ell server: sshd[ 32.769960] audit: type=1800 audit(1556136326.973:33): pid=6890 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [?25l[?1c7[1[ 32.799706] audit: type=1800 audit(1556136326.973:34): pid=6890 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 G[ ok 8[?25h[?0c. [ 33.834090] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 34.208448] audit: type=1400 audit(1556136328.413:35): avc: denied { map } for pid=7065 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 34.261029] random: sshd: uninitialized urandom read (32 bytes read) [ 34.936669] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.48' (ECDSA) to the list of known hosts. [ 40.675220] random: sshd: uninitialized urandom read (32 bytes read) 2019/04/24 20:05:35 fuzzer started [ 40.877346] audit: type=1400 audit(1556136335.083:36): avc: denied { map } for pid=7075 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 42.848339] random: cc1: uninitialized urandom read (8 bytes read) 2019/04/24 20:05:38 dialing manager at 10.128.0.105:35831 2019/04/24 20:05:38 syscalls: 2434 2019/04/24 20:05:38 code coverage: enabled 2019/04/24 20:05:38 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/04/24 20:05:38 extra coverage: extra coverage is not supported by the kernel 2019/04/24 20:05:38 setuid sandbox: enabled 2019/04/24 20:05:38 namespace sandbox: enabled 2019/04/24 20:05:38 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/24 20:05:38 fault injection: enabled 2019/04/24 20:05:38 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/24 20:05:38 net packet injection: enabled 2019/04/24 20:05:38 net device setup: enabled [ 45.017797] random: crng init done 20:07:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000040), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x200001e4) r2 = memfd_create(&(0x7f0000000180)='dev ', 0x3) write(r2, &(0x7f00000011c0)="16", 0x1) sendfile(r1, r2, &(0x7f0000000000), 0xffff) syz_execute_func(&(0x7f0000000080)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c4c1585e5c2b71660f3a426306f5") clone(0x3502001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$addseals(r2, 0x409, 0x8) setsockopt$inet6_tcp_buf(r1, 0x6, 0x0, &(0x7f00000001c0)="9a439621", 0x4) 20:07:40 executing program 0: r0 = creat(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000080)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000100), 0x1b) r2 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000180)=[@window={0x3, 0x0, 0x7f}, @sack_perm], 0x20000000000000d0) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) 20:07:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec7) ioctl$KVM_NMI(r3, 0xae9a) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000000), 0x8) ioctl$KVM_RUN(r3, 0xae80, 0x0) 20:07:40 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) r3 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r2) r4 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, &(0x7f0000000140)) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r5, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r4, &(0x7f0000000600), 0x1000) close(r5) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r5, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:07:40 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000001c0)) syz_open_dev$vbi(0x0, 0xffffffffffffffff, 0x2) dup2(r1, r2) 20:07:40 executing program 2: clone(0x2182001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./file1\x00', 0x21) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000002c0)=""/11, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x4000000000000003) r2 = dup2(r0, r1) execve(&(0x7f0000000540)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff5, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file1\x00', 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, 0x0) [ 166.672545] audit: type=1400 audit(1556136460.883:37): avc: denied { map } for pid=7075 comm="syz-fuzzer" path="/root/syzkaller-shm798455133" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 166.728655] audit: type=1400 audit(1556136460.913:38): avc: denied { map } for pid=7091 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=67 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 167.330179] IPVS: ftp: loaded support on port[0] = 21 [ 167.628983] IPVS: ftp: loaded support on port[0] = 21 [ 167.686223] chnl_net:caif_netlink_parms(): no params data found [ 167.753943] IPVS: ftp: loaded support on port[0] = 21 [ 167.770308] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.776711] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.783953] device bridge_slave_0 entered promiscuous mode [ 167.812097] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.818464] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.825559] device bridge_slave_1 entered promiscuous mode [ 167.841056] chnl_net:caif_netlink_parms(): no params data found [ 167.873733] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 167.884957] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 167.917074] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 167.924323] team0: Port device team_slave_0 added [ 167.935925] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 167.943539] team0: Port device team_slave_1 added [ 167.948946] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 167.961174] IPVS: ftp: loaded support on port[0] = 21 [ 167.980347] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 167.993552] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.000117] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.007051] device bridge_slave_0 entered promiscuous mode [ 168.062736] device hsr_slave_0 entered promiscuous mode [ 168.120394] device hsr_slave_1 entered promiscuous mode [ 168.160371] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.166860] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.174761] device bridge_slave_1 entered promiscuous mode [ 168.195106] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 168.214966] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 168.223283] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 168.231452] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 168.265299] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 168.272770] team0: Port device team_slave_0 added [ 168.310466] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 168.317652] team0: Port device team_slave_1 added [ 168.326384] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 168.336414] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 168.362916] chnl_net:caif_netlink_parms(): no params data found [ 168.372266] IPVS: ftp: loaded support on port[0] = 21 [ 168.432431] device hsr_slave_0 entered promiscuous mode [ 168.490370] device hsr_slave_1 entered promiscuous mode [ 168.530917] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 168.552137] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 168.568834] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.575366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 168.583412] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.591398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 168.689072] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.696074] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.703470] device bridge_slave_0 entered promiscuous mode [ 168.711648] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.718006] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.725316] device bridge_slave_1 entered promiscuous mode [ 168.740757] chnl_net:caif_netlink_parms(): no params data found [ 168.753896] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.760993] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.784576] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 168.796978] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 168.810166] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 168.825550] IPVS: ftp: loaded support on port[0] = 21 [ 168.864970] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 168.872933] team0: Port device team_slave_0 added [ 168.879122] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 168.887301] team0: Port device team_slave_1 added [ 168.893242] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 168.903355] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 168.974020] device hsr_slave_0 entered promiscuous mode [ 169.010471] device hsr_slave_1 entered promiscuous mode [ 169.085601] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 169.093070] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 169.146018] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.182050] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.188443] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.195753] device bridge_slave_0 entered promiscuous mode [ 169.205227] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.211712] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.218905] device bridge_slave_1 entered promiscuous mode [ 169.227205] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 169.258012] chnl_net:caif_netlink_parms(): no params data found [ 169.283598] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 169.293274] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 169.300968] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 169.317968] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 169.335834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 169.345188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 169.355319] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 169.363807] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.395330] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 169.404957] team0: Port device team_slave_0 added [ 169.410711] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 169.417730] team0: Port device team_slave_1 added [ 169.427301] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.451618] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 169.459436] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 169.485760] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 169.495883] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.502405] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.509364] device bridge_slave_0 entered promiscuous mode [ 169.516852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 169.524737] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 169.532357] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.538690] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.546083] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 169.555104] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 169.586265] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.593127] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.600292] device bridge_slave_1 entered promiscuous mode [ 169.623110] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 169.631079] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 169.638594] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.644977] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.653854] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 169.661653] chnl_net:caif_netlink_parms(): no params data found [ 169.712198] device hsr_slave_0 entered promiscuous mode [ 169.750354] device hsr_slave_1 entered promiscuous mode [ 169.790458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 169.798485] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 169.805634] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 169.813330] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 169.819550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 169.827191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 169.851301] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 169.886710] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 169.897711] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 169.907743] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 169.917968] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 169.924422] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.934679] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.941269] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.948144] device bridge_slave_0 entered promiscuous mode [ 169.971767] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 169.979043] team0: Port device team_slave_0 added [ 169.985818] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 169.993918] team0: Port device team_slave_1 added [ 170.000399] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 170.007769] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.014395] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.021430] device bridge_slave_1 entered promiscuous mode [ 170.036549] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 170.045593] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 170.053271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 170.062017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 170.069542] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.075936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.083272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 170.091408] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 170.099132] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 170.106312] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 170.117737] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 170.132493] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 170.142924] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 170.150131] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 170.157386] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 170.165434] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 170.175093] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 170.183835] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 170.254624] device hsr_slave_0 entered promiscuous mode [ 170.310437] device hsr_slave_1 entered promiscuous mode [ 170.350560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 170.358455] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 170.366189] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.372583] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.381802] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 170.390710] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 170.415242] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 170.422746] team0: Port device team_slave_0 added [ 170.428348] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 170.436073] team0: Port device team_slave_1 added [ 170.441700] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 170.448831] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 170.456934] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 170.469708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.480519] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 170.488061] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 170.497058] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 170.505150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 170.513802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 170.521368] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 170.532789] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 170.549336] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 170.569485] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 170.577539] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 170.592465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 170.599904] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 170.607409] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 170.617261] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 170.627691] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 170.635325] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 170.643571] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 170.649574] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 170.692262] device hsr_slave_0 entered promiscuous mode [ 170.730535] device hsr_slave_1 entered promiscuous mode [ 170.771229] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 170.777750] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 170.785045] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 170.792729] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 170.801307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 170.808650] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 170.819192] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 170.828546] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 170.841007] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 170.847777] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 170.857668] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 170.865594] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 170.872905] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 170.882899] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 170.888927] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 170.901550] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 170.907654] 8021q: adding VLAN 0 to HW filter on device team0 [ 170.924119] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 170.949142] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 170.964229] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 170.977854] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.987056] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 170.997251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 171.005411] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 171.013288] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.019652] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.028143] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 171.036578] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 171.048537] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 171.065514] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 171.075741] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 171.083575] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 171.093682] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 171.101837] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.108170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.115129] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 171.128096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.135924] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 171.144081] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 171.158049] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 171.166593] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 171.173642] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 171.184522] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 171.192174] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.204620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 171.214773] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 171.224120] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 171.241094] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 171.256356] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 171.267234] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 171.273986] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 171.282715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 171.290545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 171.298307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 171.306477] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.312879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.320601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 171.328461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 171.336857] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.343266] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.356693] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 171.363733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 171.373044] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 171.382808] hrtimer: interrupt took 24329 ns [ 171.421457] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 171.429261] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 171.443201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 171.451304] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 171.459171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 171.472806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 171.484784] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 171.498915] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 171.512241] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready 20:07:45 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) r3 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r2) r4 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, &(0x7f0000000140)) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r5, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r4, &(0x7f0000000600), 0x1000) close(r5) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r5, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) [ 171.528824] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 171.535582] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.549628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 171.578676] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 171.586433] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 171.598920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 171.606993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 171.622039] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 171.628153] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:07:45 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) r3 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r2) r4 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, &(0x7f0000000140)) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r5, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r4, &(0x7f0000000600), 0x1000) close(r5) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r5, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) [ 171.659380] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 171.673777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.699987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 171.713083] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 171.727653] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 171.753639] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 171.775466] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 171.788604] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 20:07:46 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x8000000a447, 0x0) ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285628, &(0x7f00000000c0)={0x3, 0x0, 0x40000000000003f, [], &(0x7f0000000100)}) [ 171.810960] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 171.818058] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 171.840594] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 171.849062] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.855490] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.870483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 171.878610] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 171.911088] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 171.931103] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 171.938723] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 171.948614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 171.959441] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 171.972534] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 171.979395] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 171.991221] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 20:07:46 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0xe00) [ 172.007056] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 172.016068] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 172.027746] 8021q: adding VLAN 0 to HW filter on device team0 20:07:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = getpgrp(0xffffffffffffffff) getpriority(0x2, r1) [ 172.052347] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 172.059259] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 172.071003] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 172.082781] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.089243] bridge0: port 2(bridge_slave_1) entered forwarding state 20:07:46 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffffe}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000780)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 172.125586] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 172.137159] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 172.148755] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 172.161383] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 172.172635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 172.184146] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 172.193819] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 172.201758] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 172.209590] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 172.218133] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.224558] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.232155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 172.251187] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 172.257233] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 172.284368] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 172.297871] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 172.306999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 172.318435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 172.326881] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.333296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.340733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 172.348446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 172.359305] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 172.370888] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 172.388769] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 172.395678] protocol 88fb is buggy, dev hsr_slave_0 [ 172.395746] protocol 88fb is buggy, dev hsr_slave_1 [ 172.411679] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 172.419626] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 172.429157] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 172.443067] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 172.457282] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 172.465159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 172.478231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 172.486621] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 172.501773] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 172.511809] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 172.520877] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 172.533417] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 172.541467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 172.549443] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 172.558146] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 172.566271] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 172.574250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 172.581828] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 172.589430] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 172.602098] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 172.627613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 172.637299] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 172.644885] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 172.659894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 172.668166] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 172.691680] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 172.699971] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 172.711292] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 172.717300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 172.727905] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 172.740847] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 172.766425] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 172.794114] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 172.807965] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 172.824594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 173.344583] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 173.461024] kvm: emulating exchange as write 20:07:49 executing program 5: 20:07:49 executing program 0: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x1, r0, &(0x7f0000000140), 0x8, &(0x7f00000001c0)) 20:07:49 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vcs\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13b, 0x6}}, 0x20) 20:07:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, 0x0, 0x0, 0x0) close(r1) 20:07:49 executing program 4: 20:07:49 executing program 2: 20:07:49 executing program 2: 20:07:49 executing program 4: 20:07:49 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0x0, &(0x7f0000000840)='net/ip6_flowlabel\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:07:49 executing program 2: 20:07:49 executing program 4: 20:07:49 executing program 3: 20:07:49 executing program 1: 20:07:49 executing program 0: 20:07:49 executing program 2: 20:07:49 executing program 4: 20:07:49 executing program 3: 20:07:49 executing program 1: 20:07:50 executing program 2: 20:07:50 executing program 3: 20:07:50 executing program 5: r0 = socket$inet6(0xa, 0x82000000003, 0x810000000000010) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000240)=ANY=[@ANYBLOB='\b']}) 20:07:50 executing program 3: 20:07:50 executing program 4: 20:07:50 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x2000048, 0x0) 20:07:50 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, 0x0) socket$inet6(0xa, 0x6, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x20000000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x10) ioctl(0xffffffffffffffff, 0x0, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x48f4}], 0x1}, 0x0) 20:07:50 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) 20:07:50 executing program 4: 20:07:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000580)={0x2c, r2, 0xc5ac741d5035292f, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}}, 0x0) 20:07:50 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0xe00) 20:07:50 executing program 5: bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f00000000c0)={'bridge_slave_0\x00', {0x2, 0x4e21, @broadcast}}) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(r1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:07:50 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='gid_map\x00') [ 176.101099] audit: type=1400 audit(1556136470.313:39): avc: denied { create } for pid=7309 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 20:07:50 executing program 3: 20:07:50 executing program 4: [ 176.257553] audit: type=1400 audit(1556136470.333:40): avc: denied { write } for pid=7309 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 20:07:50 executing program 4: 20:07:50 executing program 3: 20:07:50 executing program 4: 20:07:50 executing program 3: 20:07:50 executing program 2: 20:07:50 executing program 5: 20:07:50 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, 0x0) socket$inet6(0xa, 0x6, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x20000000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x10) ioctl(0xffffffffffffffff, 0x0, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x48f4}], 0x1}, 0x0) [ 176.475481] audit: type=1400 audit(1556136470.333:41): avc: denied { read } for pid=7309 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 20:07:50 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 20:07:50 executing program 2: 20:07:50 executing program 5: 20:07:50 executing program 4: r0 = socket$inet(0x2, 0x3, 0x7) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in6=@dev}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) 20:07:50 executing program 3: r0 = semget$private(0x0, 0x207, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") semop(r0, &(0x7f0000000140)=[{0x0, 0x23, 0x1000}], 0x81) 20:07:50 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x82102005ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") shmctl$IPC_STAT(0x0, 0x2, 0x0) 20:07:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x200000, 0x0) write$P9_RSTAT(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000200)={0x606c8336, 0x1, 0x8, 'queue1\x00', 0x3}) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, 0x0) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) syz_open_dev$media(0x0, 0x0, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x1f4) write$FUSE_BMAP(0xffffffffffffffff, 0x0, 0x0) connect$bt_sco(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000100)={0x3, 0x2, 0x3, 0x0, 0x9, 0x3}) 20:07:51 executing program 5: ioprio_set$pid(0x2, 0x0, 0x7c39) clone(0x20008577, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x2a4506, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioperm(0x0, 0x0, 0x0) 20:07:51 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x840, 0x0, 0x0) 20:07:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0x0, &(0x7f0000000100)='setgroups\x00') sendfile(r1, r1, 0x0, 0x200000000ff) 20:07:51 executing program 1: 20:07:51 executing program 0: 20:07:51 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="11dc86055e0bceec7be070") bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x4000000000002, 0x4, 0x100000001, 0x7, 0x0, 0x1}, 0x2c) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000040)={@remote, @dev, @empty, 0x0, 0x40, 0x0, 0x100, 0x0, 0x3}) write$binfmt_elf32(r0, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0x50a, 0x1, 0x1, 0x2, 0x5, 0x0, 0x3e, 0x60, 0x164, 0x38, 0x60, 0xe63f, 0x4, 0x20, 0x2, 0x24000000, 0xfff}, [{0x6474e551, 0x8, 0x226, 0x81, 0x4, 0xef6, 0x3ff000000000, 0x8}], "90399599df1adfe9d5a200c2c22f4fb3fc863adc1f093b421111a5ed463f05355401bce51ce60d61d967cb3888e09777467679f1873fcc23079210e0f5136bf095d39cebca33fadd03bc3c4f6343c510fcab0041150d000405e293518dba1fd4d4f535ba382d2f32256666689fe33eaeb19152af4ead049a14edee989846ad3d101f85934fab0ab2ffd8b3fb8b3d6d715a1b18cd1e773d435c263b061f6c15b3f5a66579ea633b26d26892264851a6817b6de923c3a2286f72cc5125e24039e3089c253bc645"}, 0x11e) 20:07:51 executing program 5: syz_mount_image$gfs2(&(0x7f0000000380)='gfs2\x00', &(0x7f00000003c0)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={[{@lockproto_nolock='lockproto=l%ck_nolock'}, {@locktable={'locktable', 0x3d, '127.0.0.1\x00'}}]}) 20:07:51 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x2}, 0x43c5) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fdatasync(r2) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) write$binfmt_misc(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="dc"], 0x1) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000a80)={0x0, r2}) 20:07:51 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000540)={0x3, {{0x2, 0x0, @multicast1}}}, 0x88) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @loopback}, 0xc) getsockopt$inet_buf(r0, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x91) [ 177.143526] gfs2: can't find protocol l%ck_nolock [ 177.235102] gfs2: can't find protocol l%ck_nolock 20:07:51 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) sendto(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x2000c000, 0x0, 0x0) 20:07:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f000000d000/0x18000)=nil, 0x0, 0x0, 0x20, &(0x7f0000000280)=[@dstype3={0x7, 0x6}], 0x1) ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, &(0x7f0000000040)={0x0, @sliced={0xe5f, [0xf9, 0x0, 0xffffffff80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) 20:07:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070") r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="24000000200007041dfffd946f610500020000001f00000000000800050018000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 20:07:51 executing program 1: openat$vfio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2000, 0x105086) r2 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r0, r1, 0x0, 0x102000002) 20:07:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x200000, 0x0) write$P9_RSTAT(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000200)={0x606c8336, 0x1, 0x8, 'queue1\x00', 0x3}) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, 0x0) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) syz_open_dev$media(0x0, 0x0, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x1f4) write$FUSE_BMAP(0xffffffffffffffff, 0x0, 0x0) connect$bt_sco(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000100)={0x3, 0x2, 0x3, 0x0, 0x9, 0x3}) 20:07:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x200000, 0x0) write$P9_RSTAT(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000200)={0x606c8336, 0x1, 0x8, 'queue1\x00', 0x3}) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, 0x0) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) syz_open_dev$media(0x0, 0x0, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x1f4) write$FUSE_BMAP(0xffffffffffffffff, 0x0, 0x0) connect$bt_sco(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000100)={0x3, 0x2, 0x3, 0x0, 0x9, 0x3}) [ 177.632137] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:07:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") pkey_alloc(0x0, 0x5) [ 177.835472] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:07:52 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) sendto(0xffffffffffffffff, &(0x7f00000001c0)='0', 0x1, 0x2000c000, 0x0, 0x0) 20:07:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$security_ima(0x0, 0x0, 0x0, 0x0, 0x0) flock(0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$KDSKBMODE(r0, 0x4b45, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000004200)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) 20:07:52 executing program 1: mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x1008007, 0x31, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000fdffffff000000000000000000000000000000000000000000000000000000000000000000002c6900"/87], 0x1, 0x0, 0xa4a3ad41a879dde0) [ 177.974841] syz-executor.1 (7434) used greatest stack depth: 23264 bytes left 20:07:52 executing program 1: ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x0, &(0x7f0000000140), 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x80800, 0x0) finit_module(r0, &(0x7f0000000180)='nodev!:\x00', 0x2) fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x12002, 0x0) gettid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000280)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) readv(r1, &(0x7f00000025c0)=[{&(0x7f0000000240)=""/196, 0xc4}, {&(0x7f0000001400)=""/171, 0xab}], 0x2) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="85e07722da70e15cc0ade98b9deda2555a3afa1317ea1aa37ef10d62c7d12b48126e0225e63cc7a4231d15db81b233a1fcbb88586aa761156c76689870efb73458a6e8c8f3bcd9b9fce6b808db9581cc8a961c388c9e63fe4ee3f41c3ea91a5c3e62118de08a74ffe8b1a1c0f5f5d19b3a4a"], 0x72) fallocate(r1, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0x0, r2, 0x6, 0x8, 0x80000001}) 20:07:52 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x9, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:07:52 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0xffffff80, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:52 executing program 3: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) sched_setaffinity(0x0, 0xffffffffffffff26, &(0x7f0000000140)=0x1) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9313, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(0x0, 0x8f, 0x2, &(0x7f00000004c0), &(0x7f00000003c0), 0x8000000000000001) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="0004f90e0000fddbdf251600000014000900080001000200000008000100ffffff7f14000900080002000001000008000200030000002c0002000400040004000400080002000100ffff040004000400040008000200ff0300000800020000000080"], 0x1}, 0x1, 0x0, 0x0, 0x20004000}, 0x10) mkdir(&(0x7f0000000380)='./file0\x00', 0x20000000000000) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) capset(&(0x7f0000000200), 0x0) munmap(&(0x7f0000552000/0x1000)=nil, 0x1000) write$P9_RMKNOD(r2, &(0x7f0000000000)={0x14, 0x13, 0x2, {0x10, 0x3, 0xffffffffffffffff}}, 0x14) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, &(0x7f0000000300)={{0x3f, 0x754, 0x7f, 0x4, 0x80000001}, 0x1b48}) r4 = dup2(0xffffffffffffffff, r3) r5 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) openat(r5, &(0x7f00000001c0)='./bus\x00', 0x882, 0xd) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240), 0x0) write$eventfd(r5, &(0x7f0000000080), 0xfffffe5e) ioctl$EVIOCSABS2F(r5, 0x401845ef, 0x0) fdatasync(r5) sendto$unix(r5, &(0x7f0000000600)="92ef0c90e20b05ab8affaa272734ee9abb7bd5028047eae92afa1e0ff43ba071b907fff272121bb1bf9aa6e0fbf6a59419475f94d7262106db0926db47d92d12e2e5a4da6112ffb60f4c7b023644e117af52073633dc4352eba15adaa78fbb418fa9917e36e1e2fc0db4c8f6d64b81f9208a006211be55af615c20472fec4a4c173900c9fddc7d0e033c97bcd84ca4ba86ab82c11527a024c886fd2bad50d8679b6a80bf2a7318c36c76cf4e948e166b438711bb7d8f7064c2af00fcf7c84e7c1e883cb394e69e41c03377c4fdcfe4c99b678e1a31abfb03a7e160096e6402dea9aa5936849abc6849964d639d", 0xed, 0x1, 0x0, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x0) ioctl$FS_IOC_GETFSLABEL(r4, 0x81009431, &(0x7f0000000500)) fsetxattr$security_selinux(r0, &(0x7f0000000440)='security.selinux\x00', &(0x7f0000000480)='system_u:object_r:selinux_config_t:s0\x00', 0x26, 0x0) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x3) 20:07:52 executing program 0: creat(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000180)='\x1a\xa86\x8a\x9b\xf8]\xc5\x06c\x9a\x11e!\xad?\x9ate\xe9\xf2c\xceZ%\x9a\x00\xcb\bY\x8f\x9e\xcb\x9a \xe0\x7f^\x03c\xd8\x8f\t\xe9\xe0\xea\fY6\n\xda\xfe\x86l\xcc\r<\xfc\xf11\x15\x9d:)O{\xbf\xea\xe1\xc68*$?\xb5}9\x02\xf3E\xb8)bX\x88c\xe5:TE\x9b\xfe\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x82\x00\x00\x00\x00\x00l\x00W\xe6XT\\l\xd6J\xf2\x12\xc4\x9e\xd4\xbe8<\v\x868%l0\xa1%\xb3\x1b,g\x8d\xfa\x8dq&\xc4\xc0\x81\x9a\x91\x9e\xe3\xe6\xa6\xd8\xb80\xe4NW=\x10\x8d\xcc\xcbU\x1dg\xd9\xc5\xb1\x94\x95\x10\xe3\xe8\xa8\xbfW\x00\x16\x90o=\x80`\xe2\xd1\xb2\xac\x92\x95F\xc0\xb5$\xe3\x1f7T\xe7\xd6A\x8b\x11Qx\xa0\xa4\xa2_h\xcc\xe0\nXpo\x9f=\xa4\xff\xaf\xb4\x02P\xaa\r46X\x8b\xfb\xc7/\x8b\xa5\x06\x11\xc9\x0fl') 20:07:52 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$GIO_FONT(r0, 0x4b60, 0x0) [ 178.326018] print_req_error: I/O error, dev loop1, sector 0 [ 178.339618] devpts: called with bogus options [ 178.352256] audit: type=1804 audit(1556136472.563:42): pid=7457 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.1" name="/root/syzkaller-testdir887489094/syzkaller.Levp6h/16/file0" dev="sda1" ino=16549 res=1 20:07:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x200000, 0x0) write$P9_RSTAT(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000200)={0x606c8336, 0x1, 0x8, 'queue1\x00', 0x3}) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, 0x0) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) syz_open_dev$media(0x0, 0x0, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x1f4) write$FUSE_BMAP(0xffffffffffffffff, 0x0, 0x0) connect$bt_sco(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000100)={0x3, 0x2, 0x3, 0x0, 0x9, 0x3}) 20:07:52 executing program 5: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xfffffe8b) unlink(&(0x7f0000000040)='./file0\x00') clone(0x200000100010a, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() rmdir(&(0x7f0000000180)='./file1\x00') ptrace(0x10, r1) creat(&(0x7f0000000000)='./file0\x00', 0x0) 20:07:52 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000033c0)={0x1, &(0x7f0000003400)=[{0x16}]}, 0x10) 20:07:52 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYRESDEC], 0x1) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x12) [ 178.550645] audit: type=1400 audit(1556136472.763:43): avc: denied { associate } for pid=7469 comm="syz-executor.3" name="kvm" dev="devtmpfs" ino=63 scontext=system_u:object_r:selinux_config_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 20:07:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000200)='./file0\x00', 0x1120, 0x0) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x27e, 0x0) r1 = dup2(r0, r0) fcntl$setpipe(r1, 0x407, 0x0) 20:07:52 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000004200)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) 20:07:53 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x8000000015, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x24) fcntl$setstatus(r1, 0x4, 0x42803) 20:07:53 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) fcntl$lock(r0, 0xd, &(0x7f0000000000)) 20:07:53 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:53 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000033c0)={0x1, &(0x7f0000003400)=[{0x16}]}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_emit_ethernet(0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaf900000000000000000c0000000000000000a8b83b567beab9089edfed737211e52520345f0de435f952b290c8ec29f02aceaba815eee4eb62070dbbb5c5e179333e91ef9c08bfbf4b8e5f525794a589b70b440959f48e164d0c9586d2b8e5cdf49cadd32430a1aa68db071347642315d4b48253bdfb8791480005f96b077cfeb9744b74e3b42399735caab1ae"], 0x0) 20:07:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) close(r0) 20:07:55 executing program 5: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xfffffe8b) unlink(&(0x7f0000000040)='./file0\x00') clone(0x200000100010a, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() rmdir(&(0x7f0000000180)='./file1\x00') ptrace(0x10, r1) creat(&(0x7f0000000000)='./file0\x00', 0x0) 20:07:55 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:55 executing program 3: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x7, 0x100, 0x9, 0x5, 0x0, 0x0, 0x2000, 0x9, 0x480, 0xfffffffffffffff7, 0x0, 0x0, 0xffffffffffffff82, 0x1, 0x8, 0x101, 0x0, 0x75e, 0x0, 0x0, 0x7, 0x4, 0x0, 0xdd, 0x8, 0x9, 0x12000000, 0x0, 0x1, 0x0, 0x10001, 0x800, 0x2, 0x1, 0x400, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x8001}, 0x80, 0x0, 0x4, 0x0, 0x400, 0x4, 0xffff}, 0x0, 0xc, 0xffffffffffffffff, 0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) syncfs(0xffffffffffffffff) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x2, 0x40) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000100)={{0xbf, @multicast1, 0x4e23, 0x0, 'wrr\x00', 0x0, 0x20, 0x64}, {@remote, 0x4e20, 0x3, 0x100, 0x6, 0x86}}, 0x44) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x3, r3}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) 20:07:55 executing program 2: mmap(&(0x7f0000ef9000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fea000/0x1000)=nil, 0x1000, 0x0, 0x8000000000032, 0xffffffffffffffff, 0x0) 20:07:55 executing program 0: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='proc\x00', 0x0, &(0x7f00000001c0)='n\xa86\x8a\x9b\xf8]\xc5\x06c\x9a\x11e!\xad?\x9ate\xe9\xf2c\xceZ%\x9a\x00\xcb\bY\x8f\x9e\xcb\x9a \xe0\x7f^\x03c\xd8\x8f\t\xe9\xe0\xea\fY6\n\xda\xfe\x86l\xcc\r<\xfc\xf11\x15\x9d:)O{\xbf\xea\xe1\xc68*$?\xb5}9\x02\xf3E\xb8)bX\x88c\xe5:TE\x9b\xfe\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x82\x00\x00\x00\x00\x00l\x00W\xe6XT\\l\xd6J\xf2\x12\xc4\x9e\xd4\xbe8<\v\x868%l0\xa1%\xb3\x1b,g\x8d\xfa\x8dq&\xc4\xc0\x81\x9a\x91\x9e\xe3\xe6\xa6\xd8\xb80\xe4NW=\x10\x8d\xcc\xcbU\x1dg\xd9\xc5\xb1\x94\x95\x10\xe3\xe8\xa8\xbfW\x00\x16\x90o=\x80`\xe2\xd1\xb2\xac\x92\x95F\xc0\xb5$\xe3\x1f7T\xe7\xd6A\x8b\x11Qx\xa0\xa4\xa2_h\xcc\xe0\nXpo\x9f=\xa4\xff\xaf\xb4\x02P\xaa\r46X\x8b\xfb\xc7/\x8b\xa5\x06\x11\xc9\x0fl') 20:07:55 executing program 4: syz_emit_ethernet(0x0, 0x0, 0x0) 20:07:55 executing program 2: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)='/', 0x1, 0x840, 0x0, 0x0) 20:07:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000004200)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) 20:07:56 executing program 4: syz_emit_ethernet(0x0, 0x0, 0x0) 20:07:56 executing program 1: r0 = eventfd2(0x4431, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) write(r2, 0x0, 0x0) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) r4 = creat(0x0, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$TIOCGDEV(r4, 0x80045432, &(0x7f00000001c0)) setsockopt$netlink_NETLINK_RX_RING(r4, 0x10e, 0x6, &(0x7f00000004c0)={0x6, 0x2, 0x7f, 0x5}, 0xffffffffffffff0e) setsockopt$inet_opts(r3, 0x0, 0x0, 0x0, 0x0) timerfd_gettime(r1, &(0x7f0000000400)) sendto$inet(r3, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) read(r3, &(0x7f0000000200)=""/13, 0xfffffffffffffdb4) set_thread_area(&(0x7f00000000c0)={0x7, 0x0, 0xffffffffffffffff, 0x45a, 0x6, 0x400, 0x3ff, 0x80000000, 0x8}) fsetxattr$security_evm(r3, &(0x7f0000000080)='security.evm\x00', &(0x7f00000001c0)=ANY=[], 0x0, 0x1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x10) fstat(r0, &(0x7f0000001740)) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f0000000440)) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000300)={0x1, 0x8, 0x8001, 0x0, 0x5}) write$FUSE_INTERRUPT(r3, &(0x7f0000000140)={0x10}, 0xfffffd2a) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f00000003c0)) 20:07:56 executing program 2: sched_setaffinity(0x0, 0xffffffffffffff26, &(0x7f0000000140)=0x1) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='cpuset\x00') setgroups(0x12d, &(0x7f0000000200)) ioctl$KVM_S390_UCAS_MAP(0xffffffffffffffff, 0x4018ae50, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(r0, 0x0, 0xffffffc3, 0x0) 20:07:56 executing program 4: syz_emit_ethernet(0x0, 0x0, 0x0) 20:07:58 executing program 5: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) 20:07:58 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x0, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:58 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000004200)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) 20:07:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000004200)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) 20:07:58 executing program 3: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x7, 0x100, 0x9, 0x5, 0x0, 0x0, 0x2000, 0x9, 0x480, 0xfffffffffffffff7, 0x0, 0x0, 0xffffffffffffff82, 0x1, 0x8, 0x101, 0x0, 0x75e, 0x0, 0x0, 0x7, 0x4, 0x0, 0xdd, 0x8, 0x9, 0x12000000, 0x0, 0x1, 0x0, 0x10001, 0x800, 0x2, 0x1, 0x400, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x8001}, 0x80, 0x0, 0x4, 0x0, 0x400, 0x4, 0xffff}, 0x0, 0xc, 0xffffffffffffffff, 0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) syncfs(0xffffffffffffffff) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x2, 0x40) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000100)={{0xbf, @multicast1, 0x4e23, 0x0, 'wrr\x00', 0x0, 0x20, 0x64}, {@remote, 0x4e20, 0x3, 0x100, 0x6, 0x86}}, 0x44) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x3, r3}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) 20:07:58 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000004200)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) 20:07:59 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x0, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socket$alg(0x26, 0x5, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@empty}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x800000022) fcntl$setstatus(r1, 0x4, 0x142802) 20:07:59 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x0, 0xffffffffffffffff, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:59 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xe}, 0x80000000006}, 0x1c) syz_emit_ethernet(0x140, &(0x7f0000000640)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff11, 0x0, @remote, @local, {[], @udp={0x0, 0x4e20, 0x8}}}}}}, 0x0) 20:07:59 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000001d008183ad5de08e3c444d3c058801eba0070000002339a0053571cc37153e3776f9835b3f00040a0000", 0x2e}], 0x1}, 0x0) 20:07:59 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0x0, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:59 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1000100) lseek(r0, 0x0, 0x3) r1 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000000)=0x1000) 20:07:59 executing program 5: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x0, 0x0, 0x0, 0x8, 0x0) 20:07:59 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0x0, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) [ 185.085190] audit: type=1804 audit(1556136479.293:44): pid=7640 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir887489094/syzkaller.Levp6h/22/bus" dev="sda1" ino=16577 res=1 20:07:59 executing program 2: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x1, r0, &(0x7f0000000140), 0x8, 0x0) 20:07:59 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000600)=""/11, 0x98) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)) dup2(r1, r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000180), 0x132772) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x2}, 0x20) ioctl$TCGETS2(r0, 0x802c542a, 0x0) 20:07:59 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @random="049cce98941b", [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0x0, @remote={0xfe, 0x80, [0x29c, 0x80ffffff00000000, 0x700, 0x0, 0x3000000, 0x0, 0x4000], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3]}, @mcast2}}}}}}}, 0x0) 20:07:59 executing program 0: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x1, r0, &(0x7f0000000140), 0xb, &(0x7f00000001c0)) 20:07:59 executing program 4: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x1, r0, 0x0, 0x8, &(0x7f00000001c0)) 20:07:59 executing program 1: clone(0x208, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xb) r1 = creat(&(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x80000000000010c) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)) open$dir(&(0x7f0000000200)='./file0\x00', 0x841, 0x0) syz_execute_func(&(0x7f00000006c0)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, 0x0) [ 185.672712] audit: type=1804 audit(1556136479.883:45): pid=7667 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir887489094/syzkaller.Levp6h/22/bus" dev="sda1" ino=16577 res=1 20:08:00 executing program 5: 20:08:00 executing program 5: 20:08:00 executing program 5: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x1, r0, 0x0, 0xb, &(0x7f00000001c0)) 20:08:00 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file1\x00', 0xc042, 0x0) mknod(0x0, 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x200010a) close(r0) execve(&(0x7f0000000100)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200800000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3103101ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file1\x00', 0x0, 0x0) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000000), 0x4) 20:08:00 executing program 2: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x0, 0x0, 0x0, 0x8, &(0x7f00000001c0)) 20:08:00 executing program 0: clone(0x8000ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000014, &(0x7f00000000c0)) ptrace(0x10, r0) waitid(0x1, r0, &(0x7f0000000140), 0xb, 0x0) 20:08:00 executing program 4: 20:08:00 executing program 3: 20:08:00 executing program 4: 20:08:00 executing program 4: 20:08:00 executing program 3: 20:08:00 executing program 1: 20:08:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x1000b525, 0x0) ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285628, &(0x7f00000000c0)={0x3, 0x0, 0x40000000000003f, [], &(0x7f0000000100)}) 20:08:00 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000280)='/dev/vbi#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, 0x0) 20:08:01 executing program 5: 20:08:01 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000001340)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x4) 20:08:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x3f}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') preadv(r0, &(0x7f00000017c0), 0x1be, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, 0x0, 0x4) 20:08:01 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}}], 0x1, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d"], 0x10c) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x34, 0x0, &(0x7f0000000300)}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r2 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz'}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r2, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, 0x0, &(0x7f0000000740)) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)) ioctl$TIOCSCTTY(r1, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0x0, &(0x7f0000000840)='net/ip6_flowlabel\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r2, 0x5) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x1000000000054}, 0x98) 20:08:01 executing program 4: 20:08:01 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000037000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 20:08:01 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}}], 0x1, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x34, 0x0, &(0x7f0000000300)}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(r1, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r3, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:01 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x7, 0x1, 0x8c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x48) [ 187.421484] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 187.431478] FAT-fs (loop2): error, invalid access to FAT (entry 0x00006500) 20:08:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000001340)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x4) [ 187.478913] FAT-fs (loop2): Filesystem has been set read-only [ 187.488233] FAT-fs (loop2): error, invalid access to FAT (entry 0x00006500) 20:08:01 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}}], 0x1, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d"], 0x10c) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x34, 0x0, &(0x7f0000000300)}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r2 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz'}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r2, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, 0x0, &(0x7f0000000740)) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)) ioctl$TIOCSCTTY(r1, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:01 executing program 5: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) r3 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000140)) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(0xffffffffffffffff, 0x0, 0x0) close(r4) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000100)={0x0, &(0x7f00000000c0)}) socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r6, 0x0) 20:08:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000001380)={@bcast, @bcast, 0x5, [@netrom, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) getsockopt(r0, 0x7fffffff, 0x82, &(0x7f0000000180)=""/4096, &(0x7f0000001180)=0x1000) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000001340)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x4) [ 187.565525] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 0) 20:08:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r3, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:01 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r3, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:01 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r3, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:02 executing program 5: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) r3 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000140)) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(0xffffffffffffffff, 0x0, 0x0) close(r4) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000100)={0x0, &(0x7f00000000c0)}) socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r6, 0x0) [ 187.930544] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 187.975398] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 188.012986] FAT-fs (loop0): Filesystem has been set read-only [ 188.049960] FAT-fs (loop0): error, invalid access to FAT (entry 0x00006500) [ 188.102589] FAT-fs (loop0): error, invalid access to FAT (entry 0x00006500) 20:08:02 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}}], 0x1, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x34, 0x0, &(0x7f0000000300)}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(r1, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:02 executing program 5: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) r3 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000140)) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(0xffffffffffffffff, 0x0, 0x0) close(r4) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000100)={0x0, &(0x7f00000000c0)}) socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r6, 0x0) [ 188.147982] FAT-fs (loop0): error, invalid access to FAT (entry 0x00006500) [ 188.321354] FAT-fs (loop0): error, invalid access to FAT (entry 0x00006500) 20:08:02 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(0xffffffffffffffff, 0xc0485660, 0x0) socket$inet6(0xa, 0x6, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x48f4}], 0x1}, 0x0) 20:08:02 executing program 5: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) r3 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000140)) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(0xffffffffffffffff, 0x0, 0x0) close(r4) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000100)={0x0, &(0x7f00000000c0)}) socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r6, 0x0) [ 188.495948] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 188.538163] FAT-fs (loop1): Filesystem has been set read-only [ 188.554453] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) 20:08:02 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x4, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt(r0, 0x400000000000003a, 0x1, 0x0, &(0x7f00000000c0)=0xffffff72) 20:08:02 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0xffffffffffffffc8, 0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x100000041}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) [ 188.639045] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006500) [ 188.646158] FAT-fs (loop2): error, invalid access to FAT (entry 0x00006500) 20:08:02 executing program 3: socket$rds(0x15, 0x5, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, &(0x7f0000000400)) syz_open_dev$admmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0xe00) 20:08:02 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r3, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:02 executing program 5: socket$rds(0x15, 0x5, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000400)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0xe00) 20:08:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") socket$inet6(0xa, 0x80001, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) prctl$PR_SET_UNALIGN(0x6, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = getpid() ioctl$sock_inet_SIOCGIFADDR(r3, 0x8915, &(0x7f0000000300)={'veth0_Wo_hsr\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x13}}}) getpriority(0x0, r4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x11) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000180)=0x14) gettid() clock_getres(0x1000000000047, 0x0) sendto$inet(r3, 0x0, 0xffffffe3, 0x20000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @multicast1}, 0x10) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f00000001c0)) sendto$inet(r3, &(0x7f0000000140)='I', 0x1, 0x4007ffd, 0x0, 0x0) [ 188.687188] FAT-fs (loop2): Filesystem has been set read-only [ 188.726257] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006500) [ 188.753738] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006500) 20:08:03 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='gid_map\x00') read(r0, 0x0, 0x0) [ 188.810427] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006500) 20:08:03 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0xffffffffffffffc8, 0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x100000041}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:08:03 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) finit_module(0xffffffffffffffff, &(0x7f0000000180)='nodev!:\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000280)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) readv(r0, &(0x7f00000025c0)=[{0x0}, {&(0x7f0000001400)=""/171, 0xab}], 0x2) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r1, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1, 0x6, 0x8, 0x80000001}) 20:08:03 executing program 4: bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x40, 0x20000) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000100)={0xffffffffffff152e, 0x0, 0x100000000, 0x4, 0x7f}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = syz_open_procfs(0x0, &(0x7f0000000840)='net/ip6_flowlabel\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r3, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r3, 0x5) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = accept4(r3, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:08:03 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0xffffffffffffffc8, 0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x100000041}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:08:03 executing program 1: 20:08:03 executing program 1: 20:08:03 executing program 5: 20:08:04 executing program 3: 20:08:04 executing program 1: 20:08:04 executing program 4: 20:08:04 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0xffffffffffffffc8, 0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x100000041}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:08:04 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect(r1, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) close(r0) 20:08:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000100)={0x0, 0x0}) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035b4db5bb358227ccdc45b4d4523bc7d2bfc7e2db050a0faebd3e3adc16273b855a09a968d540d75401f2808abf4f53c91625d2e1da462a9ae4d67669c3d55b995f858cb63e0c0d920fdbf3ee2383ce9d6c139c1d54c590f059aab46c364f5cf64ea4041cf"], 0x165) r2 = perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000a40)=""/129, 0x81}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/213, 0xd5}, {&(0x7f0000000cc0)=""/120, 0x78}, {&(0x7f0000000200)=""/54, 0x36}], 0x5}, 0x101}], 0x1, 0x40002002, &(0x7f0000000440)={0x0, 0x989680}) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r3, 0x0, &(0x7f00000003c0)='*\x00', &(0x7f0000000400)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000700), &(0x7f0000000740)=0x8) unlink(&(0x7f0000000040)='./bus\x00') ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f00000000c0)=0x6) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x3fe) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000500)) mkdir(&(0x7f00000008c0)='./file1\x00', 0x0) 20:08:04 executing program 4: 20:08:04 executing program 1: 20:08:04 executing program 3: 20:08:04 executing program 3: 20:08:04 executing program 4: 20:08:04 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000001340)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x4) 20:08:04 executing program 5: 20:08:04 executing program 3: 20:08:04 executing program 5: 20:08:04 executing program 0: 20:08:04 executing program 4: 20:08:05 executing program 2: 20:08:05 executing program 1: 20:08:05 executing program 3: 20:08:05 executing program 0: 20:08:05 executing program 5: 20:08:05 executing program 4: 20:08:05 executing program 3: r0 = socket$inet6(0xa, 0x40000000000005, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr="90ab9798f8a5c635cd92be149757a49d"}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3405000000000000]}, 0x7}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000100), &(0x7f0000000140)=0x4) 20:08:05 executing program 0: r0 = gettid() r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0xfffffffffffffefa) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, 0x0, 0x0) r2 = add_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$invalidate(0x15, r2) keyctl$setperm(0x5, r2, 0x400) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, 0x0, 0x0) tkill(r0, 0x1000000000016) 20:08:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00003b9fdc)) r3 = syz_open_pts(r2, 0x4000000000000002) r4 = dup3(r3, r1, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000280)='~', 0x1}], 0x1) ioctl$TCXONC(r4, 0x540a, 0x1) 20:08:05 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x5c65, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x7ffc) 20:08:05 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") exit(0x0) 20:08:05 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) close(r0) accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008d80)=[{{&(0x7f0000004b80)=@nl, 0x80, &(0x7f0000006100), 0x0, &(0x7f0000006140)=""/105, 0x69}}], 0x8000000000003bf, 0x0, 0x0) 20:08:05 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:05 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:05 executing program 4: syz_open_dev$sndseq(&(0x7f0000000600)='/dev/snd/seq\x00', 0x0, 0x0) [ 191.075270] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:08:05 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) setsockopt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) 20:08:05 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) [ 191.146725] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:08:05 executing program 3: socket$kcm(0x2, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'ifb0\x00', 0x400}) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) r2 = socket$kcm(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8922, &(0x7f0000000000)={'ip6tnl0\x00', @empty=[0x48]}) 20:08:05 executing program 0: r0 = memfd_create(&(0x7f0000000180)='\vem1\xc1\xf8\xa6\x8dL\xc4J\x80\x89K\xf6w\xf3\x97\xac#*\x7f{\x16\xe1\v\xbb\x91gu\x88_[)i\xe1MK_S#%\xd8\x82h\xe2\x1f\xd4\xd6\x80!\xcb`\xbc\xaa%\xed*\xc4\x9fU\"\xa7\xe5SK8\xe5b\xaf^\x02\xb8-Hr\x13\b7\x80\xe0\xb2\xaf\xb6\x98\x02J\xed\x1d\x9cO\x15m\'\xd2\xa2AI\xdb \xc8\x85\xf9\x93\xe0^A{\x8av\xbb{\t\xd3\xf1b\x83\xb4\xa9\x894\xb9m\x8f\x8e:2L\x06J\xf8\xde\xd0nRA\x8d\x8c\xf9\x1cT\x10\x94\x9a\x90\xc6\x87*zBX\xca\x00\xdc\x1b}\xfe\x97\x1al\xdd\xa9 \x18\xcf\xc7\r\xae\xc8 \xb2\x81\xb4\xf6\xa6\xd7$\xda\xc3\x1fN\x8d\x85-%M\xed\xff\x13\x9e\x02\x1e\x9a', 0x0) write(r0, &(0x7f0000000000)="e0ff", 0x2) 20:08:05 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:05 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:06 executing program 5: r0 = socket(0x1e, 0x1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, 0x80000000) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:06 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000400)={0x11, 0x10, 0xfa00, {0x0}}, 0x18) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 20:08:06 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='veth0_to_team\x00', 0x10) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0xfff6) 20:08:06 executing program 0: syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800000000002800) 20:08:06 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:06 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) recvmmsg(r0, &(0x7f0000009200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x100, 0x0) sendmsg$can_bcm(r0, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x5, 0xf, 0x0, {0x0, 0x7530}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "2d0c14c91ef86f03"}}, 0x48}}, 0x0) 20:08:06 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) write$evdev(r0, 0x0, 0x0) 20:08:06 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') ftruncate(r0, 0x3) 20:08:06 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x1000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000340)={0x0, 0x2}, &(0x7f0000000380)=0x8) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06055c8, &(0x7f0000000040)={0x7, 0x200, {0x56, 0x2, 0x1f, {0x9, 0xfffffffffffffbff}, {0xdc9, 0xfffffffffffffffa}, @rumble={0xab, 0x9}}, {0x51, 0x10001, 0x101, {0x10000, 0x5}, {0x8000, 0xa8}, @cond=[{0xfff, 0x8, 0x7ff, 0x7, 0x3, 0x7fff}, {0x2, 0x40, 0x6, 0x4, 0x80, 0x3f3}]}}) bind(0xffffffffffffffff, 0x0, 0x0) unshare(0x40000000) r2 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="37153117a99f143fa33b4eb5c4ab74b2a4b1ede98a565cad944ab30c7cf356e7dceae7033c9a00d562db2b9ae7e506ab2baa7005df4fabfaafd7be32686b9cc768205c976418307c4d0ab8f2dd2e7dc043fb6a7593319b0822", 0x59, 0x0) r3 = add_key(&(0x7f0000000200)='big_key\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f0000000280)="f3dd514a22c89f9f", 0x8, 0xfffffffffffffff9) keyctl$instantiate(0xc, r2, &(0x7f00000001c0)=@encrypted_update={'update ', 'default', 0x20, 'user:', 'vmnet0'}, 0x1b, r3) 20:08:06 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) write$evdev(r0, 0x0, 0x0) 20:08:06 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') ftruncate(r0, 0x3) 20:08:06 executing program 5: r0 = socket(0x1e, 0x1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, 0x80000000) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) recvmmsg(r0, &(0x7f0000009200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x100, 0x0) sendmsg$can_bcm(r0, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x5, 0xf, 0x0, {0x0, 0x7530}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "2d0c14c91ef86f03"}}, 0x48}}, 0x0) 20:08:06 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') ftruncate(r0, 0x3) 20:08:06 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1}}, 0x0) 20:08:06 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) write$evdev(r0, 0x0, 0x0) 20:08:06 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) 20:08:07 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) ftruncate(0xffffffffffffffff, 0x3) 20:08:07 executing program 2: read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(0xffffffffffffffff, 0x0, 0x0) 20:08:07 executing program 2: read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(0xffffffffffffffff, 0x0, 0x0) 20:08:07 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) ftruncate(0xffffffffffffffff, 0x3) 20:08:07 executing program 0: r0 = socket(0x1e, 0x1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, 0x80000000) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:07 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) 20:08:07 executing program 5: r0 = socket(0x1e, 0x1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, 0x80000000) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:07 executing program 3: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) 20:08:07 executing program 2: read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(0xffffffffffffffff, 0x0, 0x0) 20:08:07 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) ftruncate(0xffffffffffffffff, 0x3) 20:08:07 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) 20:08:07 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:07 executing program 3: r0 = socket(0x1e, 0x1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, 0x80000000) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:07 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) 20:08:07 executing program 0: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgrp(0x0) capget(&(0x7f0000000000)={0x20071026, r0}, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x0, 0xfffffffffffffbff}) tgkill(0x0, 0x0, 0x0) 20:08:08 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) [ 193.849167] capability: warning: `syz-executor.0' uses deprecated v2 capabilities in a way that may be insecure 20:08:08 executing program 5: r0 = socket(0x1e, 0x1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, 0x80000000) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:08 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:08 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:08 executing program 0: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) memfd_create(0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='veth0_to_team\x00', 0x10) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0xfff6) 20:08:08 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:08 executing program 1: rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:08 executing program 3: fallocate(0xffffffffffffffff, 0x4, 0x0, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCCONS(r0, 0x541d) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x80800, 0x0) finit_module(r2, &(0x7f0000000180)='nodev!:\x00', 0x2) r3 = fcntl$dupfd(r2, 0x0, r1) dup3(r0, r0, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x12002, 0x0) gettid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) readv(r4, &(0x7f00000025c0)=[{&(0x7f0000000240)=""/196, 0xc4}, {0x0}, {&(0x7f0000001400)=""/171, 0xab}, {&(0x7f00000014c0)=""/222, 0xde}], 0x4) r5 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r5, &(0x7f0000000180)=ANY=[@ANYBLOB="85e07722da70e15cc0ade98b9deda2555a3afa1317ea1aa37ef10d62c7d12b48126e0225e63cc7a4231d15db81b233a1fcbb88586aa761156c76689870efb73458a6e8c8f3bcd9b9fce6b808db9581cc8a961c388c9e63fe4ee3f41c3ea91a5c3e62118de08a74ffe8b1a1c0f5f5d19b3a4a18a7771564785422c84baa769b53f3556b4e5bbc785c4758c4083dedc6b6b05156b3f7"], 0x95) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r4, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x6, 0x8, 0x80000001}) 20:08:08 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:08 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') 20:08:08 executing program 1: rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:08 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x7, 0x1, 0x30}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x48) [ 194.704256] FAT-fs (loop3): bogus number of reserved sectors [ 194.751636] FAT-fs (loop3): Can't find a valid FAT filesystem 20:08:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000180)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$FUSE_LSEEK(0xffffffffffffffff, 0x0, 0x0) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0xffffffff00000001}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000002c0)={r1, 0xeac}, &(0x7f0000000300)=0x8) sched_setaffinity(0x0, 0xfffffffffffffff8, &(0x7f0000000140)=0x40000000000009) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000)) r2 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c, 0x0, 0x0, 0x0, 0x7ffffffffffc, 0x0, 0x0, 0x0, 0x44b, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) shmget$private(0x0, 0x3000, 0x562, &(0x7f0000ffd000/0x3000)=nil) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000200)={0x28, 0x2, 0x0, {0x5, 0x607b, 0x1}}, 0x28) clone(0x4000, &(0x7f0000000380), 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000343ff8)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) clone(0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x40000009, 0x0) 20:08:09 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:09 executing program 1: rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:09 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') 20:08:09 executing program 0: fallocate(0xffffffffffffffff, 0x4, 0x0, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCCONS(r0, 0x541d) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x80800, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) finit_module(r2, &(0x7f0000000180)='nodev!:\x00', 0x2) r3 = fcntl$dupfd(r2, 0x0, r1) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x12002, 0x0) gettid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) readv(r4, &(0x7f00000025c0)=[{&(0x7f0000000240)=""/196, 0xc4}, {0x0}, {&(0x7f0000001400)=""/171, 0xab}, {&(0x7f00000014c0)=""/222, 0xde}], 0x4) r5 = creat(&(0x7f0000000140)='./file0\x00', 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) fallocate(r5, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r5, &(0x7f0000000180)=ANY=[@ANYBLOB="85e07722da70e15cc0ade98b9deda2555a3afa1317ea1aa37ef10d62c7d12b48126e0225e63cc7a4231d15db81b233a1fcbb88586aa761156c76689870efb73458a6e8c8f3bcd9b9fce6b808db9581cc8a961c388c9e63fe4ee3f41c3ea91a5c3e62118de08a74ffe8b1a1c0f5f5d19b3a4a18a7771564785422c84baa769b53f3556b4e5bbc785c4758c4083dedc6b6b05156"], 0x93) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r4, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x6, 0x8, 0x80000001}) ioctl$DRM_IOCTL_CONTROL(r5, 0x40086414, &(0x7f0000002880)={0x3, 0xfffffffffffff005}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x80) 20:08:09 executing program 3: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c65, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000000), 0x8) 20:08:09 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8), 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:09 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:09 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') 20:08:09 executing program 3: syz_execute_func(&(0x7f00000000c0)="f3e100def9575c8ac2c2c9734e424a2664f0ff064a460f3038082e67660e50e94d00c9c9c4625dbae5feabc4aba39ddf4507e50c420fae9972b571112d02") r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070") 20:08:09 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0x1b, &(0x7f0000000300)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) [ 195.394311] FAT-fs (loop0): bogus number of reserved sectors [ 195.411897] FAT-fs (loop0): Can't find a valid FAT filesystem 20:08:09 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8), 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:09 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:09 executing program 5: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sched_setscheduler(0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='veth0_to_team\x00', 0x10) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0x0) 20:08:09 executing program 0: fallocate(0xffffffffffffffff, 0x4, 0x0, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCCONS(r0, 0x541d) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x80800, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) finit_module(r2, &(0x7f0000000180)='nodev!:\x00', 0x2) r3 = fcntl$dupfd(r2, 0x0, r1) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x12002, 0x0) gettid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) readv(r4, &(0x7f00000025c0)=[{&(0x7f0000000240)=""/196, 0xc4}, {0x0}, {&(0x7f0000001400)=""/171, 0xab}, {&(0x7f00000014c0)=""/222, 0xde}], 0x4) r5 = creat(&(0x7f0000000140)='./file0\x00', 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) fallocate(r5, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r5, &(0x7f0000000180)=ANY=[@ANYBLOB="85e07722da70e15cc0ade98b9deda2555a3afa1317ea1aa37ef10d62c7d12b48126e0225e63cc7a4231d15db81b233a1fcbb88586aa761156c76689870efb73458a6e8c8f3bcd9b9fce6b808db9581cc8a961c388c9e63fe4ee3f41c3ea91a5c3e62118de08a74ffe8b1a1c0f5f5d19b3a4a18a7771564785422c84baa769b53f3556b4e5bbc785c4758c4083dedc6b6b05156"], 0x93) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r4, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x6, 0x8, 0x80000001}) ioctl$DRM_IOCTL_CONTROL(r5, 0x40086414, &(0x7f0000002880)={0x3, 0xfffffffffffff005}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x80) 20:08:09 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8), 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:09 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(r0, 0x0, 0x0) 20:08:09 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:09 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, 0x0) setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:09 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, 0x0, 0x0) write$evdev(r0, 0x0, 0x0) 20:08:10 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, 0x0, 0x0) write$evdev(r0, 0x0, 0x0) 20:08:10 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) sendto(0xffffffffffffffff, &(0x7f0000000280)="30f720f2f405328bb57256e5caba0087defd473d36f6a6cde27c5467ded26b1a1bbdc33db9b7890d6f9a5631b6b4eae939fbc90f70c593065800dc607f67d79cacdaa61aec095fd04a74b828ca530f3575bd6027ee35489e4a928816da315bcda084fd95f64e8ef011b8fb47dd12834c7a260a3ebd47f3769d885ee815e8685436f5ecbb354042114c1235b58dcb20e6b82aa508701ce747fdfd7e349808886ac8567edd9ed1", 0xa6, 0x2000c000, 0x0, 0x0) 20:08:10 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:10 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, 0x0, 0x0) write$evdev(r0, 0x0, 0x0) 20:08:10 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, 0x0) setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:10 executing program 0: socket$key(0xf, 0x3, 0x2) r0 = socket$inet(0x2, 0x1, 0x0) dup(0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0xfffffffffffffec7) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x87f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x0, 0x0, 0x4, 0x0) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) ioctl$BLKIOMIN(0xffffffffffffffff, 0x1278, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) getgid() socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000280)={0x2, 0x4e23}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp\x00') sendfile(r0, r1, 0x0, 0x80000003) 20:08:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11036, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1d0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x35c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(0x0, r0, 0x2, 0xffffffffffffffff, 0x1) 20:08:10 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(0xffffffffffffffff, 0x0, 0x0) 20:08:10 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, 0x0) setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:10 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) read(0xffffffffffffffff, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:10 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x0, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11036, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1d0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x35c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(0x0, r0, 0x2, 0xffffffffffffffff, 0x1) 20:08:10 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(0xffffffffffffffff, 0x0, 0x0) 20:08:10 executing program 3: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_ro(r1, 0x0, 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0xa, 0x5, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000100)) sendmsg(r2, &(0x7f0000000400)={&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @local}, 0x80, 0x0}, 0x4040040) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={r0, 0x68, &(0x7f0000000200)}, 0xffa9) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x9, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000140)='syzkaller\x00', 0x6f1a, 0xfb, &(0x7f00000003c0)=""/251, 0x0, 0x0, [], 0x0, 0xd}, 0x48) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={r4, r3, 0xd}, 0x10) socket$kcm(0x29, 0x0, 0x0) 20:08:10 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) read(0xffffffffffffffff, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:10 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x0, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:10 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x2, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e999) write$evdev(0xffffffffffffffff, 0x0, 0x0) 20:08:10 executing program 0: socket$key(0xf, 0x3, 0x2) r0 = socket$inet(0x2, 0x1, 0x0) dup(0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0xfffffffffffffec7) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x87f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x0, 0x0, 0x4, 0x0) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) ioctl$BLKIOMIN(0xffffffffffffffff, 0x1278, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) getgid() socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000280)={0x2, 0x4e23}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp\x00') sendfile(r0, r1, 0x0, 0x80000003) 20:08:10 executing program 3: clone(0x20008577, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x2a4506, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 20:08:10 executing program 5: openat$fuse(0xffffffffffffff9c, &(0x7f0000000240)='/dev/fuse\x00', 0x2, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:10 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x0, &(0x7f0000011000)) ftruncate(r0, 0x3) 20:08:10 executing program 2: creat(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='proc\x00', 0x0, &(0x7f00000001c0)='n\xa86\x8a\x9b\xf8]\xc5\x06c\x9a\x11e!\xad?\x9ate\xe9\xf2c\xceZ%\x9a\x00\xcb\bY\x8f\x9e\xcb\x9a \xe0\x7f^\x03c\xd8\x8f\t\xe9\xe0\xea\fY6\n\xda\xfe\x86l\xcc\r<\xfc\xf11\x15\x9d:)O{\xbf\xea\xe1\xc68*$?\xb5}9\x02\xf3E\xb8)bX\x88c\xe5:TE\x9b\xfe\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x82\x00\x00\x00\x00\x00l\x00W\xe6XT\\l\xd6J\xf2\x12\xc4\x9e\xd4\xbe8<\v\x868%l0\xa1%\xb3\x1b,g\x8d\xfa\x8dq&\xc4\xc0\x81\x9a\x91\x9e\xe3\xe6\xa6\xd8\xb80\xe4NW=\x10\x8d\xcc\xcbU\x1dg\xd9\xc5\xb1\x94\x95\x10\xe3\xe8\xa8\xbfW\x00\x16\x90o=\x80`\xe2\xd1\xb2\xac\x92\x95F\xc0\xb5$\xe3\x1f7T\xe7\xd6A\x8b\x11Qx\xa0\xa4\xa2_h\xcc\xe0\nXpo\x9f=\xa4\xff\xaf\xb4\x02P\xaa\r46X\x8b\xfb\xc7/\x8b\xa5\x06\x11\xc9\x0fl') 20:08:10 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) read(0xffffffffffffffff, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:11 executing program 3: sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) close(r0) accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008d80)=[{{&(0x7f0000004b80)=@nl, 0x80, &(0x7f0000006100), 0x0, &(0x7f0000006140)=""/105, 0x69}}], 0x8000000000003bf, 0x0, 0x0) 20:08:11 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, 0x0) ftruncate(r0, 0x3) 20:08:11 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = dup2(r0, 0xffffffffffffffff) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:11 executing program 2: r0 = memfd_create(&(0x7f0000000040)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="d4", 0x1}], 0x1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x80001a}) lseek(r0, 0x0, 0x4) 20:08:11 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, 0x0) ftruncate(r0, 0x3) [ 196.853352] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:08:11 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000000)) close(r0) syz_emit_ethernet(0x0, &(0x7f0000000100)=ANY=[], 0x0) add_key(&(0x7f00000003c0)='.request_key_auth\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) request_key(0x0, &(0x7f0000000640)={'syz', 0x1}, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'eql\x00', {0x2, 0x0, @local}}) r1 = add_key$keyring(&(0x7f00000007c0)='keyring\x00', &(0x7f0000000800)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(0x0, 0x0, 0x0, 0xfffffffffffffe4f, r1) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @dev}}, 0x0, 0x0, 0x0, "adf44589f0aec597b8c996de7e4b14f5ee87ceaac4b2f6e95843200a65db02f2c6be7c39a342f1dcf21fa80e1d30e553738d587dc2a5215fa34bdfa7fe22b551cba800abdc33262da9d3be9c8c61d911"}, 0xd8) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x394) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) clone(0x70024100, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) [ 196.949742] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:08:11 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, 0x0) ftruncate(r0, 0x3) 20:08:11 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000500)={'sit0\x00\x00\x00\x00\x00\x00\x00\xd6\x00'}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141}) clock_nanosleep(0x0, 0x1, &(0x7f00000004c0)={0x77359400}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000300)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f0000001700)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) [ 197.038971] audit: type=1400 audit(1556136491.233:46): avc: denied { sys_admin } for pid=8402 comm="syz-executor.0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 197.101105] device sit0 entered promiscuous mode [ 197.941113] IPVS: ftp: loaded support on port[0] = 21 20:08:13 executing program 5: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) openat$null(0xffffffffffffff9c, 0x0, 0x606800, 0x0) fcntl$lock(r0, 0x24, &(0x7f0000004a00)={0x0, 0x0, 0x4, 0x1}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2000, 0x105086) r2 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r0, r1, 0x0, 0x102000002) 20:08:13 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = dup2(r0, 0xffffffffffffffff) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:13 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(0xffffffffffffffff, 0x3) 20:08:13 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) clone(0x0, 0x0, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x40000009, 0x0) 20:08:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x2000000088) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x10) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000080)="ee", 0x1) recvmmsg(r0, &(0x7f0000000180), 0x400000000000370, 0x6, &(0x7f0000000100)={0x77359400}) 20:08:13 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000000)) close(r0) syz_emit_ethernet(0x0, &(0x7f0000000100)=ANY=[], 0x0) add_key(&(0x7f00000003c0)='.request_key_auth\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) request_key(0x0, &(0x7f0000000640)={'syz', 0x1}, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'eql\x00', {0x2, 0x0, @local}}) r1 = add_key$keyring(&(0x7f00000007c0)='keyring\x00', &(0x7f0000000800)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(0x0, 0x0, 0x0, 0xfffffffffffffe4f, r1) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @dev}}, 0x0, 0x0, 0x0, "adf44589f0aec597b8c996de7e4b14f5ee87ceaac4b2f6e95843200a65db02f2c6be7c39a342f1dcf21fa80e1d30e553738d587dc2a5215fa34bdfa7fe22b551cba800abdc33262da9d3be9c8c61d911"}, 0xd8) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x394) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) clone(0x70024100, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) 20:08:14 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(0xffffffffffffffff, 0x3) 20:08:14 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3}) r1 = dup2(r0, 0xffffffffffffffff) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:14 executing program 2: r0 = openat$vfio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) openat$null(0xffffffffffffff9c, 0x0, 0x606800, 0x0) fcntl$lock(r1, 0x24, &(0x7f0000004a00)={0x0, 0x4, 0x4, 0x1}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x105086) r3 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x81003) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000d00)=ANY=[@ANYBLOB="00000000e0000001ff000000000000ffaaaaaaaaaabb0000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000ff00000000ff000000000000000000000008098a80010007000400007465616d300000000000000000000000726f736530000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000420100000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000395fac10003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0003401000000000000000000000000000000000000000000000000000044004c454400000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000500000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00040010000"], 0x1) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r1, r2, 0x0, 0x102000002) 20:08:14 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='gid_map\x00') 20:08:14 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(0xffffffffffffffff, 0x3) 20:08:14 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:14 executing program 5: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) openat$null(0xffffffffffffff9c, 0x0, 0x606800, 0x0) fcntl$lock(r0, 0x24, &(0x7f0000004a00)={0x0, 0x0, 0x4, 0x1}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2000, 0x105086) r2 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r0, r1, 0x0, 0x102000002) 20:08:14 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x0) 20:08:14 executing program 3: r0 = openat$vfio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) openat$null(0xffffffffffffff9c, 0x0, 0x606800, 0x0) fcntl$lock(r1, 0x24, &(0x7f0000004a00)={0x0, 0x4, 0x4, 0x1}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2000, 0x105086) r3 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r3, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000d00)=ANY=[@ANYBLOB="00000000e0000001ff000000000000ffaaaaaaaaaabb0000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000ff00000000ff000000000000000000000008098a80010007000400007465616d300000000000000000000000726f736530000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000420100000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000395fac10003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0003401000000000000000000000000000000000000000000000000000044004c454400000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000500000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000aaaaaaaaaabb000000000000000000002153b279be6800000000000000000000e00000020000000004000000ffffffff00"/1072], 0x1) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r1, r2, 0x0, 0x102000002) 20:08:14 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:14 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x0) 20:08:14 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000000)) close(r0) syz_emit_ethernet(0x0, &(0x7f0000000100)=ANY=[], 0x0) add_key(&(0x7f00000003c0)='.request_key_auth\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) request_key(0x0, &(0x7f0000000640)={'syz', 0x1}, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'eql\x00', {0x2, 0x0, @local}}) r1 = add_key$keyring(&(0x7f00000007c0)='keyring\x00', &(0x7f0000000800)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(0x0, 0x0, 0x0, 0xfffffffffffffe4f, r1) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @dev}}, 0x0, 0x0, 0x0, "adf44589f0aec597b8c996de7e4b14f5ee87ceaac4b2f6e95843200a65db02f2c6be7c39a342f1dcf21fa80e1d30e553738d587dc2a5215fa34bdfa7fe22b551cba800abdc33262da9d3be9c8c61d911"}, 0xd8) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x394) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) clone(0x70024100, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) 20:08:14 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x10, &(0x7f0000000340)={&(0x7f0000000640)=""/4096, 0x1000}}, 0x10) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:14 executing program 1: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') setrlimit(0x1, &(0x7f0000011000)) ftruncate(r0, 0x0) 20:08:15 executing program 2: r0 = openat$vfio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) openat$null(0xffffffffffffff9c, 0x0, 0x606800, 0x0) fcntl$lock(r1, 0x24, &(0x7f0000004a00)={0x0, 0x4, 0x4, 0x1}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x105086) r3 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x81003) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000d00)=ANY=[@ANYBLOB="00000000e0000001ff000000000000ffaaaaaaaaaabb0000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000ff00000000ff000000000000000000000008098a80010007000400007465616d300000000000000000000000726f736530000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000420100000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000395fac10003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0003401000000000000000000000000000000000000000000000000000044004c454400000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000500000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00040010000"], 0x1) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r1, r2, 0x0, 0x102000002) 20:08:15 executing program 3: r0 = openat$vfio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0xa) nanosleep(0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) openat$null(0xffffffffffffff9c, 0x0, 0x606800, 0x0) fcntl$lock(r1, 0x24, &(0x7f0000004a00)={0x0, 0x4, 0x4, 0x1}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2000, 0x105086) r3 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r3, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000d00)=ANY=[@ANYBLOB="00000000e0000001ff000000000000ffaaaaaaaaaabb0000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000ff00000000ff000000000000000000000008098a80010007000400007465616d300000000000000000000000726f736530000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000420100000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000395fac10003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0003401000000000000000000000000000000000000000000000000000044004c454400000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000500000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000aaaaaaaaaabb000000000000000000002153b279be6800000000000000000000e00000020000000004000000ffffffff00"/1072], 0x1) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r1, r2, 0x0, 0x102000002) 20:08:15 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup\x00\x06\"\xce[\x94:\xc1F\xd4\xb7^\v\x1e;\xed\xc1\xe9\xd00x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000000440)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000640)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000480)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000740)={{{@in6=@mcast2, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast2}}, &(0x7f0000000840)=0xe8) setresuid(r4, r5, r6) exit(0xfffffffffffffffd) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000200)='trusted.overlay.upper\x00', &(0x7f0000000140)=ANY=[@ANYRESHEX=r2], 0x1, 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x40) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000000440)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000640)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000480)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000740)={{{@in6=@mcast2, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast2}}, &(0x7f0000000840)=0xe8) setresuid(r4, r5, r6) exit(0xfffffffffffffffd) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000200)='trusted.overlay.upper\x00', &(0x7f0000000140)=ANY=[@ANYRESHEX=r2], 0x1, 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x40) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x2, 0xf0ffffffffffff}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) 20:08:20 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:20 executing program 5: 20:08:20 executing program 0: 20:08:20 executing program 5: 20:08:20 executing program 1: 20:08:20 executing program 2: 20:08:20 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:20 executing program 3: 20:08:20 executing program 0: 20:08:20 executing program 5: 20:08:20 executing program 1: 20:08:20 executing program 2: 20:08:20 executing program 3: 20:08:20 executing program 0: 20:08:20 executing program 5: 20:08:20 executing program 1: 20:08:20 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:20 executing program 2: 20:08:20 executing program 0: 20:08:20 executing program 3: 20:08:20 executing program 5: 20:08:20 executing program 1: 20:08:20 executing program 3: 20:08:20 executing program 0: 20:08:20 executing program 2: 20:08:20 executing program 5: 20:08:20 executing program 1: 20:08:20 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:20 executing program 3: 20:08:20 executing program 2: 20:08:20 executing program 0: 20:08:20 executing program 5: 20:08:20 executing program 1: 20:08:20 executing program 2: 20:08:20 executing program 3: 20:08:20 executing program 5: 20:08:20 executing program 0: 20:08:21 executing program 1: 20:08:21 executing program 2: 20:08:21 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:21 executing program 3: 20:08:21 executing program 5: 20:08:21 executing program 0: 20:08:21 executing program 1: 20:08:21 executing program 2: 20:08:21 executing program 5: 20:08:21 executing program 3: 20:08:21 executing program 1: 20:08:21 executing program 0: 20:08:21 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:21 executing program 5: 20:08:21 executing program 3: 20:08:21 executing program 2: 20:08:21 executing program 1: 20:08:21 executing program 0: 20:08:21 executing program 5: 20:08:21 executing program 3: 20:08:21 executing program 1: 20:08:21 executing program 2: 20:08:21 executing program 0: 20:08:21 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r0, 0x6, 0x1, &(0x7f0000000100), 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) 20:08:21 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) connect$unix(r1, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x5) syz_execute_func(&(0x7f0000000000)="410f01f9c4e1f573d50664ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110d4b842419dcccc") sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) 20:08:21 executing program 1: 20:08:21 executing program 2: 20:08:21 executing program 0: 20:08:21 executing program 2: 20:08:21 executing program 1: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x0, 0x0}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) 20:08:21 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:21 executing program 0: openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) set_mempolicy(0x1, 0x0, 0x0) 20:08:21 executing program 2: bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000100)={0xffffffffffff152e, 0x0, 0x0, 0x4, 0x7f}) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000000c0)={'bridge_slave_0\x00', {0x2, 0x0, @broadcast}}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r2, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001}, 0x98) 20:08:21 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:21 executing program 0: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000440)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x92\xee2\xc2$Wx\x15^\xdaM\xeaB\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WZ;\xce\x05\xfc\x95\xd9\x88\x1f|\x8b\xf1\xbf\xf2u\xdd\xd8AV\xd87\x96M\xea\xd2\xa2iM\xe9\xa1\xbc\xba}\xbe\xa1\x05J\"\f\xf9\b\xcf\xb8J\x13#\xecT\xdf\xe0\x9dOA>\xe9\x99\xf8\xaf@{dw\b\xe7{\xaf\x9a\x1e3\xc1\x83&\x89\xc2\xa5\xb1\xe2NN\xdf\xd3\x0f{\x8c\xc1\xc8y\x01\x04\x00\xc7\x94\xe3\x89|\xd7\x9f\xd3\x06\x17\xe6]\xd7\x81q\x1d\x1dN\x9e\xf4c\x83\x86_\xfc\xbc\xdd\xd4{\xde\xc4\xe5\xb6\b;L\x1cN\xa2\xc9k\xd7 \xc3\xe4\x19\x96\x8c\x04\xea\x9c9\xfa\xe3\xc1\x8dDuTHL\n\xe8\xb7oSx\'\xfd=\xfc\xa4\xa51\b\x02j\xb7\x98{`\x89\x8c\xd3\xc6\xe8\xe2\x9b\xd7\xab\xd1s\xfb\xaa\xcd\x9d\xf1\x9e\xee\xe3e\xf1\x91\xf7\xee%\xf8\xc7G', 0x2761, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000040)=r1, 0xab) sendmsg(r0, &(0x7f0000000080)={&(0x7f00000003c0)=@in={0x2, 0x0, @loopback}, 0x73, 0x0}, 0x20000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r3 = socket$kcm(0x29, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000100)={r0, r2}) 20:08:22 executing program 5: clone(0x2102009ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000880)={{0x0, 0x1c9c380}, {0x0, 0x989680}}, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) readv(r1, &(0x7f0000000640)=[{&(0x7f0000000100)=""/53, 0x35}], 0x1) r2 = open$dir(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) dup3(r2, r1, 0x0) tkill(r0, 0x1000000000015) socket$inet6(0xa, 0x0, 0x0) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 1: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x0, 0x0}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) 20:08:22 executing program 2: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x0, 0x0}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) 20:08:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x294) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) syz_execute_func(&(0x7f0000000080)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f43cd08") clone(0x3102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='htcp\x00', 0x5) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000), 0x4) 20:08:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c523f319bd070") clone(0x80a102001ff8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$userio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/userio\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, 0x0, 0x0) 20:08:22 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000140), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xffffffffffffff7f, 0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 207.895599] misc userio: Invalid payload size 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 1: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x0, 0x0}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) chroot(&(0x7f00000003c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 3: setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x5) fremovexattr(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001}, 0x98) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fc, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='yeah\x00', 0x5) shutdown(r0, 0x0) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 1: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x2d) listen(r0, 0x25) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x14) 20:08:22 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x1320af) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @empty}, 0x1c) write$P9_RWRITE(r1, 0x0, 0x0) 20:08:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xced423) 20:08:22 executing program 1: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x2d) listen(r0, 0x25) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x14) 20:08:22 executing program 3: r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000037000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000380)="da8630000000b9ae0a0000b8615e8298ba000000000f30c4e1785b24d466baf80cb8bc89a88aef66bafc0cb003ee360f001e66ba420066b8028d66ef66baf80cb8e4b9618eef66bafc0ced660f38200c340fac3809660f3880ad00600000"}], 0x1, 0x0, 0x0, 0x376) 20:08:22 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000580)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}]}}) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:22 executing program 3: r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000037000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000380)="da8630000000b9ae0a0000b8615e8298ba000000000f30c4e1785b24d466baf80cb8bc89a88aef66bafc0cb003ee360f001e66ba420066b8028d66ef66baf80cb8e4b9618eef66bafc0ced660f38200c340fac3809660f3880ad00600000"}], 0x1, 0x0, 0x0, 0x376) 20:08:23 executing program 2: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000000)=@req={0x3fc, 0x0, 0x0, 0xfffffffffffffff7}, 0x10) recvmmsg(r0, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000100)=""/247, 0xf7}], 0x1}}], 0x1, 0x0, 0x0) 20:08:23 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/11, 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000001c0)) r1 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) syz_execute_func(&(0x7f00000006c0)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") clone(0x2102101ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000500)=""/53, 0x35}], 0x1}}], 0x1, 0x0, 0x0) ioctl$TCSETS2(r0, 0x402c542b, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) shutdown(r2, 0x0) 20:08:23 executing program 0: 20:08:23 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:23 executing program 5: clone(0x80a102001ff8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$userio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/userio\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, 0x0, 0x0) 20:08:23 executing program 0: clone(0x208, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xb) r1 = creat(&(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x80000000000010c) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)) open$dir(&(0x7f0000000200)='./file0\x00', 0x841, 0x0) syz_execute_func(&(0x7f00000006c0)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, 0x0) 20:08:23 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 209.286840] misc userio: Invalid payload size 20:08:23 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:23 executing program 5: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) r0 = gettid() r1 = socket$inet(0x2, 0x0, 0x80) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f00000000c0)={{0x63, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x1, 'sed\x00', 0x10, 0x9df7, 0x5e}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e24, 0x2002, 0x5, 0xb6a, 0x8}}, 0x44) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0) 20:08:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000200), 0x11bc1f) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) msgrcv(0x0, 0x0, 0x0, 0x0, 0x0) msgctl$IPC_RMID(0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080), 0x4) 20:08:23 executing program 3: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') ptrace$getregset(0x4204, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=""/126, 0xb2}) writev(r1, &(0x7f0000000080), 0x1a6) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, r0, 0x2) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, 0x0) 20:08:23 executing program 2: 20:08:23 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x406, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:23 executing program 5: 20:08:23 executing program 3: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') ptrace$getregset(0x4204, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=""/126, 0xb2}) writev(r1, &(0x7f0000000080), 0x1a6) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, r0, 0x2) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, 0x0) 20:08:23 executing program 1: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') ptrace$getregset(0x4204, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=""/126, 0xb2}) writev(r1, &(0x7f0000000080), 0x1a6) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, r0, 0x2) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, 0x0) 20:08:24 executing program 5: 20:08:24 executing program 0: 20:08:24 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:24 executing program 2: 20:08:24 executing program 3: 20:08:24 executing program 5: 20:08:24 executing program 1: 20:08:24 executing program 5: 20:08:24 executing program 3: 20:08:24 executing program 1: 20:08:24 executing program 2: 20:08:24 executing program 0: 20:08:24 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:24 executing program 1: 20:08:24 executing program 3: 20:08:24 executing program 5: 20:08:24 executing program 0: 20:08:24 executing program 2: 20:08:24 executing program 3: 20:08:24 executing program 2: 20:08:24 executing program 1: 20:08:24 executing program 0: 20:08:24 executing program 5: 20:08:24 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:24 executing program 3: 20:08:24 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYRESDEC], 0x1) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x12) 20:08:24 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:24 executing program 0: syz_emit_ethernet(0x6e, &(0x7f0000000180)={@broadcast, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "f8e37f", 0x38, 0x2c, 0x0, @empty, @ipv4, {[@dstopts={0x3a, 0x0, [], [@padn]}], @udp={0x0, 0x0, 0x28, 0x0, [], "b27049c873d6c0dd98054b1b926ef1ce7cc0c7c9f7d7162a30c82f225ab35a72"}}}}}}, 0x0) 20:08:24 executing program 5: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_GETXATTR(r0, &(0x7f0000000280)={0x18}, 0x18) 20:08:24 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:24 executing program 0: request_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz'}, 0x0, 0xfffffffffffffffd) 20:08:24 executing program 3: mknod(&(0x7f0000000000)='./file0\x00', 0x8220, 0x2) prctl$PR_CAPBSET_READ(0x17, 0xf) r0 = semget(0xffffffffffffffff, 0x2, 0x0) semctl$IPC_RMID(0x0, 0x0, 0x0) socket(0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) lsetxattr$security_smack_entry(0x0, 0x0, 0x0, 0x0, 0x0) sigaltstack(&(0x7f0000ffc000/0x1000)=nil, 0x0) shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_UNLOCK(0x0, 0xc) connect$unix(0xffffffffffffffff, 0x0, 0x0) mknod(0x0, 0x0, 0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000300)=""/4096) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, 0x0) socket$nl_route(0x10, 0x3, 0x0) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) geteuid() getegid() fchown(0xffffffffffffffff, 0x0, 0x0) clock_gettime(0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) prctl$PR_SET_FPEMU(0xa, 0x0) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f00000014c0)=0x9) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000001500)={0x3ff, 0xf29}) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000001540)={0x6, 0x8, 0x0, 0xfffffffffffffff7, 0x8, 0x10001}) 20:08:24 executing program 1: creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) unlink(&(0x7f0000000040)='./file0\x00') creat(&(0x7f0000000080)='./file1\x00', 0x0) clone(0x200000100010a, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() rmdir(&(0x7f0000000180)='./file1\x00') ptrace(0x10, r0) creat(&(0x7f0000000000)='./file0\x00', 0x0) 20:08:24 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:24 executing program 0: socket$inet6(0xa, 0x0, 0x0) close(0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 20:08:24 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:24 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, 0x0) sched_setaffinity(0x0, 0x0, 0x0) arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x4000, &(0x7f0000000380), 0x0, 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x40000009, 0x0) 20:08:24 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:25 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x800000000000005, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000180)=@bpq0='bpq0\x00', 0x10) bind$ax25(r0, &(0x7f0000000280)={{0x3, @netrom}, [@netrom, @default, @default, @rose, @bcast, @default, @null, @rose]}, 0x48) connect$ax25(r0, &(0x7f0000000080)={{0x3, @default}, [@null, @rose, @null, @netrom, @remote, @netrom, @netrom, @netrom]}, 0x48) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom}, [@null, @null, @bcast, @remote, @netrom, @null, @netrom, @bcast]}, 0x48) [ 210.802037] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 210.836438] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de 20:08:25 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) read(r1, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:25 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ad56b6c5820000000000000000a5ddf7", 0x10) write$nbd(r1, &(0x7f00000001c0), 0x10) [ 210.875229] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de [ 210.901887] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de 20:08:25 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) [ 210.925745] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de [ 210.939218] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 20:08:25 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) dup2(r0, r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:25 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(0xffffffffffffffff, 0xc0485660, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x1fff8}], 0x1}, 0x0) 20:08:25 executing program 0: r0 = syz_init_net_socket$ax25(0x3, 0x800000000000005, 0x0) bind$ax25(r0, &(0x7f0000000280)={{0x3, @netrom}, [@netrom, @default, @default, @rose, @bcast, @default, @null, @rose]}, 0x48) 20:08:25 executing program 1: gettid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x50000}]}) getsockopt$inet_tcp_buf(0xffffffffffffff9c, 0x6, 0x0, 0x0, 0x0) 20:08:25 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) dup2(r0, r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:27 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:27 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) write$FUSE_LSEEK(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, 0x0, 0x0) syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c, 0x0, 0x0, 0x0, 0x7ffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x3000, 0x562, &(0x7f0000ffd000/0x3000)=nil) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) clone(0x4000, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x80a102001ff8, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) waitid(0x0, 0x0, 0x0, 0x40000009, 0x0) 20:08:27 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) dup2(r0, r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:27 executing program 0: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000001c0)={'rose0\x00', {0x2, 0x0, @empty}}) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1e) wait4(r0, 0x0, 0x40000002, 0x0) 20:08:27 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(0xffffffffffffffff, 0xc0485660, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x1fff8}], 0x1}, 0x0) 20:08:27 executing program 1: mount(0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000380)) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000280)={0xffffffff, {{0x2, 0x0, @empty}}}, 0x88) lsetxattr$security_selinux(&(0x7f0000001100)='./file0\x00', &(0x7f0000001140)='security.selinux\x00', &(0x7f0000001180)='system_u:object_r:gpg_agent_exec_t:s0\x00', 0x26, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000001c0)={'security\x00'}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[]}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 20:08:28 executing program 1: mount(0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000380)) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000280)={0xffffffff, {{0x2, 0x0, @empty}}}, 0x88) lsetxattr$security_selinux(&(0x7f0000001100)='./file0\x00', &(0x7f0000001140)='security.selinux\x00', &(0x7f0000001180)='system_u:object_r:gpg_agent_exec_t:s0\x00', 0x26, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000001c0)={'security\x00'}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[]}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 20:08:28 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:28 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(0xffffffffffffffff, 0xc0485660, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x1fff8}], 0x1}, 0x0) 20:08:28 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) sendto$inet(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4040801, 0x0, 0x0) 20:08:28 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:28 executing program 0: r0 = syz_init_net_socket$ax25(0x3, 0x800000000000005, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000180)=@bpq0='bpq0\x00', 0x10) bind$ax25(r0, &(0x7f0000000280)={{0x3, @netrom}, [@netrom, @default, @default, @rose, @bcast, @default, @null, @rose]}, 0x48) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom}, [@null, @null, @bcast, @remote, @netrom, @null, @netrom, @bcast]}, 0x48) ioctl$SIOCAX25GETINFO(r0, 0x89ed, &(0x7f0000000080)) [ 214.041864] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 214.052435] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de 20:08:30 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:30 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmctl$IPC_INFO(0x0, 0x3, &(0x7f00000000c0)=""/80) 20:08:30 executing program 0: r0 = socket$kcm(0x10, 0x80000000003, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000001d008108e00f80ecdb4cb9d91f63190408005b68000000fb120001000500000040d819a9060015000000", 0x2e}], 0x1}, 0x0) 20:08:30 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:30 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ad56b6c5820000000000000000a5ddf7", 0x10) write$nbd(r1, &(0x7f00000001c0), 0x10) 20:08:30 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can={0x1d, 0x0, 0x40000, 0x7b002000000000}, 0x8f940, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x2000000}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x40000, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) 20:08:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)="24000000130007041dfffd946f610500070000005f000000000002000800a3a20400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, 0x0) 20:08:31 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:08:31 executing program 5: fallocate(0xffffffffffffffff, 0x4, 0x0, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCCONS(r0, 0x541d) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x80800, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x12002, 0x0) gettid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) readv(r3, &(0x7f00000025c0)=[{0x0}, {&(0x7f0000001400)=""/171, 0xab}], 0x2) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) fallocate(r4, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="85e07722da70e15cc0ade98b9deda2555a3afa1317ea1aa37ef10d62c7d12b48126e0225e63cc7a4231d15db81b233a1fcbb88586aa761156c76689870efb73458a6e8c8f3bcd9b9fce6b808db9581cc8a961c388c9e63fe4ee3f41c3ea91a5c3e62118de08a74ffe8b1a1c0f5f5d19b3a4a18a7771564785422c84baa769b53f3556b4e5bbc785c4758c4083dedc6b6b05156b3f7d962"], 0x97) fallocate(r3, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0x0, r4, 0x6, 0x8, 0x80000001}) ioctl$DRM_IOCTL_CONTROL(r4, 0x40086414, &(0x7f0000002880)={0x3}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x80) 20:08:31 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000180)=@bpq0='bpq0\x00', 0x10) bind$ax25(r0, &(0x7f0000000280)={{}, [@netrom, @default, @default, @rose, @bcast, @default, @null, @rose]}, 0x48) connect$ax25(r0, &(0x7f0000000000)={{0x3, @bcast}, [@remote, @null, @bcast, @remote, @netrom, @null, @netrom, @bcast]}, 0x10) 20:08:31 executing program 3: r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) recvmmsg(r0, &(0x7f0000006b40)=[{{0x0, 0x0, &(0x7f0000005400)=[{&(0x7f0000005200)=""/127, 0x7f}], 0x1}}], 0x1, 0x20, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:31 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 216.917685] PF_BRIDGE: RTM_SETLINK with unknown ifindex [ 216.943686] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 216.984274] FAT-fs (loop5): bogus number of reserved sectors [ 217.001125] FAT-fs (loop5): Can't find a valid FAT filesystem [ 217.016205] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de 20:08:34 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:34 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(aes)\x00'}, 0x58) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000040)="0a0775db7b2803b4f0a12585675d26b0d5e383e5b3b60ced5c54dbb7295df0df8217ad62005127000000000000e60000", 0x30) dup3(r0, r1, 0x0) 20:08:34 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYRESDEC], 0x1) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x12) 20:08:34 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:08:34 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x9, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x14}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:08:34 executing program 3: r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f0000000140)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) recvmmsg(r0, &(0x7f0000006b40)=[{{0x0, 0x0, &(0x7f0000005400)=[{&(0x7f0000005200)=""/127, 0x7f}], 0x1}}], 0x1, 0x20, 0x0) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 20:08:34 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0) r0 = syz_open_dev$video(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x212001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) r2 = dup2(r0, r1) read(r2, &(0x7f00000000c0)=""/85, 0x321) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:08:34 executing program 5: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! .'], 0x4) close(r0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 20:08:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x0) 20:08:34 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) 20:08:34 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000180)=@bpq0='bpq0\x00', 0x10) bind$ax25(r0, &(0x7f0000000280)={{}, [@netrom, @default, @default, @rose, @bcast, @default, @null, @rose]}, 0x48) connect$ax25(r0, &(0x7f0000000000)={{0x3, @bcast}, [@remote, @null, @bcast, @remote, @netrom, @null, @netrom, @bcast]}, 0x48) connect$ax25(r0, &(0x7f0000000080)={{0x3, @null}, [@remote, @null, @remote, @rose, @netrom, @null, @default]}, 0x48) 20:08:34 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000180)=@bpq0='bpq0\x00', 0x10) bind$ax25(r0, &(0x7f0000000280)={{}, [@netrom, @default, @default, @rose, @bcast, @default, @null, @rose]}, 0x48) connect$ax25(r0, &(0x7f0000000000)={{0x3, @bcast, 0x5}, [@rose, @null, @bcast, @remote, @netrom, @null, @netrom, @bcast]}, 0x48) [ 220.068428] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de [ 220.107295] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de [ 220.133503] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de [ 220.174058] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de [ 220.190616] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de 20:08:37 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:37 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0) write$FUSE_IOCTL(r0, &(0x7f0000000080)={0x20}, 0x20) lseek(r0, 0x0, 0x4) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) 20:08:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x1f4) 20:08:37 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(aes)\x00'}, 0x58) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000040)="0a0775db7b2803b4f0a12585675d26b0d5e383e5b3b60ced5c54dbb7295df0df8217ad62005127000000000000e60000", 0x30) dup3(r0, r1, 0x0) 20:08:37 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x1c, &(0x7f0000000180)="f4", 0x1) 20:08:37 executing program 3: fallocate(0xffffffffffffffff, 0x4, 0x0, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCCONS(r0, 0x541d) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{0x0}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x80800, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) finit_module(r1, &(0x7f0000000180)='nodev!:\x00', 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) dup3(r0, r0, 0x80000) ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430) gettid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) getpid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) fallocate(r4, 0x0, 0x40000, 0xfff) write$FUSE_DIRENT(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="85e07722da70e15cc0ade98b9deda2555a3afa1317ea1aa37ef10d62c7d12b48126e0225e63cc7a4231d15db81b233a1fcbb88586aa761156c76689870efb73458a6e8c8f3bcd9b9fce6b808db9581cc8a961c388c9e63fe4ee3f41c3ea91a5c3e62118de08a74ffe8b1a1c0f5f5d19b3a4a18a7771564785422c84baa769b53f3556b4e5bbc785c4758c4083dedc6b6b05156b3f7d962"], 0x97) fallocate(r3, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0x0, r4, 0x6, 0x8, 0x80000001}) 20:08:37 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x7, 0x1, 0x4c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x48) 20:08:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00003b9fdc)) r3 = syz_open_pts(r2, 0x4000000000000002) r4 = dup3(r3, r1, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) write(r2, &(0x7f0000000100)="01", 0x1) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000280)='~', 0x1}], 0x1) ioctl$TCXONC(r4, 0x540a, 0x1) 20:08:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000640)='/dev/capi20\x00', 0x0, 0x0) ioctl$CAPI_REGISTER(r1, 0x400c4301, &(0x7f0000000040)={0x0, 0x0, 0x3ff}) 20:08:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") close(r1) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000019c0)=""/61, 0x3d}}], 0x1, 0x0, 0x0) readv(r1, &(0x7f00000002c0), 0x1000000000000177) 20:08:37 executing program 5: mount$bpf(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='m']) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='debugfs\x00', 0x0, &(0x7f00000001c0)) 20:08:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)}, 0x0) sysinfo(&(0x7f0000000000)=""/248) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000180)={'ip6_vti0:*\x03\x00\x7f\xff\xff\xff', @ifru_flags=0x48}) 20:08:40 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:40 executing program 4: getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, 0x0) arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe) perf_event_open(&(0x7f000000a000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x80a102001ff8, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) waitid(0x0, 0x0, 0x0, 0x40000009, 0x0) 20:08:40 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext3\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000280)="800f0000106a940019000300e6000400000001020000000001000000090000000040000000400000800000000000005641913bb0b210b7f053ef", 0x3a, 0x400}], 0x0, 0x0) 20:08:40 executing program 0: 20:08:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)}, 0x0) sysinfo(&(0x7f0000000000)=""/248) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000180)={'ip6_vti0:*\x03\x00\x7f\xff\xff\xff', @ifru_flags=0x48}) 20:08:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x1f4) 20:08:40 executing program 0: 20:08:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)}, 0x0) sysinfo(&(0x7f0000000000)=""/248) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000180)={'ip6_vti0:*\x03\x00\x7f\xff\xff\xff', @ifru_flags=0x48}) 20:08:40 executing program 0: 20:08:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)}, 0x0) sysinfo(&(0x7f0000000000)=""/248) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000180)={'ip6_vti0:*\x03\x00\x7f\xff\xff\xff', @ifru_flags=0x48}) [ 225.932997] EXT4-fs (loop5): couldn't mount as ext3 due to feature incompatibilities 20:08:40 executing program 0: 20:08:40 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 225.997322] EXT4-fs (loop5): couldn't mount as ext3 due to feature incompatibilities 20:08:43 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") socket$inet6(0xa, 0x80001, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) prctl$PR_SET_UNALIGN(0x6, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = getpid() ioctl$sock_inet_SIOCGIFADDR(r3, 0x8915, &(0x7f0000000300)={'veth0_Wo_hsr\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x13}}}) getpriority(0x0, r4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x11) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000180)=0x14) gettid() clock_getres(0x1000000000047, 0x0) sendto$inet(r3, 0x0, 0xffffffe3, 0x20000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @multicast1}, 0x10) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f00000001c0)) sendto$inet(r3, &(0x7f0000000140)='I', 0x1, 0x4007ffd, 0x0, 0x0) shutdown(r3, 0x1) recvfrom(r3, 0x0, 0xfffffffffffffd3f, 0x45, 0x0, 0x2e2) 20:08:43 executing program 1: 20:08:43 executing program 5: 20:08:43 executing program 0: 20:08:43 executing program 4: 20:08:43 executing program 5: 20:08:43 executing program 0: 20:08:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = epoll_create1(0x0) dup2(r0, r1) clone(0x2100201ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) 20:08:43 executing program 1: 20:08:43 executing program 1: 20:08:43 executing program 0: 20:08:46 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:46 executing program 1: 20:08:46 executing program 5: 20:08:46 executing program 0: 20:08:46 executing program 3: 20:08:46 executing program 1: 20:08:46 executing program 3: 20:08:46 executing program 4: 20:08:46 executing program 5: 20:08:46 executing program 0: 20:08:46 executing program 1: 20:08:46 executing program 4: 20:08:49 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:49 executing program 5: 20:08:49 executing program 3: 20:08:49 executing program 1: 20:08:49 executing program 0: 20:08:49 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000240)='cpuacct.usage_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:08:49 executing program 1: 20:08:49 executing program 5: 20:08:49 executing program 3: 20:08:49 executing program 0: 20:08:49 executing program 4: 20:08:49 executing program 5: 20:08:52 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:52 executing program 1: 20:08:52 executing program 0: 20:08:52 executing program 3: 20:08:52 executing program 4: 20:08:52 executing program 5: 20:08:52 executing program 4: 20:08:52 executing program 3: 20:08:52 executing program 1: 20:08:52 executing program 0: 20:08:52 executing program 5: 20:08:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:08:55 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:55 executing program 4: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r0, &(0x7f0000000140)=@profile={'permprofile ', ':\"//em0ppp1vboxnet0-user\x00'}, 0xff57) 20:08:55 executing program 1: 20:08:55 executing program 5: 20:08:55 executing program 0: 20:08:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:08:55 executing program 1: 20:08:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') pread64(r1, 0x0, 0xffffffc3, 0x204) 20:08:55 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) dup2(r1, r2) 20:08:55 executing program 4: r0 = syz_init_net_socket$ax25(0x3, 0x800000000000005, 0x0) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom, 0x1}, [@null, @null, @bcast, @remote, @netrom, @null, @netrom, @bcast]}, 0x48) 20:08:55 executing program 1: sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0xfffffece) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)) 20:08:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 241.193980] ax25_connect(): syz-executor.4 uses autobind, please contact jreuter@yaina.de 20:08:58 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:08:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000040), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x200001e4) r2 = memfd_create(&(0x7f0000000180)='dev ', 0x3) write(r2, &(0x7f00000011c0)="16", 0x1) sendfile(r1, r2, &(0x7f0000000000), 0xffff) clone(0x3502001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$addseals(r2, 0x409, 0x8) setsockopt$inet6_tcp_buf(r1, 0x6, 0x0, &(0x7f00000001c0)="9a439621", 0x4) 20:08:58 executing program 4: r0 = socket$inet6(0xa, 0x82000000003, 0x810000000000010) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="0f"]}) 20:08:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:08:58 executing program 0: r0 = socket$inet6(0xa, 0x82000000003, 0x810000000000010) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="09000000000000000003"]}) 20:08:58 executing program 1: r0 = socket$inet(0x2, 0x3, 0x1b) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x2000000000002) 20:08:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) 20:08:58 executing program 4: r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x200, 0x0) read(r0, 0x0, 0x3d5) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x2, 0x0) dup2(r0, r1) 20:08:58 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x8) [ 244.146854] mmap: syz-executor.1 (9717) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. 20:08:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) 20:08:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) 20:08:58 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x8) 20:09:01 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:01 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000580)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}]}}) listxattr(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 20:09:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8001) 20:09:01 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x800000000000005, 0x0) connect$ax25(r0, &(0x7f0000000000)={{0x3, @null}, [@bcast, @null, @remote, @remote, @netrom, @remote, @null, @netrom]}, 0x48) 20:09:01 executing program 0: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r3, 0xc0485630, &(0x7f0000000380)={0x0, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(0x0, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file'], 0x9) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x17f) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) accept4(0xffffffffffffffff, &(0x7f0000000140)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @dev}}, &(0x7f0000000000)=0x80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f00000000c0)={0xc}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20:09:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8001) [ 247.195463] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de 20:09:01 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:01 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8001) [ 247.309048] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000006d data 0x4d00000000f 20:09:01 executing program 0: r0 = socket$inet6(0xa, 0x82000000003, 0x810000000000010) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000240)=ANY=[@ANYBLOB='\v']}) [ 247.365168] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000003b data 0x4d00000000f [ 247.411063] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000009 data 0x4d00000000f [ 247.430648] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000041 data 0x4d00000000f [ 247.452243] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000000f data 0x4d00000000f 20:09:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$vsock_stream(0x28, 0x1, 0x0) accept4(r1, 0x0, 0x0, 0x0) [ 247.488481] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000079 data 0x4d00000000f [ 247.515577] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000047 data 0x4d00000000f [ 247.536916] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000015 data 0x4d00000000f [ 247.565224] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000007f data 0x4d00000000f [ 247.576306] kvm [9762]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000004d data 0x4d00000000f 20:09:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:02 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:02 executing program 4: 20:09:02 executing program 0: pipe2(0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000500)={'sit0\x00\x00\x00\x00\x00\x00\x00\xd6\x00'}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141}) getpid() socket$inet6(0xa, 0x8, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001380), 0x4) clock_nanosleep(0x0, 0x1, &(0x7f00000004c0)={0x77359400}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) keyctl$get_keyring_id(0x0, 0x0, 0x3ff) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000300)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000280)=0xfffffffffffffc00, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f0000001700)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x406855c9) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000200)={0x7, 0x7b, 0x1}, 0x7) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) creat(&(0x7f0000000100)='./file0\x00', 0x94) syz_genetlink_get_family_id$net_dm(&(0x7f00000003c0)='NET_DM\x00') 20:09:02 executing program 5: 20:09:02 executing program 5: 20:09:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) [ 248.094428] device sit0 entered promiscuous mode [ 248.815834] device sit0 left promiscuous mode [ 248.864204] device sit0 entered promiscuous mode 20:09:04 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:04 executing program 5: syz_execute_func(&(0x7f00000006c0)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f11106f") clone(0x8000100000203, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x200010a) close(r0) symlink(&(0x7f0000000040)='./file1/file0\x00', &(0x7f00000000c0)='./file1\x00') execve(&(0x7f0000000100)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r1 = open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3103101ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file1\x00', 0x0, 0x0) write$binfmt_aout(r1, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00'], 0x1) 20:09:04 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:04 executing program 4: r0 = creat(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000080)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000100), 0x1c) r2 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000180)=[@window={0x3, 0x0, 0x7f}, @sack_perm], 0x20000000000000d0) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, 0x0, 0x0) 20:09:04 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:04 executing program 0: pipe2(0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000500)={'sit0\x00\x00\x00\x00\x00\x00\x00\xd6\x00'}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141}) getpid() socket$inet6(0xa, 0x8, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001380), 0x4) clock_nanosleep(0x0, 0x1, &(0x7f00000004c0)={0x77359400}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) keyctl$get_keyring_id(0x0, 0x0, 0x3ff) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000300)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000280)=0xfffffffffffffc00, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f0000001700)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x406855c9) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000200)={0x7, 0x7b, 0x1}, 0x7) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) creat(&(0x7f0000000100)='./file0\x00', 0x94) syz_genetlink_get_family_id$net_dm(&(0x7f00000003c0)='NET_DM\x00') 20:09:04 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) [ 250.368733] device sit0 left promiscuous mode 20:09:04 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:04 executing program 5: pipe2(0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000500)={'sit0\x00\x00\x00\x00\x00\x00\x00\xd6\x00'}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141}) getpid() socket$inet6(0xa, 0x8, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001380), 0x4) clock_nanosleep(0x0, 0x1, &(0x7f00000004c0)={0x77359400}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) keyctl$get_keyring_id(0x0, 0x0, 0x3ff) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000300)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000280)=0xfffffffffffffc00, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f0000001700)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x406855c9) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000200)={0x7, 0x7b, 0x1}, 0x7) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) creat(&(0x7f0000000100)='./file0\x00', 0x94) syz_genetlink_get_family_id$net_dm(&(0x7f00000003c0)='NET_DM\x00') [ 250.528510] device sit0 entered promiscuous mode 20:09:04 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:04 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:04 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) [ 250.698769] device sit0 entered promiscuous mode 20:09:07 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:07 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:07 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') 20:09:07 executing program 4: clone(0x208, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xb) r1 = creat(&(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x80000000000010c) r2 = dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)) open$dir(&(0x7f0000000200)='./file0\x00', 0x841, 0x0) syz_execute_func(&(0x7f00000006c0)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, 0x0) 20:09:07 executing program 0: r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x200, 0x0) read(r0, 0x0, 0x3d5) 20:09:07 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000001100)={0x319d2daeca5e1c63}) add_key$user(0x0, 0x0, &(0x7f0000000100)="8d", 0x1, 0xfffffffffffffffb) shutdown(r0, 0x0) epoll_pwait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 20:09:07 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:07 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:07 executing program 5: r0 = socket$inet(0x2, 0x80001, 0x84) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, 0x0) socket$inet6(0xa, 0x6, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, 0x0, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x57, &(0x7f00000002c0)=[{&(0x7f0000001840), 0x48f4}], 0x1}, 0x0) 20:09:07 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:07 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') 20:09:07 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:07 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:07 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x7ffc) 20:09:07 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8001) 20:09:08 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x3f000000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000200), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, 0x0, 0x0) 20:09:08 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:08 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') 20:09:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:08 executing program 0: r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x200, 0x0) read(r0, 0x0, 0x3) 20:09:08 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:08 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3e) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 20:09:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:08 executing program 4: socket$rds(0x15, 0x5, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$admmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0xe00) 20:09:08 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3e) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 20:09:08 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") fstat(0xffffffffffffffff, 0x0) 20:09:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:08 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3e) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 20:09:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:08 executing program 2: r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:09 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) socket$packet(0x11, 0x0, 0x300) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x12000000013, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x38) setsockopt$inet_tcp_int(r2, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000001, 0x4) r3 = fcntl$dupfd(r2, 0x0, r2) write$P9_RREMOVE(r3, &(0x7f0000000000)={0x7}, 0x7) recvmmsg(r2, &(0x7f00000001c0), 0x315, 0xea225aec34b1dd0e, 0x0) 20:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:09 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") fstat(0xffffffffffffffff, 0x0) 20:09:09 executing program 2: r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:09 executing program 4: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2a350be5ce65d41", 0xea}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r3, 0xc0485630, &(0x7f0000000380)={0x1, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(0x0, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, 0x0) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:09 executing program 2: r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:09 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:09 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x4, 0x20002) ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x5) r0 = socket(0x400040000000015, 0x805, 0x0) bind(r0, &(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @rand_addr="38656763059d9a8a64c852863d50750c"}, 0x80) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) 20:09:09 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) 20:09:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:09 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") fstat(0xffffffffffffffff, 0x0) 20:09:09 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 20:09:09 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 255.492435] audit: type=1400 audit(1556136549.703:50): avc: denied { map } for pid=10104 comm="syz-executor.4" path="/dev/binder0" dev="devtmpfs" ino=879 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 255.512879] binder: tried to use weak ref as strong ref 20:09:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") semop(0x0, &(0x7f0000000140)=[{0x0, 0x23, 0x1000}], 0x81) 20:09:09 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) [ 255.575999] binder: 10104:10120 ioctl c0306201 0 returned -14 20:09:09 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 255.631090] binder: 10104:10109 Release 1 refcount change on invalid ref 0 ret -22 20:09:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 255.688106] audit: type=1400 audit(1556136549.713:51): avc: denied { set_context_mgr } for pid=10104 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 255.703287] binder: 10104:10120 ioctl c0306201 0 returned -14 20:09:10 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x40000000) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf035"], 0x101) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000480)={0x0, 0x0, 0x0}) ftruncate(r1, 0x100) 20:09:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:10 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 20:09:10 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 255.932492] binder: tried to use weak ref as strong ref 20:09:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 255.998429] binder: 10158:10165 Release 1 refcount change on invalid ref 0 ret -22 [ 256.011946] binder: 10158:10177 ioctl c0306201 0 returned -14 20:09:10 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) socket$packet(0x11, 0x0, 0x300) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x12000000013, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x38) setsockopt$inet_tcp_int(r2, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000001, 0x4) r3 = fcntl$dupfd(r2, 0x0, r2) write$P9_RREMOVE(r3, &(0x7f0000000000)={0x7}, 0x7) recvmmsg(r2, &(0x7f00000001c0), 0x315, 0xea225aec34b1dd0e, 0x0) 20:09:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:10 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:10 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 256.232730] binder: tried to use weak ref as strong ref 20:09:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:10 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 256.265905] binder: 10201:10209 Release 1 refcount change on invalid ref 0 ret -22 [ 256.291116] binder: 10201:10217 ioctl c0306201 0 returned -14 20:09:10 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 20:09:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) 20:09:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:10 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) [ 256.448978] binder: tried to use weak ref as strong ref [ 256.474434] binder: 10232:10237 Release 1 refcount change on invalid ref 0 ret -22 [ 256.504692] binder: 10232:10237 ioctl c0306201 0 returned -14 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:10 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 20:09:10 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, &(0x7f0000000100)={0xffffffffffff152e, 0x0, 0x100000000, 0x4, 0x7f}) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_procfs(0x0, &(0x7f0000000840)='net/ip6_flowlabel\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0xffffffffffffffc8, 0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x100000041}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) fremovexattr(r1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x80000001, 0x0, 0x0, 0x1000000000054}, 0x98) 20:09:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:10 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:10 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) [ 256.649287] binder: tried to use weak ref as strong ref [ 256.684374] binder: 10267:10272 Release 1 refcount change on invalid ref 0 ret -22 20:09:10 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:10 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 256.708757] binder: 10267:10282 ioctl c0306201 0 returned -14 20:09:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:11 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:11 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x8000, 0x0) 20:09:11 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:11 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 256.923882] binder: tried to use weak ref as strong ref [ 256.951797] binder: 10303:10307 Release 1 refcount change on invalid ref 0 ret -22 20:09:11 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000400)={0x11, 0x10, 0xfa00, {0x0}}, 0x18) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 20:09:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:11 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 20:09:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:11 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 257.151335] binder: tried to use weak ref as strong ref [ 257.159762] binder: 10331:10340 Release 1 refcount change on invalid ref 0 ret -22 20:09:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$admmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0xe00) 20:09:11 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) [ 257.317693] binder: tried to use weak ref as strong ref [ 257.335206] binder: 10355:10361 Release 1 refcount change on invalid ref 0 ret -22 20:09:14 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:14 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:14 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000700080000ee8b08b7960ff7aae2cb6e041a1000fdff863809aa0063e62555fd964eda145b11a8c3b8f654b8000000000038f70f651f0ffb09f0d536b564df5e0acad550fe203534da91b5b9fb501e212fde7c0eca620000000000000000c91ac4bfa3841f9d63e232b9b2500000010033ccfd435a143bc66ed4d2865babd0e773ffb90e884d15424cd5e743d46a8ca5c988c24e475397f26c0f75a738b600ad6a8e4c3085238314f759450965cd96f2649cc51708670919150ddf80f9f5f6194a995692be22887fc0909e3d5225edd53c7a198ea6fb0ed919f4674bf22ffe33394caa79993b6ce9199a336d97daa4081aa3d4f2cf4cddf0"], 0x100) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, 0x0) ftruncate(r1, 0x100) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, 0x0, 0x0) unlink(0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) mkdir(0x0, 0x0) 20:09:14 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:14 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:14 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:14 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:17 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:17 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:17 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:17 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) dup2(r0, r1) 20:09:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 262.964863] binder: 10422:10428 IncRefs 0 refcount change on invalid ref 0 ret -22 20:09:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 263.006280] binder: 10422:10428 Release 1 refcount change on invalid ref 0 ret -22 20:09:17 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:17 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) [ 263.051184] audit: type=1800 audit(1556136557.253:52): pid=10426 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed" comm="syz-executor.1" name="file0" dev="sda1" ino=16882 res=0 20:09:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 263.203533] binder: 10451:10456 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 263.266930] binder: 10451:10456 Release 1 refcount change on invalid ref 0 ret -22 20:09:20 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:20 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, 0x0, 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:20 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 265.996504] binder: 10474:10479 IncRefs 0 refcount change on invalid ref 0 ret -22 20:09:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, 0x0, 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:20 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x5}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 266.053911] binder: 10474:10479 Release 1 refcount change on invalid ref 0 ret -22 20:09:20 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:20 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, 0x0, 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 266.236746] binder: tried to use weak ref as strong ref [ 266.273756] binder: 10510:10513 Release 1 refcount change on invalid ref 0 ret -22 20:09:23 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:23 executing program 0: 20:09:23 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:23 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:23 executing program 0: [ 269.025156] binder: tried to use weak ref as strong ref 20:09:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 269.074298] binder: 10532:10534 Release 1 refcount change on invalid ref 0 ret -22 20:09:23 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:23 executing program 0: 20:09:23 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) [ 269.267883] binder: tried to use weak ref as strong ref [ 269.305514] binder: 10559:10565 Release 1 refcount change on invalid ref 0 ret -22 20:09:26 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:26 executing program 0: 20:09:26 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:26 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:26 executing program 0: 20:09:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:26 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:26 executing program 0: 20:09:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 272.058035] binder: tried to use weak ref as strong ref [ 272.089993] binder: 10574:10579 Release 1 refcount change on invalid ref 0 ret -22 20:09:26 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) [ 272.191884] binder: tried to use weak ref as strong ref [ 272.206064] binder: 10603:10607 Release 1 refcount change on invalid ref 0 ret -22 20:09:29 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) 20:09:29 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:29 executing program 0: 20:09:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:29 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:29 executing program 0: [ 275.092129] binder: tried to use weak ref as strong ref 20:09:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x8001) [ 275.141492] binder: 10613:10618 Release 1 refcount change on invalid ref 0 ret -22 20:09:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:29 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:29 executing program 0: 20:09:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8001) 20:09:32 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:32 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:32 executing program 0: 20:09:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8001) 20:09:32 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:32 executing program 0: [ 278.139563] binder: tried to use weak ref as strong ref 20:09:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8001) 20:09:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 278.186917] binder: 10652:10659 Release 1 refcount change on invalid ref 0 ret -22 20:09:32 executing program 0: 20:09:32 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:32 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) [ 278.397726] binder: 10683:10687 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 278.438639] binder: 10683:10687 Release 1 refcount change on invalid ref 0 ret -22 20:09:35 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) 20:09:35 executing program 0: 20:09:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:35 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:35 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:35 executing program 0: 20:09:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 281.224126] binder: 10696:10704 IncRefs 0 refcount change on invalid ref 0 ret -22 20:09:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) 20:09:35 executing program 0: [ 281.296639] binder: 10696:10704 Release 1 refcount change on invalid ref 0 ret -22 20:09:35 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:35 executing program 0: 20:09:38 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) 20:09:38 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:38 executing program 0: 20:09:38 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:38 executing program 0: 20:09:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x0) 20:09:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 284.289333] binder: 10732:10743 IncRefs 0 refcount change on invalid ref 0 ret -22 20:09:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x0) 20:09:38 executing program 0: ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x7) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000180)=0x5, 0x4) open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sched_setaffinity(0x0, 0xffffffffffffff26, &(0x7f0000000140)=0x1) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005) getuid() setresuid(0x0, 0x0, 0x0) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x31) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x13f}) ptrace$setregs(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000180)) add_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0)={'\x02\x00'}, &(0x7f0000000100), 0xfffff, 0xfffffffffffffffb) 20:09:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 284.349625] binder: 10732:10743 Release 1 refcount change on invalid ref 0 ret -22 20:09:41 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:41 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) r1 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000000)={0x0, 0x0, 0x0, r1}) ioctl(r0, 0x8916, &(0x7f0000000000)) 20:09:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.cpus\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x0) 20:09:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:41 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:41 executing program 3: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x0, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x0, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r3, 0xc0485630, &(0x7f0000000380)={0x1, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") 20:09:41 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:41 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:41 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='setgroups\x00') sendfile(r0, r0, 0x0, 0x200000000ff) 20:09:41 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:41 executing program 3: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x0, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x0, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r3, 0xc0485630, &(0x7f0000000380)={0x1, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") 20:09:44 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4000000, 0xc}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:44 executing program 0: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x0, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm-monitor\x00', 0x0, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(r3, 0xc0485630, &(0x7f0000000380)={0x1, "086299a8c9dc53b00a5ab6650688048ad14761729b4be067b631b1244787bbf5", 0x1, 0x0, 0x3, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") 20:09:44 executing program 4: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:44 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @rand_addr="831100fe0c9064b5f14f034a54dd825b"}, 0x1c) 20:09:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:44 executing program 4: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr="037308cfb2e0bca7d5b2d4347f0125ef"}, 0x1c) 20:09:44 executing program 0: 20:09:44 executing program 0: 20:09:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:47 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:47 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:47 executing program 4: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:47 executing program 3: 20:09:47 executing program 0: 20:09:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, &(0x7f0000000080)) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, &(0x7f0000000080)) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:47 executing program 3: 20:09:47 executing program 0: 20:09:47 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:47 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) r6 = creat(&(0x7f0000000080)='./file0\x00', 0x3) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(r6) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r6, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r8, 0x0) 20:09:47 executing program 3: [ 293.375413] binder: tried to use weak ref as strong ref [ 293.404677] binder: 10891:10899 Release 1 refcount change on invalid ref 0 ret -22 20:09:50 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, &(0x7f0000000080)) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:50 executing program 0: 20:09:50 executing program 3: 20:09:50 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) write$binfmt_script(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(0xffffffffffffffff) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:50 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, 0x0) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:50 executing program 3: 20:09:50 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) write$binfmt_script(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(0xffffffffffffffff) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:50 executing program 0: [ 296.333289] binder: tried to use weak ref as strong ref [ 296.367966] binder: 10917:10918 Release 1 refcount change on invalid ref 0 ret -22 20:09:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, 0x0) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:50 executing program 3: 20:09:53 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:09:53 executing program 4: syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f319bd070") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000040)=[@increfs, @decrefs={0x40046306}], 0x0, 0x0, 0x0}) 20:09:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") msgsnd(0x0, &(0x7f0000000040), 0x8, 0x0) 20:09:53 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x7, 0x1, 0x60}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x48) 20:09:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, 0x0) syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 20:09:53 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) r4 = memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000140)) write$binfmt_script(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r5, &(0x7f0000000600), 0x1000) close(0xffffffffffffffff) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(0x0) 20:09:53 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x9, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x2c}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:09:53 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003a00)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f00000038c0)="a6a5afbf512fa21e677d0a971ef957099d809dadf6dfb263dc63c0de84fbbddccf1146be05ee60381184323103b0c28565ba4797dddce4411268897d72ff8cbde0a9e39ca3be19147b849926b1e59505f5a8cf37b6a46276b9d77284547befa92bd836453cca2622af6032c1fcde3e8dc3aa27a922088a58c1a10d83a01468c2aacbe84adb3d3fa66ce741238285b2756670ae33229c78d5bfbb9a67977b280202868aae4759cd15073880a5de9a72772e00dffa2f250bedd0f2d4b577c795b072625ba541e1a911a5823e09c621ab78a7cabdfcd8c4dec3bd6e139d5ac19214d74da2", 0xe3}], 0x1, 0x0, 0x0, 0x4}], 0x1, 0x40000) r2 = syz_open_dev$loop(&(0x7f0000003c40)='/dev/loop#\x00', 0x0, 0x105000) r3 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x4003, 0x0) memfd_create(&(0x7f0000000100)='t\b\x00\x00\xf9\xff\x85nG\x13g\xa6\x05', 0x0) ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) r4 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x3) write$binfmt_script(r5, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) read$FUSE(r4, &(0x7f0000000600), 0x1000) close(r5) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r5, 0x8008700b, &(0x7f00000000c0)) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x80000000, 0x9, 0x401, 0xffffffffffffffff}]}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') fstat(r7, 0x0) 20:09:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$kcm(0xa, 0x2, 0x88) sendmsg$kcm(r1, &(0x7f0000004740)={&(0x7f0000000580)=@in6={0xa, 0x4e21, 0x0, @local, 0x9}, 0x80, 0x0}, 0xe803) sendmsg$kcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)='9', 0x1}], 0x1}, 0xc000) recvmsg$kcm(r1, &(0x7f0000004700)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001140)="9f9025b320788266150ed588b66cd0dd770efee3df0eeff01d143e2389f276d82f99bdb1f7481621368993f568e513da6e80b184528701504efff7db040122b20f745cf1eb1bf22c5a1f1c5f85a26296e823ac629de5e615d16e99f1afbc45625ff0a05af9fc5e1e09216769781152170ac15e247dfcebf85f20ba7a785a71716ddfc2b46e03a55ca42e8da04f71f11198d73e86b69bdc17dbf9b224576ea5a31ecc9bffd0b5ee913c663a7192f2adddaa11f1b7bc78e08e85d96c5f937ea77d943d6f6b7a09fa95d85e7472998acb3ea08ff58ac1c257e21e538c34798fdd56e22244c3a7773a623e16373ee62033bf1e7e21da94d9e53373981ff346162b503e7d0a27217a4f32def89fa47f94a7c8585f78e56e319a9987f5c7af7e19767b3e4849c9ca7266f09d77f5de864e5ab35ff61628afa93c777ce552d172984b179bd6125bf4f7ef7f9993dfe6191c13590e2920cf59ed4e8f6ae0bfd6e0480d2d99bca526ca2c79f333c60c0a800616959e53aa46d05c7778068654bfd50aec1024ab8bcdc120c541bc0bd20329e874ff4b50cbb1172aae55629bb257c5f3d0b3ee0f40490427c326580217710e2b7a08595171bc34aeec83d796e1ca51ce75896e2886c30783bfc2825f98c10a1dd9ee36abfabb692e3834aa4c1b31230f08bbc2a6971a4a9e186ee568dfccc13a59f4cc5c331cfabb0a87addf6b5c78223bc17ff7b9106ee8f575ceb16c6fa884659f5952cd25277f770dd366081b30569396b57bf5d64b087dae3958e3a0eeecad93e9dfc7528e8cb11f2ed324e8fde030186fc96b00f75e7fffad1115f66aa6986c8fc5c6619a5c80921955cb08395680b2e933dd4147dc53649d3f687643b125853c979f8534b91c970872e996fcf6de452f5b05a18fe77ead019a7bbca5e9e45a91d52fdd55c3711341b3e6d7054c9b8473a841b7cc095708747ffa37fa2889b9d69b76de2eeb3d9494f1f3c72e548dd9f8f9ab6bb992cdf6a43eff5adba3e6c04bcd4c04c0f27c1ee23cda111c7c8e46cdf95f69bf0f8bdd6338ed6ba21420a193002c4eb527b6f368978c363a67de77c1675c04d2e94d47ede850fd4f26ffe5d370af75894f767b4f3a1100ed4f02faddc9bd482f22154f6c47d9a1a6fb953426aa05b798a2eb9b01c68d5d2fcb428fb62da26ecac9eef03565120a08309f4f9790a3ffdadc91f297cc045c0c95f7d6ea9aede8dbea8e5e8bb8f94a9de11fd91262194c72e175db5a65efe78fba2c64ce85606af79aaaba0ffe5070e457aa3e3b4584b54acb5ffa92546cee55f0008031a33124d444420aa7209900f418a5a9ae94779ba41b99c1e93355db80085622757cc13c0ba8de715ba1fc73cd44e92b2da2407cc8300ad47df8fed565c8b40a2cd69a0e2485343829b53f03f9917bd99799aa77946d64ed781590b25e73c80fb1d3493175794e0ef57f099b61b56f37c9332490b3bf6c25decfb2a2ccc5b06d0e5a34b7f94812f9dae7fc1c1dc73e39a5d78427776856bf9c8878fcb0afb757dabdc45055b011d104e1934f9788c00eebe94a9d2ad4509ccfa1c28b2c44f21f4750a011e7d0515fa972109dd1742dd256a3043cace172355029b8c0156852f861c493d42aa13077d45407396555f090ae343e05ddd33c4e164395d8eff7a9bad88e33e64e50156f1907a6457b13c9cb0c0ca74ad694ed5d9046f804cc8054d75b607228d25774cb8fdd8cd6bf77f880370152a9998da68d92b91501f6f6283fe7e44538f96aac8919873344cf6446dd0c6ef9b5a3bf4a2345e05bb3f0d1959975eb108c45509415ef81d9507681eb76d86c734d8adbe72c9faa23b2781cb30ee200e84737efef8f6830749fdd2380b51064de2a8e46b245fb3a5b5ef4a97567f435b4f81998ab0d0c32054143360245baf889f31b11d1504a58060b7a770ca4699017cde1170b296b91924541d00fcab3a41a485922faec9833b0", 0x57b}], 0x1}, 0x8000) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000001e80)='r', 0x1}], 0x1}, 0x0) 20:09:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) syz_execute_func(0x0) [ 299.398300] binder: tried to use weak ref as strong ref [ 299.438126] binder: 10950:10963 Release 1 refcount change on invalid ref 0 ret -22 20:09:53 executing program 3: r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000000200)=@caif=@rfm={0x25, 0x5, "8de06f55c742ae7c2bb7ed7767c245f6"}, 0x80, 0x0}, 0x0) [ 299.515073] ================================================================== [ 299.522647] BUG: KASAN: use-after-free in erspan_build_header+0x392/0x3b0 [ 299.529571] Read of size 2 at addr ffff88809196cacb by task syz-executor.3/10991 [ 299.537357] [ 299.539070] CPU: 0 PID: 10991 Comm: syz-executor.3 Not tainted 4.14.113 #3 [ 299.546073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 299.555418] Call Trace: [ 299.558004] dump_stack+0x138/0x19c [ 299.561624] ? erspan_build_header+0x392/0x3b0 [ 299.566234] print_address_description.cold+0x7c/0x1dc [ 299.571503] ? erspan_build_header+0x392/0x3b0 [ 299.576069] kasan_report.cold+0xaf/0x2b5 [ 299.580325] __asan_report_load_n_noabort+0xf/0x20 [ 299.585244] erspan_build_header+0x392/0x3b0 [ 299.589641] ? iptunnel_handle_offloads+0x2f3/0x500 [ 299.594653] erspan_xmit+0x3ec/0x11c0 [ 299.598439] ? __gre_xmit+0x890/0x890 [ 299.602219] ? lock_acquire+0x16f/0x430 [ 299.606219] ? packet_direct_xmit+0x345/0x640 [ 299.610706] packet_direct_xmit+0x438/0x640 [ 299.615080] packet_sendmsg+0x31e1/0x5990 [ 299.619267] ? __might_fault+0x110/0x1d0 [ 299.623320] ? rw_copy_check_uvector+0x1f1/0x290 [ 299.628062] ? packet_notifier+0x770/0x770 [ 299.632283] ? copy_msghdr_from_user+0x292/0x3f0 [ 299.637147] ? security_socket_sendmsg+0x8f/0xc0 [ 299.641915] ? packet_notifier+0x770/0x770 [ 299.646143] sock_sendmsg+0xd0/0x110 [ 299.649846] ___sys_sendmsg+0x70c/0x850 [ 299.653804] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 299.658589] ? __fget+0x210/0x370 [ 299.662041] ? find_held_lock+0x35/0x130 [ 299.666083] ? __fget+0x210/0x370 [ 299.669522] ? lock_downgrade+0x6e0/0x6e0 [ 299.673658] ? __fget+0x237/0x370 [ 299.677150] ? __fdget+0x1b/0x20 [ 299.680546] ? sockfd_lookup_light+0xb4/0x160 [ 299.685037] __sys_sendmsg+0xb9/0x140 [ 299.688836] ? SyS_shutdown+0x180/0x180 [ 299.693412] ? put_timespec64+0xb4/0x100 [ 299.697472] ? SyS_clock_gettime+0xfd/0x190 [ 299.701778] SyS_sendmsg+0x2d/0x50 [ 299.705307] ? __sys_sendmsg+0x140/0x140 [ 299.709358] do_syscall_64+0x1eb/0x630 [ 299.713235] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.718077] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 299.723261] RIP: 0033:0x458d99 [ 299.726732] RSP: 002b:00007f7986c00c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 299.734464] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458d99 [ 299.741766] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003 [ 299.749026] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 299.756431] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7986c016d4 [ 299.763752] R13: 00000000004c6616 R14: 00000000004daf38 R15: 00000000ffffffff [ 299.771091] [ 299.772708] Allocated by task 10455: [ 299.776414] save_stack_trace+0x16/0x20 [ 299.780375] save_stack+0x45/0xd0 [ 299.783816] kasan_kmalloc+0xce/0xf0 [ 299.787523] kasan_slab_alloc+0xf/0x20 [ 299.791413] kmem_cache_alloc+0x12e/0x780 [ 299.795591] getname_flags+0xcb/0x580 [ 299.799415] SyS_symlink+0x68/0x210 [ 299.803036] do_syscall_64+0x1eb/0x630 [ 299.806912] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 299.812083] [ 299.813754] Freed by task 10455: [ 299.817114] save_stack_trace+0x16/0x20 [ 299.821075] save_stack+0x45/0xd0 [ 299.824510] kasan_slab_free+0x75/0xc0 [ 299.828384] kmem_cache_free+0x83/0x2b0 [ 299.832347] putname+0xdb/0x120 [ 299.835609] SyS_symlink+0x12c/0x210 [ 299.839375] do_syscall_64+0x1eb/0x630 [ 299.843305] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 299.848479] [ 299.850088] The buggy address belongs to the object at ffff88809196c280 [ 299.850088] which belongs to the cache names_cache of size 4096 [ 299.862817] The buggy address is located 2123 bytes inside of [ 299.862817] 4096-byte region [ffff88809196c280, ffff88809196d280) [ 299.874863] The buggy address belongs to the page: [ 299.879780] page:ffffea0002465b00 count:1 mapcount:0 mapping:ffff88809196c280 index:0x0 compound_mapcount: 0 [ 299.889728] flags: 0x1fffc0000008100(slab|head) [ 299.894423] raw: 01fffc0000008100 ffff88809196c280 0000000000000000 0000000100000001 [ 299.902311] raw: ffffea00024a3a20 ffffea0001617ca0 ffff8880aa9e0cc0 0000000000000000 [ 299.910182] page dumped because: kasan: bad access detected [ 299.915882] [ 299.917494] Memory state around the buggy address: [ 299.922410] ffff88809196c980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 299.929793] ffff88809196ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 299.937142] >ffff88809196ca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 299.944595] ^ [ 299.950329] ffff88809196cb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 299.957784] ffff88809196cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 299.965229] ================================================================== [ 299.972569] Disabling lock debugging due to kernel taint [ 299.978135] Kernel panic - not syncing: panic_on_warn set ... [ 299.978135] [ 299.985491] CPU: 0 PID: 10991 Comm: syz-executor.3 Tainted: G B 4.14.113 #3 [ 299.993933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 300.003277] Call Trace: [ 300.005860] dump_stack+0x138/0x19c [ 300.009470] ? erspan_build_header+0x392/0x3b0 [ 300.014051] panic+0x1f2/0x438 [ 300.017224] ? add_taint.cold+0x16/0x16 [ 300.021190] kasan_end_report+0x47/0x4f [ 300.025140] kasan_report.cold+0x136/0x2b5 [ 300.029396] __asan_report_load_n_noabort+0xf/0x20 [ 300.034312] erspan_build_header+0x392/0x3b0 [ 300.038765] ? iptunnel_handle_offloads+0x2f3/0x500 [ 300.044103] erspan_xmit+0x3ec/0x11c0 [ 300.047889] ? __gre_xmit+0x890/0x890 [ 300.051750] ? lock_acquire+0x16f/0x430 [ 300.055717] ? packet_direct_xmit+0x345/0x640 [ 300.060201] packet_direct_xmit+0x438/0x640 [ 300.064509] packet_sendmsg+0x31e1/0x5990 [ 300.068646] ? __might_fault+0x110/0x1d0 [ 300.072697] ? rw_copy_check_uvector+0x1f1/0x290 [ 300.077447] ? packet_notifier+0x770/0x770 [ 300.081671] ? copy_msghdr_from_user+0x292/0x3f0 [ 300.086416] ? security_socket_sendmsg+0x8f/0xc0 [ 300.091183] ? packet_notifier+0x770/0x770 [ 300.095560] sock_sendmsg+0xd0/0x110 [ 300.099275] ___sys_sendmsg+0x70c/0x850 [ 300.103263] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 300.108013] ? __fget+0x210/0x370 [ 300.111453] ? find_held_lock+0x35/0x130 [ 300.115492] ? __fget+0x210/0x370 [ 300.118931] ? lock_downgrade+0x6e0/0x6e0 [ 300.123064] ? __fget+0x237/0x370 [ 300.126499] ? __fdget+0x1b/0x20 [ 300.129846] ? sockfd_lookup_light+0xb4/0x160 [ 300.134375] __sys_sendmsg+0xb9/0x140 [ 300.138223] ? SyS_shutdown+0x180/0x180 [ 300.142183] ? put_timespec64+0xb4/0x100 [ 300.146229] ? SyS_clock_gettime+0xfd/0x190 [ 300.150534] SyS_sendmsg+0x2d/0x50 [ 300.154053] ? __sys_sendmsg+0x140/0x140 [ 300.158100] do_syscall_64+0x1eb/0x630 [ 300.162019] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 300.166960] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 300.172148] RIP: 0033:0x458d99 [ 300.175421] RSP: 002b:00007f7986c00c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 300.183247] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458d99 [ 300.190511] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003 [ 300.197902] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 300.205156] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7986c016d4 [ 300.212505] R13: 00000000004c6616 R14: 00000000004daf38 R15: 00000000ffffffff [ 300.220467] Kernel Offset: disabled [ 300.224132] Rebooting in 86400 seconds..