bd391faf9d9c220de8830f1e5b4e49615070a45554d427fb4", 0xee}) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000240), &(0x7f0000000280)=0x4) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0x5, &(0x7f00000002c0)=0x10000, 0x4) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:54 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:54 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000600)={0x7, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffd}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a0000000", @ANYRES16, @ANYBLOB="00012abd7000fddbdf250b0000004800508011000100e9799eb118ffff40400a5d7b22744036e2680000001100010034b63613acd1dbdb94a6abe8b500000009000100d99801234900000005000200050000000800030001ac0f0004002800400050800500020003000000070004001a3cf90008000700000000000500020003000000110001006549fa2b2debf2ffffffffffff00000000000700000000005c9b4be1361b0bee5b247e604a84303dfe09eecfa1e73907da958ac28592015d5b70e74778d73d9a833bd3bebdea8e4a189c8e6ff81f31246d249e974c8a14fddd683d6f11204d8a01c7bbe62a443e9b8fddfa9076f80da182709cd8dc3bfcd299b2197020e283cefad7fcc57990e3c89b98afd9e237b7b7311e4869469241dc8890360b78a9596ef00c6e6a70cb7402573e"], 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0xc4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x1000100) lseek(r4, 0x0, 0x3) r5 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r5, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) [ 1863.078383] ubi0: attaching mtd0 [ 1863.085283] ubi0: scanning is finished [ 1863.148722] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1863.155917] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1863.174223] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1863.180696] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1863.187491] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1863.193993] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1863.201677] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1863.211400] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1863.221959] ubi0: background thread "ubi_bgt0d" started, PID 3335 [ 1863.228424] ubi0: detaching mtd0 [ 1863.236515] ubi0: mtd0 is detached 14:59:54 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0xe2, 0x20, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x5}, 0xa752e43e0ccda41f, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) readahead(r0, 0x0, 0x7fff) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) r3 = socket$inet6(0xa, 0x3, 0x9) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$cgroup_type(r5, &(0x7f0000000180)='threaded\x00', 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f0000000140)={0x62, 0x0, [], [@enc_lim]}, 0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) [ 1863.299812] ubi0: attaching mtd0 [ 1863.304982] ubi0: scanning is finished 14:59:55 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) [ 1863.510756] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1863.533432] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1863.572676] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1863.601259] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1863.624691] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1863.673253] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1863.709908] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1863.739201] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1863.777500] ubi0: background thread "ubi_bgt0d" started, PID 3353 [ 1863.784319] ubi0: detaching mtd0 [ 1863.802400] ubi0: mtd0 is detached 14:59:55 executing program 0: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000140)=0xe) 14:59:55 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x1}, 0x0, 0x0, 0x1ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:55 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:55 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x280000000000002, &(0x7f0000000100)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000001040)={0x2, 0x4e23, @loopback}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001080)=""/4112, 0x1010}], 0x1}, 0x40000104) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)="beb963162a56840d2179e9588da73b863aa87057c044c80853911c5f2ffad9c51d64e80b67a63cfaa3db0afda8cc5563f9e5cba65f9dd52630fe334698b5b7da9baba87fe23f87d3365bef9bd50f7985713ff29b6c2b869dc24b2f9770aaa13a93f1a9a40d41fe9a7285693d2ecb75b2f427f76ee80d59b19f9297fb6ad1c9f2f58c3400e36fbf696ea65277010000800000000076ab082aa70dec85a7b444de7d83d366fc78244217797b795674d3083d3f2493f0b888ab3c2ba422a9", 0xbd}, {&(0x7f00000020c0)="cfa102aa05b6f03273dbfd72225be29e88fb8de8f1279099c7d060c4ce2ed20caefb8afd5239600d4b5d10fd688b136f263d630a1e8e663d72af5184db15f4104ea5b2edb1ae82570e5ac4bb5c3dcaf45eaa3e56464bd5f918d1ad530278e80bd406e07d62e3effbacd901655fe526b5ac3d10f24f94c1f51d31ef9dc16a0780dea7050a3547d0c91a0929039ce3f4af0a69543997d93ca560c21eec297aae8070cf870e9c7f94b570fa13e49e620bf6c4bd531a7e79c8250c79b61037cf47d432d77b55f29476390c530b9e6d08c7a343b2b90ae031106e1fb283f1aa17997b626f7357c1d954b18bcc91d3cc0e2690a404daa454bc2e4a32d2ee4e06b73260353637329a8de38f62c1566f367e209073868e2fb160e6ef4d86708c3f5285030e7691fb3258e0931879f4c6f29e78437b1f3fc8eb5b9ec9621247a8bf12b543c10036f53a8157b3209726bab10c57efd1b4b9b8006b0ae0e3c50db763b7994ab0aade218d253f3dd4903ae5dc3a8a75378c1fe33a26eb275ad3b75437270d0ecc0064c52b7bcece2b5117aed992735e53273024f10152d3dd30b9586a9d5b57c232ba887ac7e1e0b09d9cd889a36c00b8ab565a305e4bcde54be7d02f00dcb0115ce2f72ac98e4ccfd17c0d02921360d00ce4c5dc2f89a1bdea1ebcbb149e62004757ea49b191731bfb4a7a646db8bb85e3a1c00d9c5bb20dd34a4702f8fecbcad2e43f9494d1646ccf2137c0313abbb954c15344f38af118c2762cbdc84d67794eb204dd1390dad8906466629fa47ab21fa8080975970aa1f73cf51ddf2b73538f3073dac848699746df5979647cc69a5e87f85d89ddd49830ed4145c4b32791d45ebe6ff19d7ebbe0372f12465521463e93d0481ebf070e35550914ae463971c28a721c9a3337846ad120e04b96344b300a835492b9417d7dd5f3c3cda2c2030515e2d27359612da2ec15963592b901008800d34fc0fab15ef19e5172af41079828b83e1f59f8a7e7b147b656b589ed224e328bebbfac7dbe6e3d770a13f108d5161a0dadf9a4aae7edbba0b0c4a9cb5481efc38656f2353ae874f412ee288a0df23e3fa251cbad20b8e9a90eeec2891eed63b95cbadede22e0590607066d9335a9b4e8bb2d96442460e334856c911a33599235ee81b08d5b810f7dfb1a06e925776ae15e2722d633ca0904436fcf782e34842f08127b3c8594e611acc4b2fcd291218540194095efa024c0665527ad1f03101e55e0ea042b6d778297496498d83ac62929b1d88002fb47a88cf2c159b08a76cdba639549cb139033968e573482254405ab46d9d9a43787ff1bbc7476bcbe164ddd533c263b594fcc307f4264e0221626138d948aec44cdd9db", 0x3ce}, {&(0x7f0000000140)="86279a4e5d27d43a2737db90c36150fa59eaaf81c06de5799770772c4ecf7b48b0b4c6d963dc65a2231e6a35e0a29d489c2daf9826462857404aa955bcd152a1d5af733e044c74cb54f9690f63afb0ffdd90bdb5f0ff761e590aa4dcd89275637ab911bf2ea6dd64202c0def67df046813d9f924a7ddb6a5c2cdc030f821a3e508f2fc998a91eafba365c679d71b4d2ead28645fb1da0cb1c1f417345c8322c134cd4a8ca5ed02df9a5bd3a7a04d0e609ca87fa71b", 0xb5}], 0x3}}, {{&(0x7f0000000080)={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000280)="c771da3bbdd0750c60d40f29314a7b2662627cfb66d2a67b", 0x18}, {&(0x7f00000002c0)}, {&(0x7f0000000300)="39dbfdc4c54c7d7f5dfe17164aa740b643588ab9fae13c2951f39e5ee3123f5af6666befffb05c5c24157ab489193c234bb083f2a632c52b4a073b90baeaf4785dc5d65e8cdf2b248993c1bbd33ad41566e59e6bd98f57cfb4db42b3382309388911", 0x62}], 0x3, &(0x7f0000000480)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xfffffff8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xa0e}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @private=0xa010101}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x88}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000540)="7081b1db836977a2bd8dede439d2d8f79cb625f98c952acdb8c36f3863f17778315e5f1858ef616b74cf9fc186666382dba6e5b35b365aa9dcf14d33ee601228733289cfa4d8512d26f6f79b3c2a1977c2d4a05f6e3429c46473592f7ae50399ff5fec09f3b9997375e50a0f9918010f0f882075b8292b6fa95636f9e72dfbf977411039fd237967", 0x88}, {&(0x7f0000000600)="d006537374fec4424cf5a190a7a8573a", 0x10}, {&(0x7f0000000640)="1076ffd59b63785ccc5c", 0xa}, {&(0x7f0000000740)="c3fdf717796557cd5ddab2f9a5c622aed838ec956e11052fcb0edf9480997af29ff18338448f5e9e39e633ae872aefdedc3162de3f218f93fed44e30dec68d758ca24c50c583efcd03a4dfe4d649404d091409f1eea0e0c340c545f27b43f6e3b904254ea73b7b8707e6dc0c5e510618d0c78323c6e0e9c87f903b1a74dd1e0b8f6f2e1aa9808cda2c85bcf7199f639e671d5904e9fb1926d27edcd371a6502400e19370dd3527bab0e50e625fa380089f95c7c8f2d9e6e68921cdf78a13a346d34054ac11bda2c489e2786494cf34bddf9af4a6678d55313fabf26f55de5758aebcb37f19a2fbaaf20e94c0e6fd82ed20ee11f660885c59c4965371", 0xfc}], 0x4, &(0x7f0000000a40)=[@ip_retopts={{0x20, 0x0, 0x7, {[@rr={0x7, 0xf, 0x70, [@empty, @rand_addr=0x64010102, @rand_addr=0x64010101]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x80}}, @ip_retopts={{0x68, 0x0, 0x7, {[@noop, @rr={0x7, 0xb, 0xc1, [@local, @multicast1]}, @lsrr={0x83, 0x7, 0xde, [@empty]}, @generic={0x88, 0x10, "b4018b0e175cd0e0e011dd12c614"}, @rr={0x7, 0xf, 0x39, [@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, @multicast2]}, @timestamp={0x44, 0x24, 0x14, 0x0, 0x7, [0xad, 0x47, 0x3f, 0x4, 0xc4b7, 0x7fff, 0x9, 0x5]}, @end]}}}], 0xa0}}], 0x3, 0x0) shutdown(r0, 0x1) [ 1863.962866] ubi0: attaching mtd0 [ 1863.979167] ubi0: scanning is finished [ 1864.137875] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1864.145121] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1864.157403] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1864.165086] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1864.177345] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1864.184446] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1864.197432] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1864.207478] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1864.223562] ubi0: background thread "ubi_bgt0d" started, PID 3382 [ 1864.223895] ubi0: detaching mtd0 [ 1864.238499] ubi0: mtd0 is detached [ 1864.254300] ubi0: attaching mtd0 [ 1864.274467] ubi0: scanning is finished [ 1864.347515] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1864.355561] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1864.362567] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1864.369035] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1864.379834] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1864.387372] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1864.395325] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1864.405215] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1864.414975] ubi0: background thread "ubi_bgt0d" started, PID 3392 [ 1864.424217] ubi0: detaching mtd0 [ 1864.437276] ubi0: mtd0 is detached 14:59:57 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:59:57 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5000edff000401010000000000000000020000020a0002000000000200000000060006400640000200000a000200000000060100000008000540000000030a0002000000090503000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x40044}, 0x20000000) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x1, 0x4) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, 0x0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000240)) 14:59:57 executing program 4: 14:59:57 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r5, &(0x7f0000000040)={0x4}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 14:59:57 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 14:59:57 executing program 1: 14:59:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000200, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="0503", 0x2, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/50, 0x32}], 0x1}, 0x0) 14:59:57 executing program 1: clone(0x2000000000200500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000780)=ANY=[@ANYBLOB="726120ba338ce29d60a7ac515343770000010000000000000000000000000000000000000000000000000000c103000003000000d002000000000000f0813453c31b6a07bf0000000600000000020000000200000002"], 0x1) r1 = memfd_create(&(0x7f0000000180)='\xa5E\f\x87\xda\n\xd9F\xde\x8c$3\x92\xe6e\xe4\xec\xad\x1c.\b\x06\xa76\x82F\xff\xff\xff\x7f\x00\x00\x00\x00\x9af\xaeM\xc4', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r1, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, 0xd0000002, 0x0}, 0x0, 0x8, &(0x7f0000000000)) syz_open_procfs(0x0, &(0x7f0000000080)='personality\x00') prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') 14:59:57 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:59:57 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000140)=0xe) 14:59:57 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x4, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2000000000000001}, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x468401, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000180)={0xa, 0xfffdfffe, 0x4, 0x44000}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, &(0x7f0000000140)={0x0, 0x20, 0x3, 0x1f, 0x0, 0x1, 0x8}, 0xc) gettid() ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x6, 0x9}}) r5 = socket$inet6(0xa, 0x3, 0x9) syz_init_net_socket$ax25(0x3, 0x3, 0xce) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000000), 0x4) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000040)={0x57, 0x1f, 0x0, 0x3, 0x4, 0x8, 0x80, 0x6, 0x4, 0x9, 0xc5, 0x0, 0x1, 0x2}, 0xe) [ 1866.356741] ubi0: attaching mtd0 [ 1866.392426] ubi0: scanning is finished [ 1866.484421] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1866.491694] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1866.498326] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1866.504823] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1866.511916] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1866.518102] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 14:59:58 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) [ 1866.525747] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1866.535724] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1866.545068] ubi0: background thread "ubi_bgt0d" started, PID 3448 [ 1866.549914] ubi0: detaching mtd0 [ 1866.561223] ubi0: mtd0 is detached 15:00:00 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:00 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) 15:00:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x83, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r0, 0xc0905664, &(0x7f0000000140)={0x0, 0x0, [], @bt={0x3, 0x559, 0x6, 0x7fff, 0x7, 0x6, 0x32, 0x8}}) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:00 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff0200"/49], 0xfdef) 15:00:00 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:00 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) 15:00:00 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1869.143485] ubi0: attaching mtd0 [ 1869.162054] ubi0: scanning is finished 15:00:00 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:00 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:00 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:01 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1869.333069] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1869.342396] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1869.363744] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1869.390984] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1869.411090] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1869.423574] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 15:00:01 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1869.438681] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1869.465167] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 15:00:01 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1869.489283] ubi0: background thread "ubi_bgt0d" started, PID 3499 [ 1869.495771] ubi0: detaching mtd0 [ 1869.508008] ubi0: mtd0 is detached [ 1869.515800] ubi0: attaching mtd0 [ 1869.533622] ubi0: scanning is finished 15:00:01 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, 0x0, 0x0, 0x0) [ 1869.683183] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1869.693647] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1869.703595] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1869.713250] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1869.724073] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1869.732907] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1869.742435] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1869.753850] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1869.765406] ubi0: background thread "ubi_bgt0d" started, PID 3531 [ 1869.771791] ubi0: detaching mtd0 15:00:01 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) socket$unix(0x1, 0x1, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:01 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, 0x0, 0x0, 0x0) [ 1869.781094] ubi0: mtd0 is detached [ 1869.857539] ubi0: attaching mtd0 [ 1869.867951] ubi0: scanning is finished [ 1869.942733] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1869.949938] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1869.956713] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1869.963535] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1869.979128] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 15:00:01 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:01 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000"], 0xfdef) 15:00:01 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1869.987575] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1870.012332] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1870.053340] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1870.064370] ubi0: background thread "ubi_bgt0d" started, PID 3552 [ 1870.073041] ubi0: detaching mtd0 [ 1870.082515] ubi0: mtd0 is detached 15:00:03 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:03 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, 0x0, 0x0, 0x0) 15:00:03 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:03 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9, 0x0, 0x4}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x400}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:03 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000140)=0x8) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:03 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:03 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1872.274461] ubi0: attaching mtd0 [ 1872.280926] ubi0: scanning is finished 15:00:04 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1872.405522] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1872.412851] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1872.421453] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1872.428048] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1872.436244] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1872.442957] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1872.460062] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1872.469542] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1872.480035] ubi0: background thread "ubi_bgt0d" started, PID 3607 [ 1872.486405] ubi0: detaching mtd0 [ 1872.496218] ubi0: mtd0 is detached [ 1872.505879] ubi0: attaching mtd0 15:00:04 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:04 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1872.523438] ubi0: scanning is finished 15:00:04 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1872.653102] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1872.664264] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1872.672691] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1872.680536] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1872.687806] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1872.696134] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1872.712434] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1872.722597] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1872.733213] ubi0: background thread "ubi_bgt0d" started, PID 3625 [ 1872.733330] ubi0: detaching mtd0 [ 1872.746433] ubi0: mtd0 is detached [ 1872.754262] ubi0: attaching mtd0 15:00:04 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa, 0x0, 0x0, 0x800}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1872.767018] ubi0: scanning is finished [ 1872.867393] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1872.874994] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1872.882443] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1872.889456] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1872.897398] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1872.910969] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1872.919255] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1872.929422] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1872.939593] ubi0: background thread "ubi_bgt0d" started, PID 3640 [ 1872.946268] ubi0: detaching mtd0 [ 1872.961259] ubi0: mtd0 is detached [ 1872.967455] ubi0: attaching mtd0 [ 1872.980498] ubi0: scanning is finished [ 1873.071158] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1873.083546] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1873.091064] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1873.097373] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1873.111987] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1873.123100] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1873.131388] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1873.149367] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1873.161125] ubi0: background thread "ubi_bgt0d" started, PID 3651 [ 1873.170836] ubi0: detaching mtd0 [ 1873.179981] ubi0: mtd0 is detached 15:00:06 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:06 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) 15:00:06 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r4) 15:00:06 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:06 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x9}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1875.344968] ubi0: attaching mtd0 [ 1875.361604] ubi0: scanning is finished [ 1875.438072] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1875.445351] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1875.452904] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1875.460467] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1875.467360] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1875.474113] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1875.482039] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1875.491807] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1875.501934] ubi0: background thread "ubi_bgt0d" started, PID 3678 [ 1875.508521] ubi0: detaching mtd0 [ 1875.516995] ubi0: mtd0 is detached [ 1875.524708] ubi0: attaching mtd0 [ 1875.534705] ubi0: scanning is finished 15:00:07 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) 15:00:07 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1875.607198] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1875.614695] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1875.622012] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1875.629198] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1875.647049] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1875.654697] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1875.662743] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1875.673146] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1875.687631] ubi0: background thread "ubi_bgt0d" started, PID 3688 [ 1875.697793] ubi: mtd0 is already attached to ubi0 15:00:07 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0xfffffffffffffffe}, 0x20c2, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1875.704867] ubi0: detaching mtd0 [ 1875.716132] ubi0: mtd0 is detached [ 1875.725356] ubi0: attaching mtd0 [ 1875.746103] ubi0: scanning is finished [ 1875.869261] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1875.876593] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1875.885023] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1875.892743] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1875.900784] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1875.907179] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1875.915186] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1875.925011] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1875.934922] ubi0: background thread "ubi_bgt0d" started, PID 3704 [ 1875.941373] ubi0: detaching mtd0 [ 1875.948862] ubi0: mtd0 is detached [ 1875.958821] ubi0: attaching mtd0 15:00:07 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) 15:00:07 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) write$tun(r0, &(0x7f0000000040)={@void, @val={0x0, 0x80, 0x1, 0x3, 0x8, 0x7}, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@mpls_mc={0x8848, {[{0x81}], @generic="6c548104b5a027dced3a5affefa029ce5323bc0498d077457b8d90ddb484651c3693"}}}}}, 0x3e) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0xc) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1875.974010] ubi0: scanning is finished [ 1876.074555] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1876.093406] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 15:00:07 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1876.119411] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1876.125659] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1876.139809] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1876.156419] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1876.176554] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1876.197512] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1876.213324] ubi0: background thread "ubi_bgt0d" started, PID 3716 [ 1876.223084] ubi0: detaching mtd0 [ 1876.231039] ubi0: mtd0 is detached 15:00:07 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000040)) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:09 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:09 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) 15:00:09 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:09 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) tee(r2, r3, 0x0, 0x2) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xe}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, r5, 0x3) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:09 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:10 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:10 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:10 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) 15:00:10 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:10 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:10 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000100)={0x0, 0xfffffffffffffd7d, &(0x7f00000000c0)={&(0x7f0000000040)={0x30, r4, 0x531, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1, 0x1}}}}, 0x30}}, 0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r4, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", "", ""]}, 0x28}}, 0x880) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:10 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:10 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) [ 1878.759623] ubi0: attaching mtd0 [ 1878.776472] ubi0: scanning is finished [ 1878.910377] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1878.917259] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1878.933892] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1878.942601] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1878.950769] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 15:00:10 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1878.957109] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1878.965687] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1878.976221] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1878.986013] ubi0: background thread "ubi_bgt0d" started, PID 3788 [ 1878.986083] ubi0: detaching mtd0 [ 1879.003378] ubi0: mtd0 is detached 15:00:10 executing program 2: ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000)='batadv\x00') sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="010300000000000000000c000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$BATADV_CMD_SET_VLAN(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r5, 0x100, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x4000000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$6lowpan_enable(r1, &(0x7f0000000040)='0', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r6, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x3ff, 0x20000000000}, 0x0, 0x0, 0x0, 0x4, 0x2, 0xfffffffe}, 0x0, 0x3, 0xffffffffffffffff, 0x3) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r7, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:10 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) tee(r2, r3, 0x0, 0x2) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xe}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, r5, 0x3) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:10 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:10 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:13 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:13 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x101002, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x1002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046205, &(0x7f0000000180)=0x101) ioctl$int_out(r3, 0x5466, &(0x7f0000000140)) 15:00:13 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x4, 0x5d7, 0x6086}, 0xc) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:13 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:13 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:13 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:13 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x4, 0x5d7, 0x6086}, 0xc) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1881.765288] ubi0: attaching mtd0 15:00:13 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1881.820391] ubi0: scanning is finished [ 1881.839794] ptrace attach of "/root/syz-executor.5"[3832] was attempted by "/root/syz-executor.5"[3836] 15:00:13 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1881.937184] ptrace attach of "/root/syz-executor.5"[3844] was attempted by "/root/syz-executor.5"[3845] [ 1881.987615] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1882.001230] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1882.010465] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1882.010650] ptrace attach of "/root/syz-executor.5"[3850] was attempted by "/root/syz-executor.5"[3852] 15:00:13 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1882.040280] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1882.047687] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1882.067490] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1882.083417] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1882.094914] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1882.107102] ubi0: background thread "ubi_bgt0d" started, PID 3849 [ 1882.114918] ubi0: detaching mtd0 [ 1882.122940] ubi0: mtd0 is detached [ 1882.136554] ubi0: attaching mtd0 15:00:13 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x4, 0x5d7, 0x6086}, 0xc) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1882.154724] ubi0: scanning is finished [ 1882.254831] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1882.263088] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1882.270509] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1882.277301] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1882.285385] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1882.292322] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1882.300412] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1882.310449] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1882.320483] ubi0: background thread "ubi_bgt0d" started, PID 3869 [ 1882.326861] ubi0: detaching mtd0 [ 1882.343455] ubi0: mtd0 is detached [ 1882.347392] ubi0: attaching mtd0 15:00:14 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r2}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r2, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(0xffffffffffffffff, 0x84, 0x78, &(0x7f00000001c0)=r2, 0x4) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') r4 = getgid() write$FUSE_DIRENTPLUS(r3, &(0x7f0000000080)=ANY=[@ANYRESOCT=r4], 0x17) getresgid(&(0x7f0000000040), &(0x7f0000000140)=0x0, &(0x7f0000000180)) setregid(r4, r5) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r6, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:14 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1882.364712] ubi0: scanning is finished [ 1882.451712] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1882.459833] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1882.480983] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1882.500228] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1882.509135] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1882.525751] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1882.533933] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 15:00:14 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1882.545597] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1882.556138] ubi0: detaching mtd0 [ 1882.556259] ubi0: background thread "ubi_bgt0d" started, PID 3880 [ 1882.582225] ubi0: mtd0 is detached [ 1882.614751] ubi0: attaching mtd0 [ 1882.627309] ubi0: scanning is finished 15:00:14 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1882.754271] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1882.766474] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1882.780319] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1882.786933] ubi0: VID header offset: 64 (aligned 64), data offset: 128 15:00:14 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1882.799135] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1882.806568] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1882.815298] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1882.825651] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1882.836687] ubi0: background thread "ubi_bgt0d" started, PID 3902 [ 1882.843248] ubi0: detaching mtd0 15:00:14 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1882.867143] ubi0: mtd0 is detached [ 1882.875381] ubi0: attaching mtd0 [ 1882.914007] ubi0: scanning is finished [ 1883.034710] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1883.043093] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1883.051953] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1883.059458] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1883.066313] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1883.074160] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1883.082536] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1883.092927] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1883.103448] ubi0: background thread "ubi_bgt0d" started, PID 3920 [ 1883.103518] ubi0: detaching mtd0 [ 1883.115823] ubi0: mtd0 is detached [ 1883.124190] ubi0: attaching mtd0 [ 1883.140389] ubi0: scanning is finished [ 1883.224336] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1883.232120] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1883.239572] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1883.246052] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1883.253930] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1883.261343] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1883.269421] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1883.279450] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1883.289189] ubi0: background thread "ubi_bgt0d" started, PID 3927 [ 1883.295582] ubi0: detaching mtd0 [ 1883.301730] ubi0: mtd0 is detached 15:00:16 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:16 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:16 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:16 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0xa}) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000140)=""/86, 0x56}, {&(0x7f00000001c0)=""/77, 0x4d}, {&(0x7f0000000240)=""/106, 0x6a}], 0x3) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) fcntl$setstatus(r4, 0x4, 0x40800) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) [ 1884.825759] ubi0: attaching mtd0 [ 1884.840145] ubi0: scanning is finished [ 1884.915700] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1884.923001] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1884.932178] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1884.942895] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1884.951708] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1884.962332] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1884.970684] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1884.980710] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1884.990694] ubi0: background thread "ubi_bgt0d" started, PID 3952 15:00:16 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:16 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:16 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r3}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r3, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000140)={r3, @in6={{0xa, 0x4e24, 0x7, @mcast1, 0x5d3}}, 0x5, 0x8}, &(0x7f0000000040)=0x90) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:16 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040)=0x8, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:16 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1885.154021] ubi0: detaching mtd0 [ 1885.165159] ubi0: mtd0 is detached [ 1885.174822] ubi0: attaching mtd0 [ 1885.207332] ubi0: scanning is finished 15:00:16 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1885.437689] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1885.456321] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1885.465236] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1885.479719] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1885.486934] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1885.517479] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1885.527523] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1885.537073] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1885.546965] ubi0: background thread "ubi_bgt0d" started, PID 3982 [ 1885.553631] ubi0: detaching mtd0 [ 1885.572542] ubi0: mtd0 is detached [ 1885.580761] ubi0: attaching mtd0 [ 1885.603546] ubi0: scanning is finished [ 1885.764937] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1885.775930] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1885.793154] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1885.815395] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1885.840462] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1885.853385] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1885.870695] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1885.901032] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1885.927652] ubi0: detaching mtd0 [ 1885.931183] ubi0: background thread "ubi_bgt0d" started, PID 3989 [ 1885.953975] ubi0: mtd0 is detached 15:00:17 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:17 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1886.066647] ubi0: attaching mtd0 [ 1886.082062] ubi0: scanning is finished [ 1886.195013] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1886.213206] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1886.229957] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1886.244254] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1886.258992] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1886.271650] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1886.279215] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1886.289075] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1886.306607] ubi0: background thread "ubi_bgt0d" started, PID 4006 15:00:19 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:19 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:19 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value={r2}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={r2, @in={{0x2, 0x4e24, @remote}}, [0x2, 0x0, 0x5, 0x10001, 0x6, 0x9, 0x9, 0x200, 0x100000000, 0x5, 0x101]}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000040)={0x3, 0x5, 0x208, 0xffffffff, 0x8, 0x1, 0xb71, 0xffff, r2}, 0x20) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c85, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x100, 0x5}, 0x40000, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:19 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1887.826730] ubi0: detaching mtd0 [ 1887.835823] ubi0: mtd0 is detached 15:00:19 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:19 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:19 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0x0, 0x410400) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nvme-fabrics\x00', 0x280040, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f0000000180)) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 15:00:19 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:19 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x7}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:19 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) fremovexattr(r1, &(0x7f00000000c0)=@known='trusted.syz\x00') setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1888.165607] ubi0: attaching mtd0 [ 1888.176859] ubi0: scanning is finished 15:00:19 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) fremovexattr(r1, &(0x7f00000000c0)=@known='trusted.syz\x00') setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 15:00:19 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) fremovexattr(r1, &(0x7f00000000c0)=@known='trusted.syz\x00') setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1888.286240] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1888.294326] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1888.302280] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1888.308946] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1888.317422] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1888.332972] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1888.341003] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1888.353954] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1888.365075] ubi0: detaching mtd0 [ 1888.365288] ubi0: background thread "ubi_bgt0d" started, PID 4057 [ 1888.382524] ubi0: mtd0 is detached [ 1888.397281] ubi0: attaching mtd0 [ 1888.401727] ubi0: scanning is finished [ 1888.462765] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1888.469721] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1888.476209] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1888.484223] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1888.491363] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1888.497745] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1888.505010] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1888.515364] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1888.524924] ubi0: background thread "ubi_bgt0d" started, PID 4068 [ 1888.527941] ubi: mtd0 is already attached to ubi0 [ 1888.536075] ubi0: detaching mtd0 [ 1888.554844] ubi0: mtd0 is detached 15:00:22 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:22 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:22 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffbffffff, 0xffffffffffffffff, 0xa) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000180)={0xa, 0x4, 0xfa00, {r3}}, 0xc) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:22 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = getpid() setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x440000, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, &(0x7f0000000180)={0x4, 0x80ad, 0x6, @empty, 'lo\x00'}) sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, r2, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) sysfs$2(0x2, 0x3, &(0x7f0000000240)=""/172) madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x10) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f00000001c0)={0xfffffff8, "ea820bed4667ab3383aa6b251daf1696ad92d0839e4627ad2f39574ad37af0fd", 0x4, 0x1, 0x5, 0x7, 0x4, 0x2, 0x6, 0xc8db}) [ 1890.915365] ubi0: attaching mtd0 [ 1890.920548] ubi0: scanning is finished [ 1890.962436] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1890.972169] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1890.979652] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1890.990745] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1891.003584] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1891.010178] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1891.019542] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1891.031974] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1891.041946] ubi0: background thread "ubi_bgt0d" started, PID 4096 15:00:22 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:22 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:22 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) unshare(0x10000) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:22 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:22 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = getpid() setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x440000, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, &(0x7f0000000180)={0x4, 0x80ad, 0x6, @empty, 'lo\x00'}) sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, r2, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) sysfs$2(0x2, 0x3, &(0x7f0000000240)=""/172) madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x10) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f00000001c0)={0xfffffff8, "ea820bed4667ab3383aa6b251daf1696ad92d0839e4627ad2f39574ad37af0fd", 0x4, 0x1, 0x5, 0x7, 0x4, 0x2, 0x6, 0xc8db}) [ 1891.172186] ubi0: detaching mtd0 [ 1891.185945] ubi0: mtd0 is detached 15:00:22 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = getpid() setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x440000, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, &(0x7f0000000180)={0x4, 0x80ad, 0x6, @empty, 'lo\x00'}) sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, r2, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) sysfs$2(0x2, 0x3, &(0x7f0000000240)=""/172) madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x10) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r4, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f00000001c0)={0xfffffff8, "ea820bed4667ab3383aa6b251daf1696ad92d0839e4627ad2f39574ad37af0fd", 0x4, 0x1, 0x5, 0x7, 0x4, 0x2, 0x6, 0xc8db}) 15:00:22 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:22 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:25 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:25 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:25 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x7}}) [ 1893.927094] ubi0: attaching mtd0 [ 1893.942216] ubi0: scanning is finished [ 1894.054948] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1894.062238] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1894.072843] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1894.080019] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1894.090406] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1894.096477] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1894.104993] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1894.118314] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1894.128208] ubi0: background thread "ubi_bgt0d" started, PID 4157 [ 1894.134497] ubi0: detaching mtd0 [ 1894.145315] ubi0: mtd0 is detached 15:00:25 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:25 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:25 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:25 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$l2tp(0x2, 0x2, 0x73) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x4c0800, 0x0) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000180)) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000480)=ANY=[@ANYBLOB="000000000000000002004e23ac1414bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002004e24ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e2200000000000000000000000000000000000000000000000064f840d885c58cd568d7e276160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14143300"/797], 0x310) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PPPIOCGIDLE(r4, 0x8010743f, &(0x7f0000000040)) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000024000b0f000000000000000060000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100c1ffffff001000f0"], 0x58}}, 0x0) bind$can_raw(r2, &(0x7f00000001c0), 0x10) [ 1894.153438] ubi0: attaching mtd0 [ 1894.174699] ubi0: scanning is finished 15:00:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1894.322848] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1894.338545] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1894.345400] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1894.353324] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1894.361333] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 15:00:26 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1894.368928] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1894.377438] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1894.387566] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1894.398991] ubi0: background thread "ubi_bgt0d" started, PID 4183 15:00:26 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x7}}) 15:00:26 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1894.424119] ubi: mtd0 is already attached to ubi0 [ 1894.430613] ubi0: detaching mtd0 [ 1894.442320] ubi0: mtd0 is detached 15:00:26 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:26 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x7}}) [ 1894.541796] ubi0: attaching mtd0 [ 1894.566063] ubi0: scanning is finished [ 1894.670017] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1894.682279] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1894.689729] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1894.711778] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1894.744043] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1894.751139] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1894.761915] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1894.776144] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1894.787238] ubi0: background thread "ubi_bgt0d" started, PID 4213 [ 1894.793867] ubi0: detaching mtd0 [ 1894.819911] ubi0: mtd0 is detached [ 1894.824346] ubi0: attaching mtd0 [ 1894.849581] ubi0: scanning is finished [ 1894.924614] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1894.932094] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1894.940195] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1894.947210] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1894.953977] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1894.961905] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1894.970076] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1894.980526] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1894.990547] ubi0: background thread "ubi_bgt0d" started, PID 4223 15:00:28 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:28 executing program 1: ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:28 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x7}}) 15:00:28 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:28 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x800e, 0x20000000000000, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:28 executing program 1: ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1897.235915] ubi0: detaching mtd0 [ 1897.255738] ubi0: mtd0 is detached [ 1897.276338] ubi0: attaching mtd0 [ 1897.299656] ubi0: scanning is finished [ 1897.382469] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1897.390641] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1897.398658] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1897.405148] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1897.414142] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1897.421443] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 15:00:29 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:29 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x800e, 0x20000000000000, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1897.438029] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1897.448556] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1897.460178] ubi0: background thread "ubi_bgt0d" started, PID 4259 [ 1897.467661] ubi: mtd0 is already attached to ubi0 [ 1897.473192] ubi: mtd0 is already attached to ubi0 15:00:29 executing program 1: ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:29 executing program 4: ioperm(0x0, 0x100000000, 0x3) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x2202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000140)="6e7f3169b3f4f2c1fdebd5fff375097192dd8d6a128d158b4e8f7e0bdddfa28bf40ea5e38b376b3e792f4a547f802b7916ab997b48b0aa65da00694895b88ba36ac556f0b76df10a3006b74e947412757527d08b7a320e2f010b4b5b7961605afa5b8c66d5f1f1a4983a81f6be57648ece5a02ae28a69dea3bf56a2dc7604964d284a5d610f6389bd7485f7b9630c8d967fc806c0fa70df715749a2553c751545d0ec248ffb815454af7565fba39752fb826ec448ec263837f0a454a6c7d06957c01695810a742fe024ea761b191cc0f8cefe87bbfc2ec976829a607a2f6329972ea67c0dc168646e7574fc87098656fd355b471ae34e37e8a54bfde5ce89355") setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1897.514649] ubi0: detaching mtd0 [ 1897.529241] ubi0: mtd0 is detached 15:00:29 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:29 executing program 2: ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1897.634081] ubi0: attaching mtd0 [ 1897.645664] ubi0: scanning is finished [ 1897.738640] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1897.745645] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1897.753967] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1897.769196] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1897.780905] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1897.792236] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1897.806878] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1897.817143] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1897.828645] ubi0: background thread "ubi_bgt0d" started, PID 4283 [ 1899.818191] NOHZ: local_softirq_pending 08 [ 1899.822513] NOHZ: local_softirq_pending 08 15:00:31 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:31 executing program 4: ioperm(0x0, 0x100000000, 0x3) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x2202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000140)="6e7f3169b3f4f2c1fdebd5fff375097192dd8d6a128d158b4e8f7e0bdddfa28bf40ea5e38b376b3e792f4a547f802b7916ab997b48b0aa65da00694895b88ba36ac556f0b76df10a3006b74e947412757527d08b7a320e2f010b4b5b7961605afa5b8c66d5f1f1a4983a81f6be57648ece5a02ae28a69dea3bf56a2dc7604964d284a5d610f6389bd7485f7b9630c8d967fc806c0fa70df715749a2553c751545d0ec248ffb815454af7565fba39752fb826ec448ec263837f0a454a6c7d06957c01695810a742fe024ea761b191cc0f8cefe87bbfc2ec976829a607a2f6329972ea67c0dc168646e7574fc87098656fd355b471ae34e37e8a54bfde5ce89355") setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) 15:00:31 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:31 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:31 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:31 executing program 4: ioperm(0x0, 0x100000000, 0x3) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x2202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x9) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000140)="6e7f3169b3f4f2c1fdebd5fff375097192dd8d6a128d158b4e8f7e0bdddfa28bf40ea5e38b376b3e792f4a547f802b7916ab997b48b0aa65da00694895b88ba36ac556f0b76df10a3006b74e947412757527d08b7a320e2f010b4b5b7961605afa5b8c66d5f1f1a4983a81f6be57648ece5a02ae28a69dea3bf56a2dc7604964d284a5d610f6389bd7485f7b9630c8d967fc806c0fa70df715749a2553c751545d0ec248ffb815454af7565fba39752fb826ec448ec263837f0a454a6c7d06957c01695810a742fe024ea761b191cc0f8cefe87bbfc2ec976829a607a2f6329972ea67c0dc168646e7574fc87098656fd355b471ae34e37e8a54bfde5ce89355") setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, 0x0, 0x0) [ 1900.291432] ubi: mtd0 is already attached to ubi0 [ 1900.306057] ubi: mtd0 is already attached to ubi0 [ 1900.364793] ubi: mtd0 is already attached to ubi0 15:00:32 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:32 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:32 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) 15:00:32 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:32 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1900.520851] ubi: mtd0 is already attached to ubi0 15:00:34 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:34 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:34 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:34 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:34 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:34 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:34 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1903.359774] ubi: mtd0 is already attached to ubi0 15:00:35 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:35 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:35 executing program 1: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1903.442453] ubi0: detaching mtd0 [ 1903.459903] ubi0: mtd0 is detached [ 1903.470532] ubi0: attaching mtd0 [ 1903.486791] ip_tables: iptables: counters copy to user failed while replacing table [ 1903.497244] ubi0: scanning is finished [ 1903.541709] ip_tables: iptables: counters copy to user failed while replacing table 15:00:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) [ 1903.659939] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1903.678982] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1903.721229] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1903.739215] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1903.752584] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1903.764427] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1903.774246] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1903.805375] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1903.816615] ubi0: background thread "ubi_bgt0d" started, PID 4380 [ 1903.823051] ubi: mtd0 is already attached to ubi0 15:00:35 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1903.905350] ubi0: detaching mtd0 [ 1903.918403] ubi0: mtd0 is detached [ 1903.933349] ip_tables: iptables: counters copy to user failed while replacing table 15:00:37 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:37 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x1bd, 0x47]) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockname$unix(r0, &(0x7f0000000140), &(0x7f00000000c0)=0x6e) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0xfffd, 0xdba}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, 0x0, 0x0) 15:00:37 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:37 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:37 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:38 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1906.379653] ubi0: attaching mtd0 [ 1906.391322] ubi0: scanning is finished [ 1906.462548] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1906.469712] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1906.478412] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1906.485028] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1906.493416] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1906.501018] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1906.512148] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1906.512238] ip_tables: iptables: counters copy to user failed while replacing table [ 1906.525156] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1906.545540] ubi0: background thread "ubi_bgt0d" started, PID 4424 [ 1906.553124] ubi0: detaching mtd0 15:00:38 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1906.571991] ubi0: mtd0 is detached [ 1906.586961] ubi0: attaching mtd0 [ 1906.606030] ubi0: scanning is finished [ 1906.677846] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1906.684641] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1906.698879] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1906.712203] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1906.721854] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1906.729028] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1906.737334] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1906.747179] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1906.757069] ubi0: background thread "ubi_bgt0d" started, PID 4434 [ 1906.757092] ubi: mtd0 is already attached to ubi0 [ 1906.770225] ubi0: detaching mtd0 15:00:38 executing program 2: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:38 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) [ 1906.781394] ubi0: mtd0 is detached [ 1906.790183] ubi0: attaching mtd0 [ 1906.795256] ubi0: scanning is finished 15:00:38 executing program 2: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1906.902765] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1906.929629] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 15:00:38 executing program 2: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1906.949898] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1906.963663] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1906.971053] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1906.982802] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1906.992666] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1907.010043] ip_tables: iptables: counters copy to user failed while replacing table [ 1907.025734] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 15:00:38 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1907.069403] ubi0: background thread "ubi_bgt0d" started, PID 4449 [ 1907.076367] ubi0: detaching mtd0 [ 1907.094555] ubi0: mtd0 is detached [ 1907.119368] ubi0: attaching mtd0 [ 1907.135948] ubi0: scanning is finished [ 1907.224353] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1907.235834] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1907.246086] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1907.252680] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1907.261729] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1907.269539] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1907.278115] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1907.288552] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1907.298709] ubi0: background thread "ubi_bgt0d" started, PID 4475 [ 1907.305126] ubi: mtd0 is already attached to ubi0 [ 1907.315036] ubi0: detaching mtd0 [ 1907.323539] ubi0: mtd0 is detached [ 1907.345186] ubi0: attaching mtd0 [ 1907.349805] ubi0: scanning is finished [ 1907.403792] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1907.410756] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1907.419089] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1907.425327] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1907.434640] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1907.448562] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1907.455950] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1907.474829] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1907.484267] ubi0: background thread "ubi_bgt0d" started, PID 4482 15:00:41 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:41 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, 0x0, 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:41 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000480)={0xa, 0x4, 0xfa00, {r4}}, 0xc) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x800, @local, 0x8}, r4}}, 0x30) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xa}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x3, 0x5}}) 15:00:41 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) 15:00:41 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:41 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:41 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) [ 1909.423792] ubi0: detaching mtd0 [ 1909.438283] ubi0: mtd0 is detached [ 1909.450449] ubi0: attaching mtd0 [ 1909.469748] ubi0: scanning is finished [ 1909.511781] ip_tables: iptables: counters copy to user failed while replacing table [ 1909.612385] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1909.623642] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1909.647346] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1909.665408] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1909.667767] ip_tables: iptables: counters copy to user failed while replacing table [ 1909.683151] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1909.693157] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1909.701584] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1909.717488] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1909.728085] ubi0: background thread "ubi_bgt0d" started, PID 4518 [ 1909.735069] ubi: mtd0 is already attached to ubi0 [ 1909.741709] ubi0: detaching mtd0 [ 1909.753751] ubi0: mtd0 is detached 15:00:41 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:41 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1909.767999] ubi0: attaching mtd0 [ 1909.782801] ubi0: scanning is finished [ 1909.932141] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1909.941620] ip_tables: iptables: counters copy to user failed while replacing table [ 1909.948492] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1909.968281] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1909.979530] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1909.987000] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1909.995006] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1910.004403] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1910.015855] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1910.026303] ubi0: background thread "ubi_bgt0d" started, PID 4532 15:00:41 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1910.032911] ubi0: detaching mtd0 [ 1910.050412] ubi0: mtd0 is detached [ 1910.073055] ubi0: attaching mtd0 [ 1910.078696] ubi0: scanning is finished 15:00:41 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) [ 1910.182364] ip_tables: iptables: counters copy to user failed while replacing table [ 1910.191364] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1910.199603] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1910.210451] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1910.214197] ip_tables: iptables: counters copy to user failed while replacing table [ 1910.218148] ubi0: VID header offset: 64 (aligned 64), data offset: 128 15:00:41 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, 0x0, 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1910.234833] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1910.253512] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1910.294487] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1910.318434] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1910.343157] ubi0: background thread "ubi_bgt0d" started, PID 4546 [ 1910.351432] ubi0: detaching mtd0 [ 1910.373257] ubi0: mtd0 is detached 15:00:44 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:44 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:44 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f00000000c0)={0xa}) 15:00:44 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:44 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, 0x0, 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:44 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x33) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 1912.459607] ubi0: attaching mtd0 [ 1912.490555] ubi0: scanning is finished 15:00:44 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x33) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 1912.521222] ip_tables: iptables: counters copy to user failed while replacing table [ 1912.553411] ip_tables: iptables: counters copy to user failed while replacing table 15:00:44 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x33) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 15:00:44 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1912.704621] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1912.723553] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1912.737249] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1912.744420] ubi0: VID header offset: 64 (aligned 64), data offset: 128 15:00:44 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1912.766671] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1912.780905] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1912.796721] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 15:00:44 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1912.818053] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1912.844096] ubi0: background thread "ubi_bgt0d" started, PID 4600 [ 1912.851723] ubi0: detaching mtd0 15:00:44 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1912.876314] ubi0: mtd0 is detached [ 1912.885906] ubi0: attaching mtd0 [ 1912.890297] ubi0: scanning is finished [ 1912.990095] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1912.997179] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1913.006092] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1913.020595] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1913.028138] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1913.034553] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1913.043110] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1913.053107] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1913.062833] ubi0: background thread "ubi_bgt0d" started, PID 4617 [ 1913.069784] ubi0: detaching mtd0 [ 1913.078545] ubi0: mtd0 is detached [ 1913.079490] ip_tables: iptables: counters copy to user failed while replacing table 15:00:47 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:47 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) 15:00:47 executing program 0: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:47 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:47 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:47 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1915.496877] ubi0: attaching mtd0 [ 1915.504735] ip_tables: iptables: counters copy to user failed while replacing table [ 1915.521743] ubi0: scanning is finished [ 1915.527226] ptrace attach of "/root/syz-executor.0"[4640] was attempted by "/root/syz-executor.0"[4645] 15:00:47 executing program 0: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1915.565935] ip_tables: iptables: counters copy to user failed while replacing table 15:00:47 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:47 executing program 0: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1915.665334] ptrace attach of "/root/syz-executor.0"[4655] was attempted by "/root/syz-executor.0"[4657] [ 1915.699267] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1915.727810] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1915.729066] ip_tables: iptables: counters copy to user failed while replacing table [ 1915.757236] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 15:00:47 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1915.773578] ptrace attach of "/root/syz-executor.0"[4665] was attempted by "/root/syz-executor.0"[4667] [ 1915.773701] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1915.801189] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1915.809344] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 15:00:47 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1915.823128] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1915.833463] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1915.848144] ubi0: background thread "ubi_bgt0d" started, PID 4661 [ 1915.848192] ubi0: detaching mtd0 [ 1915.867446] ubi0: mtd0 is detached 15:00:47 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1915.914141] ubi0: attaching mtd0 [ 1915.920212] ubi0: scanning is finished [ 1916.003730] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1916.022415] ip_tables: iptables: counters copy to user failed while replacing table [ 1916.033494] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1916.041680] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1916.049122] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1916.056717] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1916.063076] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1916.074468] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1916.088265] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1916.097758] ubi0: background thread "ubi_bgt0d" started, PID 4685 [ 1916.097768] ubi0: detaching mtd0 [ 1916.113812] ubi0: mtd0 is detached 15:00:50 executing program 5: socket$inet6(0xa, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:50 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:50 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:50 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:50 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:50 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1918.540158] ubi0: attaching mtd0 [ 1918.562147] ubi0: scanning is finished 15:00:50 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xdb, &(0x7f0000000140)="c4fe910c6786cec96ddb5322b89152563fadcd891969b71832cb470c94d61f3514dca76fd1664d2013712c225da4a455f4c9fd98a5680956f1291607e39a209852cea9c3f5ec31a933137a89acd693be5df4e7a840effc012904b9ce36371060422e2cc232d5863cad44f8be41bcd8922896ba19b709aa38f427f642337a05000000000000008058f48b81186d77e74aaf54860411ac969951663853572ea4f368c4edd62e428e672fb1fa1c199d965ca69bcc91a6481d9bff6e2146492dc5995fde02b9197039be8be4594a48eb7620c5ab0fb3c665214f2c8602"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1918.594303] ip_tables: iptables: counters copy to user failed while replacing table 15:00:50 executing program 5: socket$inet6(0xa, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1918.687738] ip_tables: iptables: counters copy to user failed while replacing table [ 1918.703198] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1918.715715] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 15:00:50 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, 0x0, 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1918.750769] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1918.788817] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1918.818304] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1918.828466] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1918.837677] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1918.849279] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1918.860224] ubi0: background thread "ubi_bgt0d" started, PID 4729 15:00:50 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:50 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1918.867531] ubi: mtd0 is already attached to ubi0 [ 1918.872612] ubi0: detaching mtd0 [ 1918.890954] ubi0: mtd0 is detached [ 1918.898360] ubi0: attaching mtd0 [ 1918.950499] ubi0: scanning is finished [ 1919.035805] ip_tables: iptables: counters copy to user failed while replacing table [ 1919.098479] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1919.108287] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1919.115797] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1919.122143] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1919.129406] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1919.136823] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 15:00:50 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) dup(0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:50 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1919.144149] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1919.154162] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1919.164846] ubi0: background thread "ubi_bgt0d" started, PID 4757 [ 1919.171222] ubi0: detaching mtd0 [ 1919.181988] ubi0: mtd0 is detached [ 1919.186405] ubi0: attaching mtd0 [ 1919.190854] ubi0: scanning is finished [ 1919.316307] ip_tables: iptables: counters copy to user failed while replacing table [ 1919.338542] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1919.353297] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 15:00:51 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1919.363586] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1919.371510] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1919.379643] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1919.383121] ip_tables: iptables: counters copy to user failed while replacing table [ 1919.388130] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1919.426057] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1919.440211] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1919.452576] ubi0: background thread "ubi_bgt0d" started, PID 4770 [ 1919.452632] ubi0: detaching mtd0 15:00:51 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:51 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1919.476009] ubi0: mtd0 is detached [ 1919.484341] ubi0: attaching mtd0 [ 1919.528165] ubi0: scanning is finished [ 1919.622941] ip_tables: iptables: counters copy to user failed while replacing table [ 1919.691002] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1919.698508] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1919.710656] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1919.717742] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1919.728833] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1919.736084] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1919.743425] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1919.754573] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1919.764113] ubi0: background thread "ubi_bgt0d" started, PID 4795 [ 1919.764219] ubi0: detaching mtd0 [ 1919.785055] ubi0: mtd0 is detached 15:00:51 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:51 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0xf6) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1919.790325] ubi0: attaching mtd0 [ 1919.805262] ubi0: scanning is finished [ 1919.916935] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1919.947539] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1919.954172] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1919.966655] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1919.977517] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1919.983600] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1919.992201] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1920.002305] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 15:00:51 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1920.012361] ubi0: background thread "ubi_bgt0d" started, PID 4808 [ 1920.019324] ubi0: detaching mtd0 [ 1920.024262] ubi0: mtd0 is detached [ 1920.093047] ubi0: attaching mtd0 [ 1920.106189] ubi0: scanning is finished [ 1920.215459] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1920.236551] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1920.244803] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1920.251896] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1920.259074] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1920.267470] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1920.276186] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1920.286846] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1920.297505] ubi0: background thread "ubi_bgt0d" started, PID 4822 15:00:53 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1921.684155] ubi0: detaching mtd0 [ 1921.689732] ubi0: mtd0 is detached 15:00:53 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, 0x0, 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:53 executing program 5: socket$inet6(0xa, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:53 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:53 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:00:53 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:53 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1921.856318] ubi0: attaching mtd0 [ 1921.879807] ubi0: scanning is finished 15:00:53 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, 0x0, 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1921.918511] net_ratelimit: 3 callbacks suppressed [ 1921.918535] ip_tables: iptables: counters copy to user failed while replacing table [ 1922.040890] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1922.048885] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1922.057267] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1922.063571] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1922.071546] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1922.078606] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 15:00:53 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1922.086830] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1922.097069] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1922.107519] ubi0: background thread "ubi_bgt0d" started, PID 4868 [ 1922.107793] ubi0: detaching mtd0 [ 1922.129598] ubi0: mtd0 is detached [ 1922.133283] ubi0: attaching mtd0 15:00:53 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1922.139598] ubi0: scanning is finished [ 1922.193620] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1922.200713] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1922.214111] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1922.227351] ip_tables: iptables: counters copy to user failed while replacing table [ 1922.236037] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1922.259467] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1922.287062] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1922.299024] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 15:00:54 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:54 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1922.309977] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1922.319997] ubi0: background thread "ubi_bgt0d" started, PID 4877 [ 1922.327217] ubi0: detaching mtd0 [ 1922.337392] ubi0: mtd0 is detached 15:00:54 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:54 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1922.452132] ubi0: attaching mtd0 [ 1922.487492] ubi0: scanning is finished [ 1922.519426] ip_tables: iptables: counters copy to user failed while replacing table [ 1922.613106] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1922.621877] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1922.629916] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1922.639590] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1922.647264] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1922.653620] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1922.662132] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1922.672383] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1922.682245] ubi0: background thread "ubi_bgt0d" started, PID 4902 [ 1922.688674] ubi0: detaching mtd0 [ 1922.693934] ubi0: mtd0 is detached 15:00:56 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:56 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:56 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:56 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:56 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1924.861797] ubi0: attaching mtd0 [ 1924.885970] ubi0: scanning is finished 15:00:56 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0), 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:56 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:56 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 1924.997119] ip_tables: iptables: counters copy to user failed while replacing table [ 1925.062808] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1925.079827] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1925.102825] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1925.129905] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1925.145773] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1925.152285] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1925.168406] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1925.181514] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1925.193184] ubi0: background thread "ubi_bgt0d" started, PID 4944 [ 1925.193477] ubi0: detaching mtd0 15:00:56 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1925.229592] ubi0: mtd0 is detached [ 1925.233543] ubi0: attaching mtd0 [ 1925.259321] ubi0: scanning is finished [ 1925.371708] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1925.379091] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1925.387093] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1925.393372] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1925.401927] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1925.409164] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 15:00:57 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) dup(0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:57 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1925.418175] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1925.428724] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1925.439120] ubi0: background thread "ubi_bgt0d" started, PID 4960 [ 1925.444993] ubi0: detaching mtd0 [ 1925.452067] ubi0: mtd0 is detached 15:00:57 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:57 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1925.533118] ip_tables: iptables: counters copy to user failed while replacing table [ 1925.557382] ip_tables: iptables: counters copy to user failed while replacing table 15:00:57 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:57 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:57 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:57 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1925.756937] ubi0: attaching mtd0 [ 1925.782290] ubi0: scanning is finished [ 1925.821938] ip_tables: iptables: counters copy to user failed while replacing table [ 1925.957644] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1925.965236] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1925.972099] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1925.984418] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1925.991234] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1926.000923] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1926.009707] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1926.022125] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1926.032567] ubi0: background thread "ubi_bgt0d" started, PID 4996 [ 1926.032635] ubi0: detaching mtd0 [ 1926.056594] ubi0: mtd0 is detached 15:00:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0), 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:00:59 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:59 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:00:59 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:00:59 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:00:59 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c70000000000"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1927.998708] ip_tables: iptables: counters copy to user failed while replacing table [ 1928.042222] ubi0: attaching mtd0 [ 1928.068336] ubi0: scanning is finished 15:00:59 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1928.259288] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1928.267129] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1928.275390] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1928.282333] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1928.302153] ip_tables: iptables: counters copy to user failed while replacing table [ 1928.306288] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1928.323438] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1928.331496] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1928.347814] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 15:01:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1928.358812] ubi0: background thread "ubi_bgt0d" started, PID 5036 [ 1928.359379] ubi0: detaching mtd0 [ 1928.385310] ubi0: mtd0 is detached [ 1928.413541] ubi0: attaching mtd0 [ 1928.433312] ubi0: scanning is finished [ 1928.519705] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1928.530995] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1928.538689] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1928.548980] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1928.556599] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1928.562777] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1928.576759] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1928.588795] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1928.603103] ubi0: background thread "ubi_bgt0d" started, PID 5048 [ 1928.612682] ubi0: detaching mtd0 [ 1928.621352] ubi0: mtd0 is detached 15:01:00 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1928.628482] ubi0: attaching mtd0 15:01:00 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1928.661325] ubi0: scanning is finished [ 1928.768616] ip_tables: iptables: counters copy to user failed while replacing table [ 1928.797685] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1928.809955] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1928.817629] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1928.824729] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1928.831808] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1928.839106] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1928.847816] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1928.857808] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 15:01:00 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1928.867980] ubi0: detaching mtd0 [ 1928.868533] ubi0: background thread "ubi_bgt0d" started, PID 5064 15:01:00 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c70000000000"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) [ 1928.916463] ubi0: mtd0 is detached 15:01:02 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0), 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:01:02 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1930.995375] ip_tables: iptables: counters copy to user failed while replacing table 15:01:02 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x0, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:01:02 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) 15:01:02 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:01:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c70000000000"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:01:02 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:01:02 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1931.133206] ubi0: attaching mtd0 [ 1931.137749] ip_tables: iptables: counters copy to user failed while replacing table [ 1931.171984] ubi0: scanning is finished 15:01:02 executing program 4: openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:01:02 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1931.271795] ip_tables: iptables: counters copy to user failed while replacing table [ 1931.346291] ip_tables: iptables: counters copy to user failed while replacing table 15:01:03 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 1931.412468] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1931.424211] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1931.430755] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1931.439620] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1931.449531] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 15:01:03 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000000c0)={0x8, 0x5}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x5}}) [ 1931.457023] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1931.465325] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 4091741788 [ 1931.480035] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1931.491484] ubi0: background thread "ubi_bgt0d" started, PID 5126 [ 1931.491561] ubi0: detaching mtd0 15:01:05 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x0, 0x0}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:01:05 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:01:05 executing program 5: socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$unix(0x1, 0x0, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x7, 0x34}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 15:01:05 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88202, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000000060a5c268d7dd3a00c6c7000000000000fc000200000000beff020000"], 0xfdef) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10020, 0x0) 15:01:05 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x9, 0x3, 0x208, 0xb0, 0xb0, 0x0, 0xb0, 0xb0, 0x170, 0x1a8, 0x1a8, 0x170, 0x1a8, 0x3, 0x0, {[{{@ip={@broadcast, @empty}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3b4272585404f97920335dabc5b3abeb5f79f5865c671cba15e125d11e4e"}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30, 'addrtype\x00'}, {0x824}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000030, 0x0) 15:01:05 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x0, 0x0}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:01:05 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x400000000000030, 0x0) [ 2148.106222] INFO: task syz-executor.2:5116 blocked for more than 140 seconds. [ 2148.113545] Not tainted 4.14.180-syzkaller #0 [ 2148.119364] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2148.127415] syz-executor.2 D29904 5116 6373 0x00000004 [ 2148.133038] Call Trace: [ 2148.135664] ? __schedule+0x7b8/0x1ca0 [ 2148.139649] ? __sched_text_start+0x8/0x8 [ 2148.143786] ? __sched_text_start+0x8/0x8 [ 2148.148061] ? trace_hardirqs_on+0x10/0x10 [ 2148.152287] ? check_preemption_disabled+0x35/0x240 [ 2148.157415] schedule+0x8d/0x1b0 [ 2148.160824] schedule_timeout+0x946/0xe40 [ 2148.164949] ? usleep_range+0x130/0x130 [ 2148.169026] ? wait_for_completion+0x239/0x390 [ 2148.173600] ? mark_held_locks+0xa6/0xf0 [ 2148.177729] ? _raw_spin_unlock_irq+0x24/0x80 [ 2148.182214] wait_for_completion+0x241/0x390 [ 2148.186881] ? try_to_wake_up+0x9a/0xef0 [ 2148.190938] ? wait_for_completion_interruptible+0x3e0/0x3e0 [ 2148.196867] ? wake_up_q+0xe0/0xe0 [ 2148.200399] kthread_stop+0xce/0x640 [ 2148.204091] ubi_detach_mtd_dev+0x1e3/0x3cc [ 2148.208501] ctrl_cdev_ioctl+0x14b/0x220 [ 2148.212551] ? vol_cdev_llseek+0x140/0x140 [ 2148.216870] ? selinux_file_ioctl+0x3f7/0x560 [ 2148.221357] ? vol_cdev_llseek+0x140/0x140 [ 2148.225582] do_vfs_ioctl+0x75a/0xfe0 [ 2148.229441] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2148.234187] ? ioctl_preallocate+0x1a0/0x1a0 [ 2148.238694] ? security_file_ioctl+0x76/0xb0 [ 2148.243089] ? security_file_ioctl+0x83/0xb0 [ 2148.248331] SyS_ioctl+0x7f/0xb0 [ 2148.251692] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2148.255641] do_syscall_64+0x1d5/0x640 [ 2148.259736] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2148.264916] RIP: 0033:0x45ca29 [ 2148.268131] RSP: 002b:00007f0f17a1dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2148.275938] RAX: ffffffffffffffda RBX: 00000000004e1080 RCX: 000000000045ca29 [ 2148.283209] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003 [ 2148.290534] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2148.297940] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2148.305188] R13: 0000000000000209 R14: 00000000004c44c1 R15: 00007f0f17a1e6d4 [ 2148.312542] INFO: task syz-executor.1:5132 blocked for more than 140 seconds. [ 2148.319896] Not tainted 4.14.180-syzkaller #0 [ 2148.324889] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2148.332961] syz-executor.1 D29904 5132 6374 0x00000004 [ 2148.338681] Call Trace: [ 2148.341260] ? __schedule+0x7b8/0x1ca0 [ 2148.345123] ? __mutex_lock+0x737/0x1470 [ 2148.349280] ? __sched_text_start+0x8/0x8 [ 2148.353418] ? lock_downgrade+0x6e0/0x6e0 [ 2148.357667] schedule+0x8d/0x1b0 [ 2148.361024] schedule_preempt_disabled+0xf/0x20 [ 2148.365682] __mutex_lock+0x73c/0x1470 [ 2148.369650] ? ctrl_cdev_ioctl+0x142/0x220 [ 2148.373895] ? mutex_trylock+0x1a0/0x1a0 [ 2148.378639] ? __might_fault+0x104/0x1b0 [ 2148.382700] ? lock_acquire+0x170/0x3f0 [ 2148.389522] ? ctrl_cdev_ioctl+0x142/0x220 [ 2148.393741] ctrl_cdev_ioctl+0x142/0x220 [ 2148.397835] ? vol_cdev_llseek+0x140/0x140 [ 2148.402064] ? selinux_file_ioctl+0x3f7/0x560 [ 2148.409497] ? vol_cdev_llseek+0x140/0x140 [ 2148.413763] do_vfs_ioctl+0x75a/0xfe0 [ 2148.417630] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2148.422382] ? ioctl_preallocate+0x1a0/0x1a0 [ 2148.427436] ? security_file_ioctl+0x76/0xb0 [ 2148.431838] ? security_file_ioctl+0x83/0xb0 [ 2148.436323] SyS_ioctl+0x7f/0xb0 [ 2148.439677] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2148.443628] do_syscall_64+0x1d5/0x640 [ 2148.447615] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2148.452790] RIP: 0033:0x45ca29 [ 2148.456073] RSP: 002b:00007f2eb926ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2148.463770] RAX: ffffffffffffffda RBX: 00000000004e1080 RCX: 000000000045ca29 [ 2148.471150] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003 [ 2148.478485] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2148.485765] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2148.493159] R13: 0000000000000209 R14: 00000000004c44c1 R15: 00007f2eb926b6d4 [ 2148.500555] [ 2148.500555] Showing all locks held in the system: [ 2148.507856] 1 lock held by khungtaskd/1058: [ 2148.512432] #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a [ 2148.521716] 1 lock held by in:imklog/6049: [ 2148.526027] #0: (rcu_read_lock){....}, at: [] __fdget_pos+0xa6/0xc0 [ 2148.534184] 2 locks held by agetty/6272: [ 2148.538350] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 2148.547428] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 2148.557086] 1 lock held by syz-executor.2/5116: [ 2148.561743] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 2148.570837] 1 lock held by syz-executor.1/5132: [ 2148.575501] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 2148.584601] [ 2148.586322] ============================================= [ 2148.586322] [ 2148.593318] NMI backtrace for cpu 0 [ 2148.597011] CPU: 0 PID: 1058 Comm: khungtaskd Not tainted 4.14.180-syzkaller #0 [ 2148.604443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2148.613774] Call Trace: [ 2148.616342] dump_stack+0x13e/0x194 [ 2148.619982] nmi_cpu_backtrace.cold+0x57/0x93 [ 2148.624452] ? irq_force_complete_move.cold+0x7b/0x7b [ 2148.629616] nmi_trigger_cpumask_backtrace+0x139/0x17e [ 2148.634867] watchdog+0x5e2/0xb80 [ 2148.638332] ? hungtask_pm_notify+0x50/0x50 [ 2148.642627] kthread+0x30d/0x420 [ 2148.645995] ? kthread_create_on_node+0xd0/0xd0 [ 2148.650644] ret_from_fork+0x24/0x30 [ 2148.654585] Sending NMI from CPU 0 to CPUs 1: [ 2148.659428] NMI backtrace for cpu 1 [ 2148.659432] CPU: 1 PID: 8 Comm: rcu_preempt Not tainted 4.14.180-syzkaller #0 [ 2148.659436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2148.659438] task: ffff8880a9854200 task.stack: ffff8880a9860000 [ 2148.659441] RIP: 0010:debug_lockdep_rcu_enabled+0x26/0x90 [ 2148.659443] RSP: 0018:ffff8880a9867a38 EFLAGS: 00000002 [ 2148.659448] RAX: 0000000000000007 RBX: ffff88808db2e0a8 RCX: 1ffffffff1124598 [ 2148.659451] RDX: 0000000000000000 RSI: 1ffffffff0f419ad RDI: ffffffff87a0cd68 [ 2148.659454] RBP: ffffffff8a6b8760 R08: 0000000000000000 R09: 0000000000000001 [ 2148.659458] R10: ffff8880a9854a88 R11: ffff8880a9854200 R12: 0000000000000000 [ 2148.659461] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 2148.659464] FS: 0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 [ 2148.659467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2148.659470] CR2: 00007f492a56a000 CR3: 000000009474d000 CR4: 00000000001406e0 [ 2148.659473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2148.659476] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 2148.659478] Call Trace: [ 2148.659480] lock_acquire+0x307/0x3f0 [ 2148.659482] _raw_spin_lock_irqsave+0x8c/0xbf [ 2148.659484] ? debug_object_deactivate+0xe7/0x350 [ 2148.659487] debug_object_deactivate+0xe7/0x350 [ 2148.659489] ? debug_stats_show+0xd0/0xd0 [ 2148.659491] ? lock_timer_base+0x58/0x190 [ 2148.659493] ? _raw_spin_lock_irqsave+0x94/0xbf [ 2148.659495] detach_if_pending+0x82/0x480 [ 2148.659497] try_to_del_timer_sync+0x9a/0xe0 [ 2148.659499] ? detach_if_pending+0x480/0x480 [ 2148.659502] del_timer_sync+0x17b/0x250 [ 2148.659504] schedule_timeout+0x444/0xe40 [ 2148.659506] ? usleep_range+0x130/0x130 [ 2148.659508] ? trace_hardirqs_on_caller+0x3f6/0x590 [ 2148.659511] ? _raw_spin_unlock_irqrestore+0xa0/0xe0 [ 2148.659513] ? call_timer_fn+0x650/0x650 [ 2148.659515] rcu_gp_kthread+0xb8e/0x1ce0 [ 2148.659517] ? force_qs_rnp+0x4f0/0x4f0 [ 2148.659519] ? force_qs_rnp+0x4f0/0x4f0 [ 2148.659521] kthread+0x30d/0x420 [ 2148.659524] ? kthread_create_on_node+0xd0/0xd0 [ 2148.659526] ret_from_fork+0x24/0x30 [ 2148.659527] Code: eb ea 0f 1f 00 48 c7 c0 c4 2c 92 88 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 <84> d2 75 46 8b 15 14 39 47 07 85 d2 74 39 48 c7 c0 e0 cf 13 88 [ 2148.660823] Kernel panic - not syncing: hung_task: blocked tasks [ 2148.889489] CPU: 0 PID: 1058 Comm: khungtaskd Not tainted 4.14.180-syzkaller #0 [ 2148.896909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2148.906238] Call Trace: [ 2148.908804] dump_stack+0x13e/0x194 [ 2148.912417] panic+0x1f9/0x42d [ 2148.915582] ? add_taint.cold+0x16/0x16 [ 2148.919541] ? irq_force_complete_move.cold+0x7b/0x7b [ 2148.924708] watchdog+0x5f3/0xb80 [ 2148.928138] ? hungtask_pm_notify+0x50/0x50 [ 2148.932444] kthread+0x30d/0x420 [ 2148.935786] ? kthread_create_on_node+0xd0/0xd0 [ 2148.940427] ret_from_fork+0x24/0x30 [ 2148.945541] Kernel Offset: disabled [ 2148.949157] Rebooting in 86400 seconds..