= syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB='syztnl2\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0010007b00000001000004014606001800680000022d9078ac1414bbe000000200000000a454506193466df315e5cd51938b2a37568d3aa464f8cfffac60dd06eb94d6abd81b151935b8014f18e626a60771e86e26ce0b72f702ed9fd6ba4bc9ebf0a4143d4e42a7b40a3d7f8facc05ad5869b453e733d8b1d6e26b3475793fe4090015aaeff18d97ca08dbe5657bc84034f7851080b98d131951896c363c1819a61aecf7bce99370bc635b1549766a6b2c175e1387067809f87d6b2b1ec589cb79417a027084134a326c9ab3098f746d3d008f7395f61914ca9d724550abc4a7f5dcbd607cd6d14"]}) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$rxrpc(0x21, 0x2, 0x2) (async) r8 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r8, 0x110, 0x3) setsockopt$RXRPC_SECURITY_KEY(r8, 0x110, 0x1, &(0x7f0000000040)='\x00', 0x1) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) (async) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="001cdfa50800000006001c0009000000080011001c0000000100120040bf0000050014008500000006000200000000004a05ed7677c6b451b72a3c139e66e122d3a9cbbfbd1bb79d85fe44be5f5ad8f6a3b9b7c6446891decb7d048dd4c90fd0b838475b9871f8213ecba331cfd9fc08e4d9e9b0ca1ebe29c60c5a90acd424f8d690a46ed5ea16087a58612be6fd1339575a4253ee02b34f8eea11dcdcabc23e2882b9f569"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c014) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7f}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x11a}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PEER_CONN_ID={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x8044}, 0x6) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7f}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x11a}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PEER_CONN_ID={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x8044}, 0x6) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, 0x0, 0x0) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100000000000000}, 0x48) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000100)={'tunl0\x00', r2, 0x1, 0x8, 0x0, 0x6, {{0x25, 0x4, 0x2, 0x3f, 0x94, 0x66, 0x0, 0x6, 0x4, 0x0, @multicast1, @multicast1, {[@timestamp_prespec={0x44, 0x44, 0xb8, 0x3, 0x0, [{@broadcast, 0xfffff574}, {@private=0xa010100, 0x4}, {@multicast2, 0xaa}, {@rand_addr=0x64010101, 0x46}, {@multicast1, 0x1000}, {@broadcast}, {@private=0xa010102, 0x6}, {@remote, 0xfffffffa}]}, @cipso={0x86, 0xb, 0x0, [{0x5, 0x5, "16a8ac"}]}, @end, @rr={0x7, 0x2b, 0x27, [@rand_addr=0x64010100, @broadcast, @multicast2, @private=0xa010102, @remote, @broadcast, @remote, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x15}, @remote]}, @generic={0x0, 0x3, "82"}]}}}}}) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5450, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200000000000000}, 0x48) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000100)={'tunl0\x00', r2, 0x1, 0x8, 0x0, 0x6, {{0x25, 0x4, 0x2, 0x3f, 0x94, 0x66, 0x0, 0x6, 0x4, 0x0, @multicast1, @multicast1, {[@timestamp_prespec={0x44, 0x44, 0xb8, 0x3, 0x0, [{@broadcast, 0xfffff574}, {@private=0xa010100, 0x4}, {@multicast2, 0xaa}, {@rand_addr=0x64010101, 0x46}, {@multicast1, 0x1000}, {@broadcast}, {@private=0xa010102, 0x6}, {@remote, 0xfffffffa}]}, @cipso={0x86, 0xb, 0x0, [{0x5, 0x5, "16a8ac"}]}, @end, @rr={0x7, 0x2b, 0x27, [@rand_addr=0x64010100, @broadcast, @multicast2, @private=0xa010102, @remote, @broadcast, @remote, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x15}, @remote]}, @generic={0x0, 0x3, "82"}]}}}}}) 01:03:53 executing program 4: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = socket$packet(0x11, 0x3, 0x300) getpeername$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000340)=0xd) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x0, 0x9, 0x100, 0x0, r0, 0x5, '\x00', r2, r0, 0x1, 0x3, 0x5, 0xd}, 0x48) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x7, 0x8}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x101, 0x3ff, 0x9, 0x4, r3, 0x0, '\x00', r2, r0, 0x1, 0x1, 0x1, 0xb}, 0x48) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB='syztnl2\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0010007b00000001000004014606001800680000022d9078ac1414bbe000000200000000a454506193466df315e5cd51938b2a37568d3aa464f8cfffac60dd06eb94d6abd81b151935b8014f18e626a60771e86e26ce0b72f702ed9fd6ba4bc9ebf0a4143d4e42a7b40a3d7f8facc05ad5869b453e733d8b1d6e26b3475793fe4090015aaeff18d97ca08dbe5657bc84034f7851080b98d131951896c363c1819a61aecf7bce99370bc635b1549766a6b2c175e1387067809f87d6b2b1ec589cb79417a027084134a326c9ab3098f746d3d008f7395f61914ca9d724550abc4a7f5dcbd607cd6d14"]}) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r8 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r8, 0x110, 0x3) setsockopt$RXRPC_SECURITY_KEY(r8, 0x110, 0x1, &(0x7f0000000040)='\x00', 0x1) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="001cdfa50800000006001c0009000000080011001c0000000100120040bf0000050014008500000006000200000000004a05ed7677c6b451b72a3c139e66e122d3a9cbbfbd1bb79d85fe44be5f5ad8f6a3b9b7c6446891decb7d048dd4c90fd0b838475b9871f8213ecba331cfd9fc08e4d9e9b0ca1ebe29c60c5a90acd424f8d690a46ed5ea16087a58612be6fd1339575a4253ee02b34f8eea11dcdcabc23e2882b9f569"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c014) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7f}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x11a}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PEER_CONN_ID={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x8044}, 0x6) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) socket$packet(0x11, 0x3, 0x300) (async) getpeername$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000340)=0xd) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x0, 0x9, 0x100, 0x0, r0, 0x5, '\x00', r2, r0, 0x1, 0x3, 0x5, 0xd}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x7, 0x8}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x101, 0x3ff, 0x9, 0x4, r3, 0x0, '\x00', r2, r0, 0x1, 0x1, 0x1, 0xb}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB='syztnl2\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0010007b00000001000004014606001800680000022d9078ac1414bbe000000200000000a454506193466df315e5cd51938b2a37568d3aa464f8cfffac60dd06eb94d6abd81b151935b8014f18e626a60771e86e26ce0b72f702ed9fd6ba4bc9ebf0a4143d4e42a7b40a3d7f8facc05ad5869b453e733d8b1d6e26b3475793fe4090015aaeff18d97ca08dbe5657bc84034f7851080b98d131951896c363c1819a61aecf7bce99370bc635b1549766a6b2c175e1387067809f87d6b2b1ec589cb79417a027084134a326c9ab3098f746d3d008f7395f61914ca9d724550abc4a7f5dcbd607cd6d14"]}) (async) pipe2$watch_queue(&(0x7f00000000c0), 0x80) (async) socket$rxrpc(0x21, 0x2, 0x2) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r8, 0x110, 0x3) (async) setsockopt$RXRPC_SECURITY_KEY(r8, 0x110, 0x1, &(0x7f0000000040)='\x00', 0x1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) (async) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="001cdfa50800000006001c0009000000080011001c0000000100120040bf0000050014008500000006000200000000004a05ed7677c6b451b72a3c139e66e122d3a9cbbfbd1bb79d85fe44be5f5ad8f6a3b9b7c6446891decb7d048dd4c90fd0b838475b9871f8213ecba331cfd9fc08e4d9e9b0ca1ebe29c60c5a90acd424f8d690a46ed5ea16087a58612be6fd1339575a4253ee02b34f8eea11dcdcabc23e2882b9f569"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c014) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7f}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x11a}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PEER_CONN_ID={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x8044}, 0x6) (async) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5451, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x300000000000000}, 0x48) 01:03:53 executing program 2: r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) setsockopt$sock_timeval(r0, 0x1, 0x57, &(0x7f0000000000)={0x0, 0x2710}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5452, &(0x7f00000000c0)={r1}) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400000000000000}, 0x48) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 2: r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) (async) setsockopt$sock_timeval(r0, 0x1, 0x57, &(0x7f0000000000)={0x0, 0x2710}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x82, 0x1}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5460, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x500000000000000}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x0, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x82, 0x1}, 0x48) 01:03:53 executing program 2: r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) (async) setsockopt$sock_timeval(r0, 0x1, 0x57, &(0x7f0000000000)={0x0, 0x2710}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x40049409, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x600000000000000}, 0x48) 01:03:53 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x82, 0x1}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x0, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:53 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) setsockopt$inet_dccp_int(r0, 0x21, 0x1, &(0x7f0000000000)=0x1, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000002, 0x2, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x0, 0x102000}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x4020940d, &(0x7f00000000c0)={r1}) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x700000000000000}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x0, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x800000000000000}, 0x48) 01:03:53 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="65727370616e300000cae63ac23d2c00", @ANYRES32=0x0, @ANYBLOB="00010010000000070000000143ee004c00640000f32f9078ac1e0101ac14142d440c84a3ac14142e00000004442c5511ac14141500000006e000000100000400e000000200000401640101020000003f0a01010000000000"]}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f0000000340), 0x9, 0x171482) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) bind$isdn_base(r2, &(0x7f00000002c0)={0x22, 0x37, 0x2, 0xc0, 0x1}, 0x6) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@private, @in6=@private2}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) 01:03:53 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) setsockopt$inet_dccp_int(r0, 0x21, 0x1, &(0x7f0000000000)=0x1, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000002, 0x2, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x0, 0x102000}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000002, 0x2, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x0, 0x102000}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0045878, &(0x7f00000000c0)={r1}) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x900000000000000}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0045878, &(0x7f00000000c0)={r1}) 01:03:53 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="65727370616e300000cae63ac23d2c00", @ANYRES32=0x0, @ANYBLOB="00010010000000070000000143ee004c00640000f32f9078ac1e0101ac14142d440c84a3ac14142e00000004442c5511ac14141500000006e000000100000400e000000200000401640101020000003f0a01010000000000"]}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f0000000340), 0x9, 0x171482) (async, rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async, rerun: 32) bind$isdn_base(r2, &(0x7f00000002c0)={0x22, 0x37, 0x2, 0xc0, 0x1}, 0x6) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@private, @in6=@private2}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) 01:03:53 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) setsockopt$inet_dccp_int(r0, 0x21, 0x1, &(0x7f0000000000)=0x1, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000002, 0x2, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x0, 0x102000}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) setsockopt$inet_dccp_int(r0, 0x21, 0x1, &(0x7f0000000000)=0x1, 0x4) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000002, 0x2, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x0, 0x102000}, 0x48) (async) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464c9, &(0x7f00000000c0)={r1}) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xa00000000000000}, 0x48) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0045878, &(0x7f00000000c0)={r1}) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0189436, &(0x7f00000000c0)={r1}) 01:03:53 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="65727370616e300000cae63ac23d2c00", @ANYRES32=0x0, @ANYBLOB="00010010000000070000000143ee004c00640000f32f9078ac1e0101ac14142d440c84a3ac14142e00000004442c5511ac14141500000006e000000100000400e000000200000401640101020000003f0a01010000000000"]}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f0000000340), 0x9, 0x171482) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) bind$isdn_base(r2, &(0x7f00000002c0)={0x22, 0x37, 0x2, 0xc0, 0x1}, 0x6) (async, rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (rerun: 64) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@private, @in6=@private2}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xb00000000000000}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc020660b, &(0x7f00000000c0)={r1}) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x0, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="69705f76746930000008000000000200109ff89a038a523025370047b44825c186b65aa5abe77a78ba05c583366433696e31a7e08c63630ce3c7bd1452d07d0ba69952c0fc79742b987e22c886dbc4d788c2c237c0bdd02ecee1066b3a40a4b83814ab8d8930648f102423460a23aecfd5d897c362917a46e94de46794e5af4b7e28dd3436", @ANYRES32=0x0, @ANYBLOB="000000010000008000000009451e00d400650000b32990780a010100ac14142889230bac1414bbac1414bbac1e0101ac1e01017f000001ac1414aaac1e010164010101008907ee0a0101004424c8c00000000700000001000000a80081008000090000000186330000000002074dece2102f020868a04affecea070df79cbe7be0f2f3ba78ded7070340060ef62c8eebb4786c488e4d8c79014424c3310a010100000001000a010101000000010a0101020000000100000000000000050717e9e0000002e0000001640101010000000000000000000000000000100000000000"]}) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0xff, 0x600042) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4d, 0xffff, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="69705f76746930000008000000000200109ff89a038a523025370047b44825c186b65aa5abe77a78ba05c583366433696e31a7e08c63630ce3c7bd1452d07d0ba69952c0fc79742b987e22c886dbc4d788c2c237c0bdd02ecee1066b3a40a4b83814ab8d8930648f102423460a23aecfd5d897c362917a46e94de46794e5af4b7e28dd3436", @ANYRES32=0x0, @ANYBLOB="000000010000008000000009451e00d400650000b32990780a010100ac14142889230bac1414bbac1414bbac1e0101ac1e01017f000001ac1414aaac1e010164010101008907ee0a0101004424c8c00000000700000001000000a80081008000090000000186330000000002074dece2102f020868a04affecea070df79cbe7be0f2f3ba78ded7070340060ef62c8eebb4786c488e4d8c79014424c3310a010100000001000a010101000000010a0101020000000100000000000000050717e9e0000002e0000001640101010000000000000000000000000000100000000000"]}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="69705f76746930000008000000000200109ff89a038a523025370047b44825c186b65aa5abe77a78ba05c583366433696e31a7e08c63630ce3c7bd1452d07d0ba69952c0fc79742b987e22c886dbc4d788c2c237c0bdd02ecee1066b3a40a4b83814ab8d8930648f102423460a23aecfd5d897c362917a46e94de46794e5af4b7e28dd3436", @ANYRES32=0x0, @ANYBLOB="000000010000008000000009451e00d400650000b32990780a010100ac14142889230bac1414bbac1414bbac1e0101ac1e01017f000001ac1414aaac1e010164010101008907ee0a0101004424c8c00000000700000001000000a80081008000090000000186330000000002074dece2102f020868a04affecea070df79cbe7be0f2f3ba78ded7070340060ef62c8eebb4786c488e4d8c79014424c3310a010100000001000a010101000000010a0101020000000100000000000000050717e9e0000002e0000001640101010000000000000000000000000000100000000000"]}) (async) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xc00000000000000}, 0x48) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) (fail_nth: 1) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xd00000000000000}, 0x48) 01:03:53 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="69705f76746930000008000000000200109ff89a038a523025370047b44825c186b65aa5abe77a78ba05c583366433696e31a7e08c63630ce3c7bd1452d07d0ba69952c0fc79742b987e22c886dbc4d788c2c237c0bdd02ecee1066b3a40a4b83814ab8d8930648f102423460a23aecfd5d897c362917a46e94de46794e5af4b7e28dd3436", @ANYRES32=0x0, @ANYBLOB="000000010000008000000009451e00d400650000b32990780a010100ac14142889230bac1414bbac1414bbac1e0101ac1e01017f000001ac1414aaac1e010164010101008907ee0a0101004424c8c00000000700000001000000a80081008000090000000186330000000002074dece2102f020868a04affecea070df79cbe7be0f2f3ba78ded7070340060ef62c8eebb4786c488e4d8c79014424c3310a010100000001000a010101000000010a0101020000000100000000000000050717e9e0000002e0000001640101010000000000000000000000000000100000000000"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="69705f76746930000008000000000200109ff89a038a523025370047b44825c186b65aa5abe77a78ba05c583366433696e31a7e08c63630ce3c7bd1452d07d0ba69952c0fc79742b987e22c886dbc4d788c2c237c0bdd02ecee1066b3a40a4b83814ab8d8930648f102423460a23aecfd5d897c362917a46e94de46794e5af4b7e28dd3436", @ANYRES32=0x0, @ANYBLOB="000000010000008000000009451e00d400650000b32990780a010100ac14142889230bac1414bbac1414bbac1e0101ac1e01017f000001ac1414aaac1e010164010101008907ee0a0101004424c8c00000000700000001000000a80081008000090000000186330000000002074dece2102f020868a04affecea070df79cbe7be0f2f3ba78ded7070340060ef62c8eebb4786c488e4d8c79014424c3310a010100000001000a010101000000010a0101020000000100000000000000050717e9e0000002e0000001640101010000000000000000000000000000100000000000"]}) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0xff, 0x600042) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4d, 0xffff, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000080), 0xff, 0x600042) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4d, 0xffff, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 0: bpf$MAP_CREATE(0x2, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xe00000000000000}, 0x48) 01:03:53 executing program 4: ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000000)) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x100, 0xfffffffb, 0x7, 0x2c, 0xffffffffffffffff, 0x9, '\x00', 0x0, r0, 0x5, 0x5, 0x5}, 0x48) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 01:03:53 executing program 0: bpf$MAP_CREATE(0x3, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) syz_open_dev$dri(&(0x7f0000000080), 0xff, 0x600042) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4d, 0xffff, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:53 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf00000000000000}, 0x48) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 01:03:53 executing program 4: ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000000)) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x100, 0xfffffffb, 0x7, 0x2c, 0xffffffffffffffff, 0x9, '\x00', 0x0, r0, 0x5, 0x5, 0x5}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x100, 0xfffffffb, 0x7, 0x2c, 0xffffffffffffffff, 0x9, '\x00', 0x0, r0, 0x5, 0x5, 0x5}, 0x48) 01:03:53 executing program 0: bpf$MAP_CREATE(0x4, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x48) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf73addae785cbfe7403542cba8f40ab75e6e224815593ea18bb904084ec767547f4b1261c5ca82a80583d23434e8a660", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000040)=r2) 01:03:53 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000340)={0x8009, 0x97, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept$nfc_llcp(r2, &(0x7f0000000280), &(0x7f0000000080)=0x60) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000140)) 01:03:54 executing program 0: bpf$MAP_CREATE(0x5, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 4: ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000000)) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x100, 0xfffffffb, 0x7, 0x2c, 0xffffffffffffffff, 0x9, '\x00', 0x0, r0, 0x5, 0x5, 0x5}, 0x48) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x48) 01:03:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x48) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf73addae785cbfe7403542cba8f40ab75e6e224815593ea18bb904084ec767547f4b1261c5ca82a80583d23434e8a660", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000040)=r2) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000340)={0x8009, 0x97, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) accept$nfc_llcp(r2, &(0x7f0000000280), &(0x7f0000000080)=0x60) (async, rerun: 64) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000140)) (rerun: 64) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100000000000000}, 0x48) 01:03:54 executing program 4: socket$nl_crypto(0x10, 0x3, 0x15) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) socketpair(0x10, 0x0, 0xedd1, &(0x7f0000000000)={0xffffffffffffffff}) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000100)=0x14) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000340)={0x8009, 0x97, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept$nfc_llcp(r2, &(0x7f0000000280), &(0x7f0000000080)=0x60) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000140)) 01:03:54 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000003c0)=0x6, 0x4) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$PPPIOCSDEBUG(r2, 0x40047440, &(0x7f0000000440)=0x4) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000004c0)={{0x2, 0x3, 0x6, 0xf89cb1495647367f, 0x59cddc15}}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) recvfrom$packet(r0, &(0x7f0000000280)=""/100, 0x64, 0x40002001, &(0x7f0000000340)={0x11, 0x8, 0x0, 0x1, 0x6}, 0x14) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000400)=0xfb1, 0xff98) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x26, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000140)={0xffffffffffffffff}, 0x1, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2b}}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r5, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r6}}, 0x18) clock_gettime(0x5, &(0x7f0000000480)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) socket$nl_xfrm(0x10, 0x3, 0x6) setpriority(0x0, 0x0, 0x0) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) 01:03:54 executing program 4: socket$nl_crypto(0x10, 0x3, 0x15) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) socketpair(0x10, 0x0, 0xedd1, &(0x7f0000000000)={0xffffffffffffffff}) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000100)=0x14) 01:03:54 executing program 0: bpf$MAP_CREATE(0x6, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x48) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf73addae785cbfe7403542cba8f40ab75e6e224815593ea18bb904084ec767547f4b1261c5ca82a80583d23434e8a660", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000040)=r2) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1200000000000000}, 0x48) 01:03:54 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000003c0)=0x6, 0x4) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async, rerun: 64) ioctl$PPPIOCSDEBUG(r2, 0x40047440, &(0x7f0000000440)=0x4) (async, rerun: 64) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000004c0)={{0x2, 0x3, 0x6, 0xf89cb1495647367f, 0x59cddc15}}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) recvfrom$packet(r0, &(0x7f0000000280)=""/100, 0x64, 0x40002001, &(0x7f0000000340)={0x11, 0x8, 0x0, 0x1, 0x6}, 0x14) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000400)=0xfb1, 0xff98) (async, rerun: 32) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x26, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 32) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async, rerun: 64) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000140)={0xffffffffffffffff}, 0x1, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2b}}}}, 0xa0) (rerun: 64) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r5, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r6}}, 0x18) (async) clock_gettime(0x5, &(0x7f0000000480)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async, rerun: 32) socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 32) setpriority(0x0, 0x0, 0x0) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (fail_nth: 1) 01:03:54 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000000)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e3000008000200000000000000000000081c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493eeaf1b1376b3e95a8f87c2569df4ee5d794b027cd6ec26f1c42ecfc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf741376c16264dbc", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1e, 0x6, 0x1, 0x28b7fe, 0x4, r5, 0xbee10, '\x00', 0x0, r6, 0x1, 0x2, 0x2}, 0x48) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$PPPIOCATTACH(r6, 0x4004743d, &(0x7f00000007c0)=0x1) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r9) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x5, 0xfffffffe, 0x1, 0x802, r6, 0x9501, '\x00', r4, r5, 0x3, 0x1, 0x3, 0x1}, 0x48) pipe2$watch_queue(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x19, 0xf, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, [@alu={0x7, 0x1, 0x0, 0x9, 0x1, 0x0, 0x18}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0xfffeffff}, @map_val={0x18, 0x4, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0xb1}, @map_val={0x18, 0x5, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xffff8000}, @exit, @generic={0x35, 0x6, 0x3, 0x5242, 0x3}, @map_fd={0x18, 0x8, 0x1, 0x0, r5}, @call={0x85, 0x0, 0x0, 0x16}]}, &(0x7f0000000280)='syzkaller\x00', 0xfffff800, 0x99, &(0x7f0000000380)=""/153, 0x41000, 0xd, '\x00', r8, 0x13, r9, 0x8, &(0x7f0000000480)={0x6, 0x4}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x10, 0x62}, 0x10, 0xffffffffffffffff, r10, 0x0, &(0x7f0000000700)=[r11, r12]}, 0x80) 01:03:54 executing program 4: socket$nl_crypto(0x10, 0x3, 0x15) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) socketpair(0x10, 0x0, 0xedd1, &(0x7f0000000000)={0xffffffffffffffff}) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000100)=0x14) socket$nl_crypto(0x10, 0x3, 0x15) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) socketpair(0x10, 0x0, 0xedd1, &(0x7f0000000000)) (async) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000100)=0x14) (async) 01:03:54 executing program 0: bpf$MAP_CREATE(0x7, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1300000000000000}, 0x48) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:54 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000040)={'ip_vti0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x1, 0x80, 0x1c0, 0x9, {{0xc, 0x4, 0x3, 0x1, 0x30, 0x66, 0x0, 0x7f, 0x29, 0x0, @remote, @rand_addr=0x64010102, {[@ra={0x94, 0x4}, @timestamp_addr={0x44, 0x4, 0x58, 0x1, 0x6}, @noop, @timestamp={0x44, 0x10, 0xc6, 0x0, 0x9, [0x20080000, 0x0, 0x7]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x10000, 0x1, 0x480, r0, 0x3, '\x00', r1, 0xffffffffffffffff, 0x3, 0x2, 0x2, 0x6}, 0x48) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000000180)=0x4) 01:03:54 executing program 0: bpf$MAP_CREATE(0x8, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000003c0)=0x6, 0x4) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$PPPIOCSDEBUG(r2, 0x40047440, &(0x7f0000000440)=0x4) (async, rerun: 32) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) (async, rerun: 32) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000004c0)={{0x2, 0x3, 0x6, 0xf89cb1495647367f, 0x59cddc15}}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) recvfrom$packet(r0, &(0x7f0000000280)=""/100, 0x64, 0x40002001, &(0x7f0000000340)={0x11, 0x8, 0x0, 0x1, 0x6}, 0x14) (async, rerun: 64) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000400)=0xfb1, 0xff98) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x26, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000140)={0xffffffffffffffff}, 0x1, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2b}}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r5, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r6}}, 0x18) (async, rerun: 64) clock_gettime(0x5, &(0x7f0000000480)) (rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) setpriority(0x0, 0x0, 0x0) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1400000000000000}, 0x48) 01:03:54 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) socket$rxrpc(0x21, 0x2, 0x2) (async) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000000)={r1}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e3000008000200000000000000000000081c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493eeaf1b1376b3e95a8f87c2569df4ee5d794b027cd6ec26f1c42ecfc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf741376c16264dbc", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e3000008000200000000000000000000081c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493eeaf1b1376b3e95a8f87c2569df4ee5d794b027cd6ec26f1c42ecfc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf741376c16264dbc", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000100), 0x80) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f00000001c0), 0x80) (async) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1e, 0x6, 0x1, 0x28b7fe, 0x4, r5, 0xbee10, '\x00', 0x0, r6, 0x1, 0x2, 0x2}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1e, 0x6, 0x1, 0x28b7fe, 0x4, r5, 0xbee10, '\x00', 0x0, r6, 0x1, 0x2, 0x2}, 0x48) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$PPPIOCATTACH(r6, 0x4004743d, &(0x7f00000007c0)=0x1) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r9) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x5, 0xfffffffe, 0x1, 0x802, r6, 0x9501, '\x00', r4, r5, 0x3, 0x1, 0x3, 0x1}, 0x48) pipe2$watch_queue(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x19, 0xf, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, [@alu={0x7, 0x1, 0x0, 0x9, 0x1, 0x0, 0x18}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0xfffeffff}, @map_val={0x18, 0x4, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0xb1}, @map_val={0x18, 0x5, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xffff8000}, @exit, @generic={0x35, 0x6, 0x3, 0x5242, 0x3}, @map_fd={0x18, 0x8, 0x1, 0x0, r5}, @call={0x85, 0x0, 0x0, 0x16}]}, &(0x7f0000000280)='syzkaller\x00', 0xfffff800, 0x99, &(0x7f0000000380)=""/153, 0x41000, 0xd, '\x00', r8, 0x13, r9, 0x8, &(0x7f0000000480)={0x6, 0x4}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x10, 0x62}, 0x10, 0xffffffffffffffff, r10, 0x0, &(0x7f0000000700)=[r11, r12]}, 0x80) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x2, &(0x7f00000000c0)={r1}) 01:03:54 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000040)={'ip_vti0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x1, 0x80, 0x1c0, 0x9, {{0xc, 0x4, 0x3, 0x1, 0x30, 0x66, 0x0, 0x7f, 0x29, 0x0, @remote, @rand_addr=0x64010102, {[@ra={0x94, 0x4}, @timestamp_addr={0x44, 0x4, 0x58, 0x1, 0x6}, @noop, @timestamp={0x44, 0x10, 0xc6, 0x0, 0x9, [0x20080000, 0x0, 0x7]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x10000, 0x1, 0x480, r0, 0x3, '\x00', r1, 0xffffffffffffffff, 0x3, 0x2, 0x2, 0x6}, 0x48) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async, rerun: 64) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000000180)=0x4) (rerun: 64) 01:03:54 executing program 0: bpf$MAP_CREATE(0x9, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0xf3d8, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0x100000000, 0xa80) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1800000000000000}, 0x48) 01:03:54 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000000)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e3000008000200000000000000000000081c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493eeaf1b1376b3e95a8f87c2569df4ee5d794b027cd6ec26f1c42ecfc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf741376c16264dbc", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1e, 0x6, 0x1, 0x28b7fe, 0x4, r5, 0xbee10, '\x00', 0x0, r6, 0x1, 0x2, 0x2}, 0x48) (async) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$PPPIOCATTACH(r6, 0x4004743d, &(0x7f00000007c0)=0x1) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) (async) getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r9) (async) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x5, 0xfffffffe, 0x1, 0x802, r6, 0x9501, '\x00', r4, r5, 0x3, 0x1, 0x3, 0x1}, 0x48) (async) pipe2$watch_queue(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x19, 0xf, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, [@alu={0x7, 0x1, 0x0, 0x9, 0x1, 0x0, 0x18}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0xfffeffff}, @map_val={0x18, 0x4, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0xb1}, @map_val={0x18, 0x5, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xffff8000}, @exit, @generic={0x35, 0x6, 0x3, 0x5242, 0x3}, @map_fd={0x18, 0x8, 0x1, 0x0, r5}, @call={0x85, 0x0, 0x0, 0x16}]}, &(0x7f0000000280)='syzkaller\x00', 0xfffff800, 0x99, &(0x7f0000000380)=""/153, 0x41000, 0xd, '\x00', r8, 0x13, r9, 0x8, &(0x7f0000000480)={0x6, 0x4}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x10, 0x62}, 0x10, 0xffffffffffffffff, r10, 0x0, &(0x7f0000000700)=[r11, r12]}, 0x80) 01:03:54 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000040)={'ip_vti0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x1, 0x80, 0x1c0, 0x9, {{0xc, 0x4, 0x3, 0x1, 0x30, 0x66, 0x0, 0x7f, 0x29, 0x0, @remote, @rand_addr=0x64010102, {[@ra={0x94, 0x4}, @timestamp_addr={0x44, 0x4, 0x58, 0x1, 0x6}, @noop, @timestamp={0x44, 0x10, 0xc6, 0x0, 0x9, [0x20080000, 0x0, 0x7]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x10000, 0x1, 0x480, r0, 0x3, '\x00', r1, 0xffffffffffffffff, 0x3, 0x2, 0x2, 0x6}, 0x48) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000000180)=0x4) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5421, &(0x7f00000000c0)={r1}) 01:03:54 executing program 0: bpf$MAP_CREATE(0xa, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x200000c8) 01:03:54 executing program 5: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0xf3d8, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0x100000000, 0xa80) 01:03:54 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, r0}, 0x48) 01:03:54 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000280)) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000240)={'macvtap0\x00', @remote}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xffff, 0x7ff, 0x1, 0x808, r0, 0x81, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x3}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmsg$nl_crypto(r6, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)=@del={0xe8, 0x11, 0x0, 0x70bd26, 0x25dfdbfb, {{'ecb(cast6)\x00'}, '\x00', '\x00', 0x2000, 0x2000}, [{0x8, 0x1, 0x7}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40010}, 0x40004011) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xf, 0x3cf2, 0x7, 0x1, 0x10, r3, 0x80, '\x00', r4, r5, 0x1, 0x0, 0x1}, 0x48) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5450, &(0x7f00000000c0)={r1}) 01:03:54 executing program 0: bpf$MAP_CREATE(0xb, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, r0}, 0x48) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0xf3d8, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0x100000000, 0xa80) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0xf3d8, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x100000000, 0xa80) (async) 01:03:54 executing program 1: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0xff, 0x6, 0x41, @ipv4={'\x00', '\xff\xff', @empty}, @empty, 0x7800, 0x40, 0x0, 0x5}}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x0, 0x1, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x8180) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f00000000c0)=0xa4, 0x4) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x200000) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f00000001c0)=""/83) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)) 01:03:54 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000280)) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000240)={'macvtap0\x00', @remote}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xffff, 0x7ff, 0x1, 0x808, r0, 0x81, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x3}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) pipe2$watch_queue(&(0x7f0000000180), 0x80) (async) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmsg$nl_crypto(r6, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)=@del={0xe8, 0x11, 0x0, 0x70bd26, 0x25dfdbfb, {{'ecb(cast6)\x00'}, '\x00', '\x00', 0x2000, 0x2000}, [{0x8, 0x1, 0x7}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40010}, 0x40004011) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xf, 0x3cf2, 0x7, 0x1, 0x10, r3, 0x80, '\x00', r4, r5, 0x1, 0x0, 0x1}, 0x48) 01:03:54 executing program 0: bpf$MAP_CREATE(0xc, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5451, &(0x7f00000000c0)={r1}) 01:03:54 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, r0}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, r0}, 0x48) (async) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x800000044, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:54 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000280)) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000240)={'macvtap0\x00', @remote}) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xffff, 0x7ff, 0x1, 0x808, r0, 0x81, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x3}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) (async) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmsg$nl_crypto(r6, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)=@del={0xe8, 0x11, 0x0, 0x70bd26, 0x25dfdbfb, {{'ecb(cast6)\x00'}, '\x00', '\x00', 0x2000, 0x2000}, [{0x8, 0x1, 0x7}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40010}, 0x40004011) (async) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xf, 0x3cf2, 0x7, 0x1, 0x10, r3, 0x80, '\x00', r4, r5, 0x1, 0x0, 0x1}, 0x48) 01:03:54 executing program 1: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0xff, 0x6, 0x41, @ipv4={'\x00', '\xff\xff', @empty}, @empty, 0x7800, 0x40, 0x0, 0x5}}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x0, 0x1, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x8180) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) (async) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f00000000c0)=0xa4, 0x4) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x200000) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) (async) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f00000001c0)=""/83) (async) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5452, &(0x7f00000000c0)={r1}) 01:03:54 executing program 0: bpf$MAP_CREATE(0xd, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x800000044, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:54 executing program 4: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r1, 0xe4) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000040)=r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x5460, &(0x7f00000000c0)={r1}) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x800000044, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 32) 01:03:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:54 executing program 0: bpf$MAP_CREATE(0xe, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:54 executing program 1: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0xff, 0x6, 0x41, @ipv4={'\x00', '\xff\xff', @empty}, @empty, 0x7800, 0x40, 0x0, 0x5}}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x0, 0x1, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x0, 0x1, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x8180) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f00000000c0)=0xa4, 0x4) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x200000) (async) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x200000) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f00000001c0)=""/83) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)) 01:03:54 executing program 4: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r1, 0xe4) (async) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000040)=r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:54 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x40049409, &(0x7f00000000c0)={r1}) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0xa, 0x9b, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xa8, 0x7fd, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000480)='/dev/drk/card#\x006\xa8(\xab\t\xc4\x0f\x9c\xae\xb6\x90a\x84\x0e\x81#\x9a=\xfcZ\x17\xc4-\xf6\xb6\xc6a\x85\x9f\x99\x9f\xeeE\x9cGv\v\xc5\xb6\x00\x00\x00\x00\x00\x00\x00\x00\'\xaaX_\v\x96\'\x0e\x81\x1b\xaf\x80O\x1c\xe0\x8f|\x89g\xb0c\x10%\xaf\x00\x00\x00\x00|\x86\xb1=y6\xb8o\xa5\x01\xf0\xa4\xd3\x87\xa6\x82\xc6\xab\x9c\xac-\x82\xc3\xa7\f\xf69fp\xe7\xf5\x87\xe0\xa0Z\x1d\n\x0ec.\xef\x03\xfd6\xb0h\xdb\x81\xdbg\xe1\xf9\xac\x182\xa9\xc2\x84\xdd\b\x8a\x00\x00\x00\x00\x00\x00\x00\x00\xb0\'\x97d\xa5\xa8w#\xb8\xca\x1d??\a\xd5J\xc6\x91\xbby\x8c%\xccn\xc9\x83K\xa5t\xdc\xfe\xc8\x13\t\x1d\xa4\xf6\xa9X\x8f\xad\xdf\xc8<\xa3\x03\"\x85\xa7S\xad\x18\xf0\x19\x11`+\xb2\xe1\xdba\xdf\xd1\x9d\x13\x98\xf6a\x9b0\x87\x10\xda\xb8\x9f\xc8c\xf5\xda\xd6\xfeb,OO\x9a\xbb>\x03v\xfbU\xfcs3!YN\x81?\xb21\xeb\x01\xa6\xb8\xda#\x13\x96A\xbeN\x98J\x1b\xac\x8e\xe3\x9b\xc0\xf2\xe0\xf2\xeb\xbf\xc3_,\x83\xa2\xba\x1d\xe6p\x11\x18\xfb\x03\xdd\x95\x8eO\xe9a\r\xeb\xa7\xf1\xc7t\xbb\v\xfd8\xa9\x91.\xe6\xc4\xce\xbf\x1a\xbc;{\xf4\xb6\nT\xdei\xc6I\xedC}\xc6\xc5\xd5A\xc9x\x9e\xa1\x83\xc6k#\xde\xf1\xa6\xa3P\x86\xf4e\xeb@\xc2>\xe1\xdf\x91g\xd8\x01OkRTmw\x9c\x9f4[$\x9dwS\xa1%\x14\xc9\xe0\xce\r\xcf\x06e\xca\x18q\x87=\xa9\x1c\xe6\f\xf7\xbd\xe5\v\xeda\x03\xce\xe4\x84\xb6TP\xd1\xd4\xf3\xba\x00$\xdd\n\r\x10\xe5b\x9e\xb8+D\xef\x85B\x8f\xe2\xa6\x19\x0f\x81\x8cZ\xb0\x99\xe8\xd2d&9\x82\x0fDz\xe8\xe6\xe4\xda\xeb\x90\xb9\xb2+\xf7\x8b\xb8q*\xe9\x80b\xec\xf6\xa56q\xbb\xd3\xdc\xe7d(\x88\xc5\xeajD\x85\x00{\xc2\x90 \xe0\n4W\x97X\xdf{\xc0f~\x7f\x8dF\xfc\x83Y\xe0\xb4\x86\xde\xf9I\xf6\xf3\x05\xa8\x8cnf\xdf\xb1\xc1\xe8;;\x94\xca\x97\x17%F\xb1fb\xef\x83L\xbf\x9f\x06\xcd\xeaG\x01\xac\x0e\x13\xf2\xfc\x93\x17\xd0\x96Z\x98\xb3^\xad\xa6<\xf8\x19@\x88\xd6F\xf1\xba\xa4\xf7\x13\xef\x83\x01\xfc0Q\xba\x89t\x81\xc1\x8fL\xa5\xa1\xef{0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r1, 0xe4) (async) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000040)=r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0xa, 0x9b, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xa8, 0x7fd, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000480)='/dev/drk/card#\x006\xa8(\xab\t\xc4\x0f\x9c\xae\xb6\x90a\x84\x0e\x81#\x9a=\xfcZ\x17\xc4-\xf6\xb6\xc6a\x85\x9f\x99\x9f\xeeE\x9cGv\v\xc5\xb6\x00\x00\x00\x00\x00\x00\x00\x00\'\xaaX_\v\x96\'\x0e\x81\x1b\xaf\x80O\x1c\xe0\x8f|\x89g\xb0c\x10%\xaf\x00\x00\x00\x00|\x86\xb1=y6\xb8o\xa5\x01\xf0\xa4\xd3\x87\xa6\x82\xc6\xab\x9c\xac-\x82\xc3\xa7\f\xf69fp\xe7\xf5\x87\xe0\xa0Z\x1d\n\x0ec.\xef\x03\xfd6\xb0h\xdb\x81\xdbg\xe1\xf9\xac\x182\xa9\xc2\x84\xdd\b\x8a\x00\x00\x00\x00\x00\x00\x00\x00\xb0\'\x97d\xa5\xa8w#\xb8\xca\x1d??\a\xd5J\xc6\x91\xbby\x8c%\xccn\xc9\x83K\xa5t\xdc\xfe\xc8\x13\t\x1d\xa4\xf6\xa9X\x8f\xad\xdf\xc8<\xa3\x03\"\x85\xa7S\xad\x18\xf0\x19\x11`+\xb2\xe1\xdba\xdf\xd1\x9d\x13\x98\xf6a\x9b0\x87\x10\xda\xb8\x9f\xc8c\xf5\xda\xd6\xfeb,OO\x9a\xbb>\x03v\xfbU\xfcs3!YN\x81?\xb21\xeb\x01\xa6\xb8\xda#\x13\x96A\xbeN\x98J\x1b\xac\x8e\xe3\x9b\xc0\xf2\xe0\xf2\xeb\xbf\xc3_,\x83\xa2\xba\x1d\xe6p\x11\x18\xfb\x03\xdd\x95\x8eO\xe9a\r\xeb\xa7\xf1\xc7t\xbb\v\xfd8\xa9\x91.\xe6\xc4\xce\xbf\x1a\xbc;{\xf4\xb6\nT\xdei\xc6I\xedC}\xc6\xc5\xd5A\xc9x\x9e\xa1\x83\xc6k#\xde\xf1\xa6\xa3P\x86\xf4e\xeb@\xc2>\xe1\xdf\x91g\xd8\x01OkRTmw\x9c\x9f4[$\x9dwS\xa1%\x14\xc9\xe0\xce\r\xcf\x06e\xca\x18q\x87=\xa9\x1c\xe6\f\xf7\xbd\xe5\v\xeda\x03\xce\xe4\x84\xb6TP\xd1\xd4\xf3\xba\x00$\xdd\n\r\x10\xe5b\x9e\xb8+D\xef\x85B\x8f\xe2\xa6\x19\x0f\x81\x8cZ\xb0\x99\xe8\xd2d&9\x82\x0fDz\xe8\xe6\xe4\xda\xeb\x90\xb9\xb2+\xf7\x8b\xb8q*\xe9\x80b\xec\xf6\xa56q\xbb\xd3\xdc\xe7d(\x88\xc5\xeajD\x85\x00{\xc2\x90 \xe0\n4W\x97X\xdf{\xc0f~\x7f\x8dF\xfc\x83Y\xe0\xb4\x86\xde\xf9I\xf6\xf3\x05\xa8\x8cnf\xdf\xb1\xc1\xe8;;\x94\xca\x97\x17%F\xb1fb\xef\x83L\xbf\x9f\x06\xcd\xeaG\x01\xac\x0e\x13\xf2\xfc\x93\x17\xd0\x96Z\x98\xb3^\xad\xa6<\xf8\x19@\x88\xd6F\xf1\xba\xa4\xf7\x13\xef\x83\x01\xfc0Q\xba\x89t\x81\xc1\x8fL\xa5\xa1\xef{\xa4\xd3\x87\xa6\x82\xc6\xab\x9c\xac-\x82\xc3\xa7\f\xf69fp\xe7\xf5\x87\xe0\xa0Z\x1d\n\x0ec.\xef\x03\xfd6\xb0h\xdb\x81\xdbg\xe1\xf9\xac\x182\xa9\xc2\x84\xdd\b\x8a\x00\x00\x00\x00\x00\x00\x00\x00\xb0\'\x97d\xa5\xa8w#\xb8\xca\x1d??\a\xd5J\xc6\x91\xbby\x8c%\xccn\xc9\x83K\xa5t\xdc\xfe\xc8\x13\t\x1d\xa4\xf6\xa9X\x8f\xad\xdf\xc8<\xa3\x03\"\x85\xa7S\xad\x18\xf0\x19\x11`+\xb2\xe1\xdba\xdf\xd1\x9d\x13\x98\xf6a\x9b0\x87\x10\xda\xb8\x9f\xc8c\xf5\xda\xd6\xfeb,OO\x9a\xbb>\x03v\xfbU\xfcs3!YN\x81?\xb21\xeb\x01\xa6\xb8\xda#\x13\x96A\xbeN\x98J\x1b\xac\x8e\xe3\x9b\xc0\xf2\xe0\xf2\xeb\xbf\xc3_,\x83\xa2\xba\x1d\xe6p\x11\x18\xfb\x03\xdd\x95\x8eO\xe9a\r\xeb\xa7\xf1\xc7t\xbb\v\xfd8\xa9\x91.\xe6\xc4\xce\xbf\x1a\xbc;{\xf4\xb6\nT\xdei\xc6I\xedC}\xc6\xc5\xd5A\xc9x\x9e\xa1\x83\xc6k#\xde\xf1\xa6\xa3P\x86\xf4e\xeb@\xc2>\xe1\xdf\x91g\xd8\x01OkRTmw\x9c\x9f4[$\x9dwS\xa1%\x14\xc9\xe0\xce\r\xcf\x06e\xca\x18q\x87=\xa9\x1c\xe6\f\xf7\xbd\xe5\v\xeda\x03\xce\xe4\x84\xb6TP\xd1\xd4\xf3\xba\x00$\xdd\n\r\x10\xe5b\x9e\xb8+D\xef\x85B\x8f\xe2\xa6\x19\x0f\x81\x8cZ\xb0\x99\xe8\xd2d&9\x82\x0fDz\xe8\xe6\xe4\xda\xeb\x90\xb9\xb2+\xf7\x8b\xb8q*\xe9\x80b\xec\xf6\xa56q\xbb\xd3\xdc\xe7d(\x88\xc5\xeajD\x85\x00{\xc2\x90 \xe0\n4W\x97X\xdf{\xc0f~\x7f\x8dF\xfc\x83Y\xe0\xb4\x86\xde\xf9I\xf6\xf3\x05\xa8\x8cnf\xdf\xb1\xc1\xe8;;\x94\xca\x97\x17%F\xb1fb\xef\x83L\xbf\x9f\x06\xcd\xeaG\x01\xac\x0e\x13\xf2\xfc\x93\x17\xd0\x96Z\x98\xb3^\xad\xa6<\xf8\x19@\x88\xd6F\xf1\xba\xa4\xf7\x13\xef\x83\x01\xfc0Q\xba\x89t\x81\xc1\x8fL\xa5\xa1\xef{0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0x4020940d, &(0x7f00000000c0)={r1}) 01:03:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:54 executing program 4: ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x8, 0x40, 0x2, 0x0, {{0x17, 0x4, 0x3, 0x19, 0x5c, 0x68, 0x0, 0x8, 0x4, 0x0, @empty, @rand_addr=0x64010100, {[@timestamp={0x44, 0x18, 0x4a, 0x0, 0x9, [0x3f, 0x5, 0x8, 0x7fff, 0x0]}, @timestamp={0x44, 0x8, 0x5f, 0x0, 0x1, [0x6]}, @generic={0x7, 0xd, "970dcdbdbc1e87e42259b9"}, @rr={0x7, 0x17, 0xa4, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @loopback, @local, @multicast1]}, @noop]}}}}}) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) pipe2$watch_queue(&(0x7f0000000240), 0x80) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r6, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r6, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x101, 0x0, 0x40, 0xffffffffffffffff, 0x1000, '\x00', r6, r2, 0x3, 0x4, 0x0, 0x4000002}, 0x48) 01:03:54 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async, rerun: 64) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x6, 0x3f, 0x1, 0x10, 0x1, 0x80000000, '\x00', 0x0, r0, 0x0, 0x2, 0x0, 0xc}, 0x48) (rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x1af9601c, 0x3cd, 0x200, 0x80, r1, 0x82, '\x00', 0x0, r0, 0x4, 0x1, 0x3}, 0x48) 01:03:54 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0xa, 0x9b, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xa8, 0x7fd, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async, rerun: 64) r2 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000480)='/dev/drk/card#\x006\xa8(\xab\t\xc4\x0f\x9c\xae\xb6\x90a\x84\x0e\x81#\x9a=\xfcZ\x17\xc4-\xf6\xb6\xc6a\x85\x9f\x99\x9f\xeeE\x9cGv\v\xc5\xb6\x00\x00\x00\x00\x00\x00\x00\x00\'\xaaX_\v\x96\'\x0e\x81\x1b\xaf\x80O\x1c\xe0\x8f|\x89g\xb0c\x10%\xaf\x00\x00\x00\x00|\x86\xb1=y6\xb8o\xa5\x01\xf0\xa4\xd3\x87\xa6\x82\xc6\xab\x9c\xac-\x82\xc3\xa7\f\xf69fp\xe7\xf5\x87\xe0\xa0Z\x1d\n\x0ec.\xef\x03\xfd6\xb0h\xdb\x81\xdbg\xe1\xf9\xac\x182\xa9\xc2\x84\xdd\b\x8a\x00\x00\x00\x00\x00\x00\x00\x00\xb0\'\x97d\xa5\xa8w#\xb8\xca\x1d??\a\xd5J\xc6\x91\xbby\x8c%\xccn\xc9\x83K\xa5t\xdc\xfe\xc8\x13\t\x1d\xa4\xf6\xa9X\x8f\xad\xdf\xc8<\xa3\x03\"\x85\xa7S\xad\x18\xf0\x19\x11`+\xb2\xe1\xdba\xdf\xd1\x9d\x13\x98\xf6a\x9b0\x87\x10\xda\xb8\x9f\xc8c\xf5\xda\xd6\xfeb,OO\x9a\xbb>\x03v\xfbU\xfcs3!YN\x81?\xb21\xeb\x01\xa6\xb8\xda#\x13\x96A\xbeN\x98J\x1b\xac\x8e\xe3\x9b\xc0\xf2\xe0\xf2\xeb\xbf\xc3_,\x83\xa2\xba\x1d\xe6p\x11\x18\xfb\x03\xdd\x95\x8eO\xe9a\r\xeb\xa7\xf1\xc7t\xbb\v\xfd8\xa9\x91.\xe6\xc4\xce\xbf\x1a\xbc;{\xf4\xb6\nT\xdei\xc6I\xedC}\xc6\xc5\xd5A\xc9x\x9e\xa1\x83\xc6k#\xde\xf1\xa6\xa3P\x86\xf4e\xeb@\xc2>\xe1\xdf\x91g\xd8\x01OkRTmw\x9c\x9f4[$\x9dwS\xa1%\x14\xc9\xe0\xce\r\xcf\x06e\xca\x18q\x87=\xa9\x1c\xe6\f\xf7\xbd\xe5\v\xeda\x03\xce\xe4\x84\xb6TP\xd1\xd4\xf3\xba\x00$\xdd\n\r\x10\xe5b\x9e\xb8+D\xef\x85B\x8f\xe2\xa6\x19\x0f\x81\x8cZ\xb0\x99\xe8\xd2d&9\x82\x0fDz\xe8\xe6\xe4\xda\xeb\x90\xb9\xb2+\xf7\x8b\xb8q*\xe9\x80b\xec\xf6\xa56q\xbb\xd3\xdc\xe7d(\x88\xc5\xeajD\x85\x00{\xc2\x90 \xe0\n4W\x97X\xdf{\xc0f~\x7f\x8dF\xfc\x83Y\xe0\xb4\x86\xde\xf9I\xf6\xf3\x05\xa8\x8cnf\xdf\xb1\xc1\xe8;;\x94\xca\x97\x17%F\xb1fb\xef\x83L\xbf\x9f\x06\xcd\xeaG\x01\xac\x0e\x13\xf2\xfc\x93\x17\xd0\x96Z\x98\xb3^\xad\xa6<\xf8\x19@\x88\xd6F\xf1\xba\xa4\xf7\x13\xef\x83\x01\xfc0Q\xba\x89t\x81\xc1\x8fL\xa5\xa1\xef{0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0045878, &(0x7f00000000c0)={r1}) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:55 executing program 4: ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x8, 0x40, 0x2, 0x0, {{0x17, 0x4, 0x3, 0x19, 0x5c, 0x68, 0x0, 0x8, 0x4, 0x0, @empty, @rand_addr=0x64010100, {[@timestamp={0x44, 0x18, 0x4a, 0x0, 0x9, [0x3f, 0x5, 0x8, 0x7fff, 0x0]}, @timestamp={0x44, 0x8, 0x5f, 0x0, 0x1, [0x6]}, @generic={0x7, 0xd, "970dcdbdbc1e87e42259b9"}, @rr={0x7, 0x17, 0xa4, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @loopback, @local, @multicast1]}, @noop]}}}}}) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) pipe2$watch_queue(&(0x7f0000000240), 0x80) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r6, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r6, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x101, 0x0, 0x40, 0xffffffffffffffff, 0x1000, '\x00', r6, r2, 0x3, 0x4, 0x0, 0x4000002}, 0x48) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x8, 0x40, 0x2, 0x0, {{0x17, 0x4, 0x3, 0x19, 0x5c, 0x68, 0x0, 0x8, 0x4, 0x0, @empty, @rand_addr=0x64010100, {[@timestamp={0x44, 0x18, 0x4a, 0x0, 0x9, [0x3f, 0x5, 0x8, 0x7fff, 0x0]}, @timestamp={0x44, 0x8, 0x5f, 0x0, 0x1, [0x6]}, @generic={0x7, 0xd, "970dcdbdbc1e87e42259b9"}, @rr={0x7, 0x17, 0xa4, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @loopback, @local, @multicast1]}, @noop]}}}}}) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) (async) pipe2$watch_queue(&(0x7f0000000240), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r6, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r6, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x101, 0x0, 0x40, 0xffffffffffffffff, 0x1000, '\x00', r6, r2, 0x3, 0x4, 0x0, 0x4000002}, 0x48) (async) 01:03:55 executing program 0: bpf$MAP_CREATE(0x12, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1a, 0x1, &(0x7f0000000280)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x3}], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x21, r1, 0x8, &(0x7f0000000340)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0xe, 0x5ab, 0x3}, 0x10, 0xffffffffffffffff, r2, 0x0, &(0x7f0000000400)}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000000800)={0x7, 0x0, [{0x6, 0x10001, 0x7, [0x400, 0x80, 0x68, 0x400, 0x0, 0x4, 0x8, 0x80000000]}, {0x0, 0x80, 0xfa0, [0x1, 0x8, 0x9, 0x3, 0x40, 0x6, 0x24, 0xd1c5]}, {0x5, 0x8, 0x9, [0x0, 0x3f, 0x6, 0xc3a, 0x8, 0x7ff, 0xfffffffe]}, {0x2, 0x400, 0x9, [0x2, 0x8, 0x6, 0x7, 0x1, 0x20, 0x6, 0x334]}, {0x9f, 0x9, 0x1, [0x0, 0x200, 0x6, 0x2, 0x60, 0x10000, 0xbc9, 0x10000]}, {0x8, 0x3, 0x800, [0x401, 0x2, 0x5927, 0xffff, 0x1800000, 0x3, 0x7, 0x1a]}, {0x574, 0x1, 0x5ff, [0x597f, 0xba8c, 0xd2d, 0x7, 0xfffffc00, 0x100, 0x8, 0x1]}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x4, 0x200, 0x0, 0x43d7, 0x800, r0, 0x3, '\x00', 0x0, r2, 0x1, 0x4, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1b, 0x6, &(0x7f0000000400)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x708}, @jmp={0x5, 0x0, 0xd, 0x4, 0x2, 0x8, 0xffffffffffffffff}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x8}], &(0x7f00000004c0)='syzkaller\x00', 0x6, 0xc4, &(0x7f0000000500)=""/196, 0x41000, 0x10, '\x00', 0x0, 0xc, r1, 0x8, &(0x7f0000000600)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xd, 0x8, 0x2}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000740)=[r4, r5, r6, r0, r0, r1, 0xffffffffffffffff, r1, r1, r2]}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000100)={'tunl0\x00', 0x0, 0x10, 0x8000, 0xffffffff, 0x401, {{0x2f, 0x4, 0x1, 0x9, 0xbc, 0x65, 0x0, 0x1, 0x2f, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x46, 0x0, 0x2, [0x6, 0x7f, 0x3, 0x8, 0xffff]}, @rr={0x7, 0x17, 0x51, [@remote, @remote, @remote, @multicast1, @multicast2]}, @noop, @generic={0x89, 0x10, "e1657c929746fc471360cf3dd888"}, @ssrr={0x89, 0x13, 0xba, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x41}, @empty, @broadcast]}, @noop, @cipso={0x86, 0x50, 0x1, [{0x0, 0x11, "e834a1602e59b27c5f92132ce4a620"}, {0x2, 0x8, "92b9f61b2dcb"}, {0x1, 0xd, "dfffffff00000000000000"}, {0x7, 0x7, "e5510b81fb"}, {0x0, 0xb, "02cc228f0e0c2aaa1f"}, {0x2, 0x12, "af57f6a35a4ffb2406e63079db318a0c"}]}, @timestamp_prespec={0x44, 0x4, 0xf2, 0x3, 0x8}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'ip6_vti0\x00', r7, 0x29, 0x1, 0x40, 0x0, 0x0, @remote, @local, 0x40, 0x40, 0x6, 0x9}}) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0045878, &(0x7f00000000c0)={r1}) 01:03:55 executing program 4: ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x8, 0x40, 0x2, 0x0, {{0x17, 0x4, 0x3, 0x19, 0x5c, 0x68, 0x0, 0x8, 0x4, 0x0, @empty, @rand_addr=0x64010100, {[@timestamp={0x44, 0x18, 0x4a, 0x0, 0x9, [0x3f, 0x5, 0x8, 0x7fff, 0x0]}, @timestamp={0x44, 0x8, 0x5f, 0x0, 0x1, [0x6]}, @generic={0x7, 0xd, "970dcdbdbc1e87e42259b9"}, @rr={0x7, 0x17, 0xa4, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @loopback, @local, @multicast1]}, @noop]}}}}}) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) (async) pipe2$watch_queue(&(0x7f0000000240), 0x80) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r6, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r6, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x101, 0x0, 0x40, 0xffffffffffffffff, 0x1000, '\x00', r6, r2, 0x3, 0x4, 0x0, 0x4000002}, 0x48) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) 01:03:55 executing program 0: bpf$MAP_CREATE(0x13, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:55 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1a, 0x1, &(0x7f0000000280)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x3}], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x21, r1, 0x8, &(0x7f0000000340)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0xe, 0x5ab, 0x3}, 0x10, 0xffffffffffffffff, r2, 0x0, &(0x7f0000000400)}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000000800)={0x7, 0x0, [{0x6, 0x10001, 0x7, [0x400, 0x80, 0x68, 0x400, 0x0, 0x4, 0x8, 0x80000000]}, {0x0, 0x80, 0xfa0, [0x1, 0x8, 0x9, 0x3, 0x40, 0x6, 0x24, 0xd1c5]}, {0x5, 0x8, 0x9, [0x0, 0x3f, 0x6, 0xc3a, 0x8, 0x7ff, 0xfffffffe]}, {0x2, 0x400, 0x9, [0x2, 0x8, 0x6, 0x7, 0x1, 0x20, 0x6, 0x334]}, {0x9f, 0x9, 0x1, [0x0, 0x200, 0x6, 0x2, 0x60, 0x10000, 0xbc9, 0x10000]}, {0x8, 0x3, 0x800, [0x401, 0x2, 0x5927, 0xffff, 0x1800000, 0x3, 0x7, 0x1a]}, {0x574, 0x1, 0x5ff, [0x597f, 0xba8c, 0xd2d, 0x7, 0xfffffc00, 0x100, 0x8, 0x1]}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x4, 0x200, 0x0, 0x43d7, 0x800, r0, 0x3, '\x00', 0x0, r2, 0x1, 0x4, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1b, 0x6, &(0x7f0000000400)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x708}, @jmp={0x5, 0x0, 0xd, 0x4, 0x2, 0x8, 0xffffffffffffffff}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x8}], &(0x7f00000004c0)='syzkaller\x00', 0x6, 0xc4, &(0x7f0000000500)=""/196, 0x41000, 0x10, '\x00', 0x0, 0xc, r1, 0x8, &(0x7f0000000600)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xd, 0x8, 0x2}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000740)=[r4, r5, r6, r0, r0, r1, 0xffffffffffffffff, r1, r1, r2]}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000100)={'tunl0\x00', 0x0, 0x10, 0x8000, 0xffffffff, 0x401, {{0x2f, 0x4, 0x1, 0x9, 0xbc, 0x65, 0x0, 0x1, 0x2f, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x46, 0x0, 0x2, [0x6, 0x7f, 0x3, 0x8, 0xffff]}, @rr={0x7, 0x17, 0x51, [@remote, @remote, @remote, @multicast1, @multicast2]}, @noop, @generic={0x89, 0x10, "e1657c929746fc471360cf3dd888"}, @ssrr={0x89, 0x13, 0xba, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x41}, @empty, @broadcast]}, @noop, @cipso={0x86, 0x50, 0x1, [{0x0, 0x11, "e834a1602e59b27c5f92132ce4a620"}, {0x2, 0x8, "92b9f61b2dcb"}, {0x1, 0xd, "dfffffff00000000000000"}, {0x7, 0x7, "e5510b81fb"}, {0x0, 0xb, "02cc228f0e0c2aaa1f"}, {0x2, 0x12, "af57f6a35a4ffb2406e63079db318a0c"}]}, @timestamp_prespec={0x44, 0x4, 0xf2, 0x3, 0x8}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'ip6_vti0\x00', r7, 0x29, 0x1, 0x40, 0x0, 0x0, @remote, @local, 0x40, 0x40, 0x6, 0x9}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f00000003c0), 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1a, 0x1, &(0x7f0000000280)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x3}], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x21, r1, 0x8, &(0x7f0000000340)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0xe, 0x5ab, 0x3}, 0x10, 0xffffffffffffffff, r2, 0x0, &(0x7f0000000400)}, 0x80) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) pipe2$watch_queue(&(0x7f0000000680), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000000800)={0x7, 0x0, [{0x6, 0x10001, 0x7, [0x400, 0x80, 0x68, 0x400, 0x0, 0x4, 0x8, 0x80000000]}, {0x0, 0x80, 0xfa0, [0x1, 0x8, 0x9, 0x3, 0x40, 0x6, 0x24, 0xd1c5]}, {0x5, 0x8, 0x9, [0x0, 0x3f, 0x6, 0xc3a, 0x8, 0x7ff, 0xfffffffe]}, {0x2, 0x400, 0x9, [0x2, 0x8, 0x6, 0x7, 0x1, 0x20, 0x6, 0x334]}, {0x9f, 0x9, 0x1, [0x0, 0x200, 0x6, 0x2, 0x60, 0x10000, 0xbc9, 0x10000]}, {0x8, 0x3, 0x800, [0x401, 0x2, 0x5927, 0xffff, 0x1800000, 0x3, 0x7, 0x1a]}, {0x574, 0x1, 0x5ff, [0x597f, 0xba8c, 0xd2d, 0x7, 0xfffffc00, 0x100, 0x8, 0x1]}]}) (async) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x4, 0x200, 0x0, 0x43d7, 0x800, r0, 0x3, '\x00', 0x0, r2, 0x1, 0x4, 0x5}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1b, 0x6, &(0x7f0000000400)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x708}, @jmp={0x5, 0x0, 0xd, 0x4, 0x2, 0x8, 0xffffffffffffffff}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x8}], &(0x7f00000004c0)='syzkaller\x00', 0x6, 0xc4, &(0x7f0000000500)=""/196, 0x41000, 0x10, '\x00', 0x0, 0xc, r1, 0x8, &(0x7f0000000600)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xd, 0x8, 0x2}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000740)=[r4, r5, r6, r0, r0, r1, 0xffffffffffffffff, r1, r1, r2]}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000100)={'tunl0\x00', 0x0, 0x10, 0x8000, 0xffffffff, 0x401, {{0x2f, 0x4, 0x1, 0x9, 0xbc, 0x65, 0x0, 0x1, 0x2f, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x46, 0x0, 0x2, [0x6, 0x7f, 0x3, 0x8, 0xffff]}, @rr={0x7, 0x17, 0x51, [@remote, @remote, @remote, @multicast1, @multicast2]}, @noop, @generic={0x89, 0x10, "e1657c929746fc471360cf3dd888"}, @ssrr={0x89, 0x13, 0xba, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x41}, @empty, @broadcast]}, @noop, @cipso={0x86, 0x50, 0x1, [{0x0, 0x11, "e834a1602e59b27c5f92132ce4a620"}, {0x2, 0x8, "92b9f61b2dcb"}, {0x1, 0xd, "dfffffff00000000000000"}, {0x7, 0x7, "e5510b81fb"}, {0x0, 0xb, "02cc228f0e0c2aaa1f"}, {0x2, 0x12, "af57f6a35a4ffb2406e63079db318a0c"}]}, @timestamp_prespec={0x44, 0x4, 0xf2, 0x3, 0x8}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'ip6_vti0\x00', r7, 0x29, 0x1, 0x40, 0x0, 0x0, @remote, @local, 0x40, 0x40, 0x6, 0x9}}) (async) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464c9, &(0x7f00000000c0)={r1}) 01:03:55 executing program 0: bpf$MAP_CREATE(0x14, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x48) (async, rerun: 32) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (rerun: 32) 01:03:55 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1a, 0x1, &(0x7f0000000280)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x3}], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x21, r1, 0x8, &(0x7f0000000340)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0xe, 0x5ab, 0x3}, 0x10, 0xffffffffffffffff, r2, 0x0, &(0x7f0000000400)}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000000800)={0x7, 0x0, [{0x6, 0x10001, 0x7, [0x400, 0x80, 0x68, 0x400, 0x0, 0x4, 0x8, 0x80000000]}, {0x0, 0x80, 0xfa0, [0x1, 0x8, 0x9, 0x3, 0x40, 0x6, 0x24, 0xd1c5]}, {0x5, 0x8, 0x9, [0x0, 0x3f, 0x6, 0xc3a, 0x8, 0x7ff, 0xfffffffe]}, {0x2, 0x400, 0x9, [0x2, 0x8, 0x6, 0x7, 0x1, 0x20, 0x6, 0x334]}, {0x9f, 0x9, 0x1, [0x0, 0x200, 0x6, 0x2, 0x60, 0x10000, 0xbc9, 0x10000]}, {0x8, 0x3, 0x800, [0x401, 0x2, 0x5927, 0xffff, 0x1800000, 0x3, 0x7, 0x1a]}, {0x574, 0x1, 0x5ff, [0x597f, 0xba8c, 0xd2d, 0x7, 0xfffffc00, 0x100, 0x8, 0x1]}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x4, 0x200, 0x0, 0x43d7, 0x800, r0, 0x3, '\x00', 0x0, r2, 0x1, 0x4, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1b, 0x6, &(0x7f0000000400)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x708}, @jmp={0x5, 0x0, 0xd, 0x4, 0x2, 0x8, 0xffffffffffffffff}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x8}], &(0x7f00000004c0)='syzkaller\x00', 0x6, 0xc4, &(0x7f0000000500)=""/196, 0x41000, 0x10, '\x00', 0x0, 0xc, r1, 0x8, &(0x7f0000000600)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xd, 0x8, 0x2}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000740)=[r4, r5, r6, r0, r0, r1, 0xffffffffffffffff, r1, r1, r2]}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000100)={'tunl0\x00', 0x0, 0x10, 0x8000, 0xffffffff, 0x401, {{0x2f, 0x4, 0x1, 0x9, 0xbc, 0x65, 0x0, 0x1, 0x2f, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x46, 0x0, 0x2, [0x6, 0x7f, 0x3, 0x8, 0xffff]}, @rr={0x7, 0x17, 0x51, [@remote, @remote, @remote, @multicast1, @multicast2]}, @noop, @generic={0x89, 0x10, "e1657c929746fc471360cf3dd888"}, @ssrr={0x89, 0x13, 0xba, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x41}, @empty, @broadcast]}, @noop, @cipso={0x86, 0x50, 0x1, [{0x0, 0x11, "e834a1602e59b27c5f92132ce4a620"}, {0x2, 0x8, "92b9f61b2dcb"}, {0x1, 0xd, "dfffffff00000000000000"}, {0x7, 0x7, "e5510b81fb"}, {0x0, 0xb, "02cc228f0e0c2aaa1f"}, {0x2, 0x12, "af57f6a35a4ffb2406e63079db318a0c"}]}, @timestamp_prespec={0x44, 0x4, 0xf2, 0x3, 0x8}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'ip6_vti0\x00', r7, 0x29, 0x1, 0x40, 0x0, 0x0, @remote, @local, 0x40, 0x40, 0x6, 0x9}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f00000003c0), 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1a, 0x1, &(0x7f0000000280)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x3}], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x21, r1, 0x8, &(0x7f0000000340)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0xe, 0x5ab, 0x3}, 0x10, 0xffffffffffffffff, r2, 0x0, &(0x7f0000000400)}, 0x80) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) pipe2$watch_queue(&(0x7f0000000680), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000000800)={0x7, 0x0, [{0x6, 0x10001, 0x7, [0x400, 0x80, 0x68, 0x400, 0x0, 0x4, 0x8, 0x80000000]}, {0x0, 0x80, 0xfa0, [0x1, 0x8, 0x9, 0x3, 0x40, 0x6, 0x24, 0xd1c5]}, {0x5, 0x8, 0x9, [0x0, 0x3f, 0x6, 0xc3a, 0x8, 0x7ff, 0xfffffffe]}, {0x2, 0x400, 0x9, [0x2, 0x8, 0x6, 0x7, 0x1, 0x20, 0x6, 0x334]}, {0x9f, 0x9, 0x1, [0x0, 0x200, 0x6, 0x2, 0x60, 0x10000, 0xbc9, 0x10000]}, {0x8, 0x3, 0x800, [0x401, 0x2, 0x5927, 0xffff, 0x1800000, 0x3, 0x7, 0x1a]}, {0x574, 0x1, 0x5ff, [0x597f, 0xba8c, 0xd2d, 0x7, 0xfffffc00, 0x100, 0x8, 0x1]}]}) (async) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x4, 0x200, 0x0, 0x43d7, 0x800, r0, 0x3, '\x00', 0x0, r2, 0x1, 0x4, 0x5}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1b, 0x6, &(0x7f0000000400)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x708}, @jmp={0x5, 0x0, 0xd, 0x4, 0x2, 0x8, 0xffffffffffffffff}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x8}], &(0x7f00000004c0)='syzkaller\x00', 0x6, 0xc4, &(0x7f0000000500)=""/196, 0x41000, 0x10, '\x00', 0x0, 0xc, r1, 0x8, &(0x7f0000000600)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xd, 0x8, 0x2}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000740)=[r4, r5, r6, r0, r0, r1, 0xffffffffffffffff, r1, r1, r2]}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000100)={'tunl0\x00', 0x0, 0x10, 0x8000, 0xffffffff, 0x401, {{0x2f, 0x4, 0x1, 0x9, 0xbc, 0x65, 0x0, 0x1, 0x2f, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x46, 0x0, 0x2, [0x6, 0x7f, 0x3, 0x8, 0xffff]}, @rr={0x7, 0x17, 0x51, [@remote, @remote, @remote, @multicast1, @multicast2]}, @noop, @generic={0x89, 0x10, "e1657c929746fc471360cf3dd888"}, @ssrr={0x89, 0x13, 0xba, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x41}, @empty, @broadcast]}, @noop, @cipso={0x86, 0x50, 0x1, [{0x0, 0x11, "e834a1602e59b27c5f92132ce4a620"}, {0x2, 0x8, "92b9f61b2dcb"}, {0x1, 0xd, "dfffffff00000000000000"}, {0x7, 0x7, "e5510b81fb"}, {0x0, 0xb, "02cc228f0e0c2aaa1f"}, {0x2, 0x12, "af57f6a35a4ffb2406e63079db318a0c"}]}, @timestamp_prespec={0x44, 0x4, 0xf2, 0x3, 0x8}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'ip6_vti0\x00', r7, 0x29, 0x1, 0x40, 0x0, 0x0, @remote, @local, 0x40, 0x40, 0x6, 0x9}}) (async) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f00000002c0)=[0x0, 0x2], 0x2) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20000014) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x3c002, 0x0) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000340)) sendto$rxrpc(r0, &(0x7f0000000100)="d52e9a153578d7c42524070f54cfba89e98975ee7011bfd43b09de4108191e2173b51fb9fa501f8d48dbd432791e54f91cf1800263bf9e44efff353ad5f4c236c00effed8caaa5a4e6a5f86ea4755b6d254895fde5a6fd36f6f2fa0ee85ea161748daf1fce0030371d87e82b347c26eab5031e29bb201a6323dbdbc77f1ca5a66b0024a540c793e0793f8512b390cca86e059c19484802cc8e5fb31e48d9afaae00ffdfcca37cf07240a38190d32a4c6a8e50ff77dd0c81f1f6798cee71dbe8851453284ea3db82327411676b2220abceceb454bbafacc8515b3719a44", 0xdd, 0x0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) 01:03:55 executing program 0: bpf$MAP_CREATE(0x18, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc0189436, &(0x7f00000000c0)={r1}) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) socket$rxrpc(0x21, 0x2, 0x2) (async) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f00000002c0)=[0x0, 0x2], 0x2) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20000014) (async) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20000014) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x3c002, 0x0) (async) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x3c002, 0x0) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000340)) sendto$rxrpc(r0, &(0x7f0000000100)="d52e9a153578d7c42524070f54cfba89e98975ee7011bfd43b09de4108191e2173b51fb9fa501f8d48dbd432791e54f91cf1800263bf9e44efff353ad5f4c236c00effed8caaa5a4e6a5f86ea4755b6d254895fde5a6fd36f6f2fa0ee85ea161748daf1fce0030371d87e82b347c26eab5031e29bb201a6323dbdbc77f1ca5a66b0024a540c793e0793f8512b390cca86e059c19484802cc8e5fb31e48d9afaae00ffdfcca37cf07240a38190d32a4c6a8e50ff77dd0c81f1f6798cee71dbe8851453284ea3db82327411676b2220abceceb454bbafacc8515b3719a44", 0xdd, 0x0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:55 executing program 0: bpf$MAP_CREATE(0x300, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000240)=0x88) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TUNGETVNETBE(r1, 0x800454df, &(0x7f0000000200)) recvfrom$packet(r0, &(0x7f0000000100)=""/195, 0xc3, 0x10002, &(0x7f0000000000)={0x11, 0x1b, 0x0, 0x1, 0x40, 0x6, @multicast}, 0x14) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc020660b, &(0x7f00000000c0)={r1}) 01:03:55 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) recvfrom$packet(r0, &(0x7f0000000000)=""/19, 0x13, 0x40010020, &(0x7f0000000040)={0x11, 0x4, 0x0, 0x1, 0x2, 0x6, @link_local}, 0x14) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f00000002c0)=[0x0, 0x2], 0x2) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20000014) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x3c002, 0x0) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000340)) sendto$rxrpc(r0, &(0x7f0000000100)="d52e9a153578d7c42524070f54cfba89e98975ee7011bfd43b09de4108191e2173b51fb9fa501f8d48dbd432791e54f91cf1800263bf9e44efff353ad5f4c236c00effed8caaa5a4e6a5f86ea4755b6d254895fde5a6fd36f6f2fa0ee85ea161748daf1fce0030371d87e82b347c26eab5031e29bb201a6323dbdbc77f1ca5a66b0024a540c793e0793f8512b390cca86e059c19484802cc8e5fb31e48d9afaae00ffdfcca37cf07240a38190d32a4c6a8e50ff77dd0c81f1f6798cee71dbe8851453284ea3db82327411676b2220abceceb454bbafacc8515b3719a44", 0xdd, 0x0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) socket$rxrpc(0x21, 0x2, 0x2) (async) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f00000002c0)=[0x0, 0x2], 0x2) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20000014) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x3c002, 0x0) (async) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000340)) (async) sendto$rxrpc(r0, &(0x7f0000000100)="d52e9a153578d7c42524070f54cfba89e98975ee7011bfd43b09de4108191e2173b51fb9fa501f8d48dbd432791e54f91cf1800263bf9e44efff353ad5f4c236c00effed8caaa5a4e6a5f86ea4755b6d254895fde5a6fd36f6f2fa0ee85ea161748daf1fce0030371d87e82b347c26eab5031e29bb201a6323dbdbc77f1ca5a66b0024a540c793e0793f8512b390cca86e059c19484802cc8e5fb31e48d9afaae00ffdfcca37cf07240a38190d32a4c6a8e50ff77dd0c81f1f6798cee71dbe8851453284ea3db82327411676b2220abceceb454bbafacc8515b3719a44", 0xdd, 0x0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) (async) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept4$nfc_llcp(r2, &(0x7f0000000400), &(0x7f0000000480)=0x60, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000080)={'hsr0\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) socketpair(0x29, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) recvfrom$rxrpc(r3, &(0x7f00000001c0)=""/25, 0x19, 0x100, &(0x7f0000000200)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @mcast1, 0x200}}, 0x24) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000240)) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000340)=ANY=[@ANYBLOB="81b44838379ba135ca3806d3fa973b07746f7c2a60639d540abcbca5ac87376a240250fef184a190173ba08d44c26da89a1aa5d08b4601c4990bc1e8c2dda946e7d14793c21f64396f2417a10ac348046dec5e990ee869dd636f3a09471340b95738fe51418dc95faa9c027f531cb8575f0330e85f9e26c8bf748b4bcbc9b79161fdbb468c04d0525ae37ee27ee4d0fad31380fa721050a432920bb4b4743babad9f134f333eb8bd3525623e642eff2b"]) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000240)=0x88) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TUNGETVNETBE(r1, 0x800454df, &(0x7f0000000200)) recvfrom$packet(r0, &(0x7f0000000100)=""/195, 0xc3, 0x10002, &(0x7f0000000000)={0x11, 0x1b, 0x0, 0x1, 0x40, 0x6, @multicast}, 0x14) 01:03:55 executing program 0: bpf$MAP_CREATE(0x500, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) recvfrom$packet(r0, &(0x7f0000000000)=""/19, 0x13, 0x40010020, &(0x7f0000000040)={0x11, 0x4, 0x0, 0x1, 0x2, 0x6, @link_local}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) recvfrom$packet(r0, &(0x7f0000000000)=""/19, 0x13, 0x40010020, &(0x7f0000000040)={0x11, 0x4, 0x0, 0x1, 0x2, 0x6, @link_local}, 0x14) (async) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000240)=0x88) (async) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TUNGETVNETBE(r1, 0x800454df, &(0x7f0000000200)) (async, rerun: 32) recvfrom$packet(r0, &(0x7f0000000100)=""/195, 0xc3, 0x10002, &(0x7f0000000000)={0x11, 0x1b, 0x0, 0x1, 0x40, 0x6, @multicast}, 0x14) (rerun: 32) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) (async) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f00000009c0)) r2 = getpgrp(0x0) syz_open_procfs$namespace(r2, 0x0) write$cgroup_pid(r0, &(0x7f0000000380)=r2, 0x12) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000340)='.%\x00', 0x3) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@delrng={0x10, 0x14, 0x100, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x84011) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x80, 0x20, 0x20, 0x7, {{0x2e, 0x4, 0x0, 0x39, 0xb8, 0x68, 0x0, 0x20, 0x29, 0x0, @private=0xa010101, @loopback, {[@generic={0x7, 0x12, "b3cf3cc93b476e2f05973ae1f051eddb"}, @lsrr={0x83, 0xf, 0xf2, [@dev={0xac, 0x14, 0x14, 0xc}, @rand_addr=0x64010100, @remote]}, @timestamp_prespec={0x44, 0x4c, 0xc7, 0x3, 0x0, [{@private=0xa010100, 0x5}, {@local, 0x2}, {@remote, 0x3}, {@remote, 0x6}, {@multicast2, 0x2}, {@loopback, 0x1}, {@dev={0xac, 0x14, 0x14, 0x30}, 0xfffffffa}, {@broadcast, 0x20}, {@local, 0x2}]}, @cipso={0x86, 0x9, 0x3, [{0x5, 0x3, 'G'}]}, @lsrr={0x83, 0x13, 0x2d, [@broadcast, @dev={0xac, 0x14, 0x14, 0x17}, @local, @loopback]}, @lsrr={0x83, 0x1b, 0x36, [@remote, @local, @empty, @dev={0xac, 0x14, 0x14, 0x43}, @multicast1, @private=0xa010102]}]}}}}}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0xfffffffffffffffe) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept4$nfc_llcp(r2, &(0x7f0000000400), &(0x7f0000000480)=0x60, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000080)={'hsr0\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) socketpair(0x29, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) recvfrom$rxrpc(r3, &(0x7f00000001c0)=""/25, 0x19, 0x100, &(0x7f0000000200)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @mcast1, 0x200}}, 0x24) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000240)) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000340)=ANY=[@ANYBLOB="81b44838379ba135ca3806d3fa973b07746f7c2a60639d540abcbca5ac87376a240250fef184a190173ba08d44c26da89a1aa5d08b4601c4990bc1e8c2dda946e7d14793c21f64396f2417a10ac348046dec5e990ee869dd636f3a09471340b95738fe51418dc95faa9c027f531cb8575f0330e85f9e26c8bf748b4bcbc9b79161fdbb468c04d0525ae37ee27ee4d0fad31380fa721050a432920bb4b4743babad9f134f333eb8bd3525623e642eff2b"]) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) accept4$nfc_llcp(r2, &(0x7f0000000400), &(0x7f0000000480)=0x60, 0x0) (async) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000080)={'hsr0\x00'}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) socketpair(0x29, 0x3, 0x0, &(0x7f0000000180)) (async) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) (async) recvfrom$rxrpc(r3, &(0x7f00000001c0)=""/25, 0x19, 0x100, &(0x7f0000000200)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @mcast1, 0x200}}, 0x24) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000240)) (async) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000340)=ANY=[@ANYBLOB="81b44838379ba135ca3806d3fa973b07746f7c2a60639d540abcbca5ac87376a240250fef184a190173ba08d44c26da89a1aa5d08b4601c4990bc1e8c2dda946e7d14793c21f64396f2417a10ac348046dec5e990ee869dd636f3a09471340b95738fe51418dc95faa9c027f531cb8575f0330e85f9e26c8bf748b4bcbc9b79161fdbb468c04d0525ae37ee27ee4d0fad31380fa721050a432920bb4b4743babad9f134f333eb8bd3525623e642eff2b"]) (async) 01:03:55 executing program 0: bpf$MAP_CREATE(0x600, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) recvfrom$packet(r0, &(0x7f0000000000)=""/19, 0x13, 0x40010020, &(0x7f0000000040)={0x11, 0x4, 0x0, 0x1, 0x2, 0x6, @link_local}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) recvfrom$packet(r0, &(0x7f0000000000)=""/19, 0x13, 0x40010020, &(0x7f0000000040)={0x11, 0x4, 0x0, 0x1, 0x2, 0x6, @link_local}, 0x14) (async) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r1 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f00000009c0)) (async) r2 = getpgrp(0x0) syz_open_procfs$namespace(r2, 0x0) (async) write$cgroup_pid(r0, &(0x7f0000000380)=r2, 0x12) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000340)='.%\x00', 0x3) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@delrng={0x10, 0x14, 0x100, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x84011) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x80, 0x20, 0x20, 0x7, {{0x2e, 0x4, 0x0, 0x39, 0xb8, 0x68, 0x0, 0x20, 0x29, 0x0, @private=0xa010101, @loopback, {[@generic={0x7, 0x12, "b3cf3cc93b476e2f05973ae1f051eddb"}, @lsrr={0x83, 0xf, 0xf2, [@dev={0xac, 0x14, 0x14, 0xc}, @rand_addr=0x64010100, @remote]}, @timestamp_prespec={0x44, 0x4c, 0xc7, 0x3, 0x0, [{@private=0xa010100, 0x5}, {@local, 0x2}, {@remote, 0x3}, {@remote, 0x6}, {@multicast2, 0x2}, {@loopback, 0x1}, {@dev={0xac, 0x14, 0x14, 0x30}, 0xfffffffa}, {@broadcast, 0x20}, {@local, 0x2}]}, @cipso={0x86, 0x9, 0x3, [{0x5, 0x3, 'G'}]}, @lsrr={0x83, 0x13, 0x2d, [@broadcast, @dev={0xac, 0x14, 0x14, 0x17}, @local, @loopback]}, @lsrr={0x83, 0x1b, 0x36, [@remote, @local, @empty, @dev={0xac, 0x14, 0x14, 0x43}, @multicast1, @private=0xa010102]}]}}}}}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0xfffffffffffffffe) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept4$nfc_llcp(r2, &(0x7f0000000400), &(0x7f0000000480)=0x60, 0x0) (async) accept4$nfc_llcp(r2, &(0x7f0000000400), &(0x7f0000000480)=0x60, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000080)={'hsr0\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) socketpair(0x29, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) recvfrom$rxrpc(r3, &(0x7f00000001c0)=""/25, 0x19, 0x100, &(0x7f0000000200)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @mcast1, 0x200}}, 0x24) (async) recvfrom$rxrpc(r3, &(0x7f00000001c0)=""/25, 0x19, 0x100, &(0x7f0000000200)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @mcast1, 0x200}}, 0x24) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000240)) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000240)) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000340)=ANY=[@ANYBLOB="81b44838379ba135ca3806d3fa973b07746f7c2a60639d540abcbca5ac87376a240250fef184a190173ba08d44c26da89a1aa5d08b4601c4990bc1e8c2dda946e7d14793c21f64396f2417a10ac348046dec5e990ee869dd636f3a09471340b95738fe51418dc95faa9c027f531cb8575f0330e85f9e26c8bf748b4bcbc9b79161fdbb468c04d0525ae37ee27ee4d0fad31380fa721050a432920bb4b4743babad9f134f333eb8bd3525623e642eff2b"]) 01:03:55 executing program 0: bpf$MAP_CREATE(0x700, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x7, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:55 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x48) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f00000009c0)) r2 = getpgrp(0x0) syz_open_procfs$namespace(r2, 0x0) write$cgroup_pid(r0, &(0x7f0000000380)=r2, 0x12) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000340)='.%\x00', 0x3) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@delrng={0x10, 0x14, 0x100, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x84011) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x80, 0x20, 0x20, 0x7, {{0x2e, 0x4, 0x0, 0x39, 0xb8, 0x68, 0x0, 0x20, 0x29, 0x0, @private=0xa010101, @loopback, {[@generic={0x7, 0x12, "b3cf3cc93b476e2f05973ae1f051eddb"}, @lsrr={0x83, 0xf, 0xf2, [@dev={0xac, 0x14, 0x14, 0xc}, @rand_addr=0x64010100, @remote]}, @timestamp_prespec={0x44, 0x4c, 0xc7, 0x3, 0x0, [{@private=0xa010100, 0x5}, {@local, 0x2}, {@remote, 0x3}, {@remote, 0x6}, {@multicast2, 0x2}, {@loopback, 0x1}, {@dev={0xac, 0x14, 0x14, 0x30}, 0xfffffffa}, {@broadcast, 0x20}, {@local, 0x2}]}, @cipso={0x86, 0x9, 0x3, [{0x5, 0x3, 'G'}]}, @lsrr={0x83, 0x13, 0x2d, [@broadcast, @dev={0xac, 0x14, 0x14, 0x17}, @local, @loopback]}, @lsrr={0x83, 0x1b, 0x36, [@remote, @local, @empty, @dev={0xac, 0x14, 0x14, 0x43}, @multicast1, @private=0xa010102]}]}}}}}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0xfffffffffffffffe) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) socket$nl_crypto(0x10, 0x3, 0x15) (async) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f00000009c0)) (async) getpgrp(0x0) (async) syz_open_procfs$namespace(r2, 0x0) (async) write$cgroup_pid(r0, &(0x7f0000000380)=r2, 0x12) (async) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000340)='.%\x00', 0x3) (async) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@delrng={0x10, 0x14, 0x100, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x84011) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x80, 0x20, 0x20, 0x7, {{0x2e, 0x4, 0x0, 0x39, 0xb8, 0x68, 0x0, 0x20, 0x29, 0x0, @private=0xa010101, @loopback, {[@generic={0x7, 0x12, "b3cf3cc93b476e2f05973ae1f051eddb"}, @lsrr={0x83, 0xf, 0xf2, [@dev={0xac, 0x14, 0x14, 0xc}, @rand_addr=0x64010100, @remote]}, @timestamp_prespec={0x44, 0x4c, 0xc7, 0x3, 0x0, [{@private=0xa010100, 0x5}, {@local, 0x2}, {@remote, 0x3}, {@remote, 0x6}, {@multicast2, 0x2}, {@loopback, 0x1}, {@dev={0xac, 0x14, 0x14, 0x30}, 0xfffffffa}, {@broadcast, 0x20}, {@local, 0x2}]}, @cipso={0x86, 0x9, 0x3, [{0x5, 0x3, 'G'}]}, @lsrr={0x83, 0x13, 0x2d, [@broadcast, @dev={0xac, 0x14, 0x14, 0x17}, @local, @loopback]}, @lsrr={0x83, 0x1b, 0x36, [@remote, @local, @empty, @dev={0xac, 0x14, 0x14, 0x43}, @multicast1, @private=0xa010102]}]}}}}}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0xfffffffffffffffe) (async) 01:03:55 executing program 3: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x9, 0x97, 0x1, 0x0, 0x0}) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000240)={0x1c, 0xffff55c4, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0xfffffffc, 0x800, 0x3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x0, 0x1, 0x9}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000002c0)={0x7, &(0x7f0000000280)=[{0x401, 0xb7, 0x1f, 0x3}, {0x5, 0x8, 0x5, 0xaba9}, {0x0, 0x2, 0x2, 0x2}, {0x8000, 0x9, 0x20, 0x6}, {0x6, 0x1, 0x0, 0x3}, {0xe120, 0x9, 0x9, 0x3ff}, {0x2, 0xc0, 0x70, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f0000000340)={0x0, 0x2, 0x10001}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f00000000c0)={r7}) 01:03:55 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x48) (async) 01:03:55 executing program 0: bpf$MAP_CREATE(0x900, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x92, 0x7ffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x7fe, 0x100000b}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:55 executing program 3: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000240)={0x1c, 0xffff55c4, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0xfffffffc, 0x800, 0x3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x0, 0x1, 0x9}) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000002c0)={0x7, &(0x7f0000000280)=[{0x401, 0xb7, 0x1f, 0x3}, {0x5, 0x8, 0x5, 0xaba9}, {0x0, 0x2, 0x2, 0x2}, {0x8000, 0x9, 0x20, 0x6}, {0x6, 0x1, 0x0, 0x3}, {0xe120, 0x9, 0x9, 0x3ff}, {0x2, 0xc0, 0x70, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f0000000340)={0x0, 0x2, 0x10001}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f00000000c0)={r7}) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x7, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:55 executing program 0: bpf$MAP_CREATE(0xa00, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x48) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x48) 01:03:55 executing program 3: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x9, 0x97, 0x1, 0x0, 0x0}) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000240)={0x1c, 0xffff55c4, 0x5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0xfffffffc, 0x800, 0x3}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x0, 0x1, 0x9}) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async, rerun: 64) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000002c0)={0x7, &(0x7f0000000280)=[{0x401, 0xb7, 0x1f, 0x3}, {0x5, 0x8, 0x5, 0xaba9}, {0x0, 0x2, 0x2, 0x2}, {0x8000, 0x9, 0x20, 0x6}, {0x6, 0x1, 0x0, 0x3}, {0xe120, 0x9, 0x9, 0x3ff}, {0x2, 0xc0, 0x70, 0x2}]}) (rerun: 64) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f0000000340)={0x0, 0x2, 0x10001}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f00000000c0)={r7}) 01:03:55 executing program 1: write$ppp(0xffffffffffffffff, &(0x7f0000000100)="4381f322f14df5c525b8e1c661f8487c2bf14a6d810de18665119e683678e786a64bbaf9be15164aa4b85ddcd958743219e9a36cf653870679b9bab7d1460e75cf3c94d3241a2f91acfcac9dc2b0b2dd0a6b9d792946e4b6646c0cc3ad333caffcca51dc32859d7b9ce46fb2ab238a89676c891a862dea096b1544ae0a0309d5cfc6d0fdeedab14f8259c9905e542330d5aa87804236900b9dce7ba75ca0b5246702bc1c84dd6116054f5e6b7dbac3138acbe179c4f4424ea7f8165f8219d4f68f84f225de8ac8a58590b11587d55325b6c00c4284e2c1a9fac89c7ebd77f9352b8b66ccf67b988f898835f10af0414eb5b41787f1fe2a39f208f58ca22b6a1be70f76c1b5c1eaa6f21c5bbc94240582a98938918de634d2cf59d12e2f09a8e034ad215b817de5c1a02bba89f7b6586657cb6f42162c1d2d5df14a22c7c872bdf073a1a302f44efba4d6b0654c064957dd77d2155a14ce4f403a48d2419497161dd1276f2dbd1eb2e3db105572ec1437b65849979565ddb0fe47ffdaef0088a4196ad04cd52fc64e9116a013020650bf611489f98146e0bae25b04cda45742eaeea929f0943f6b89862cb8a7f2a52debaa82eb71dff580036e5276248e60e2bb8ce0d0eadd438a105a0d72ee0da1bf1c6e451b3a956e4208b073ce3137c9248d92891d65305b388d5475376c81429d47b3ac06765d0fc9d98d697247a6d48d446bdafe2954ff6e66974cdf51a4b5bdf92f3cb3e1737d71190f376d02df19ebdd2b9ba47f824ddef1328987b213107fa32b55d7d04f48cbdf8134c6f8a6aee7aa5c8e6bf88e5541833f875f2109087c3909758c6082612f5e5eb49d0da28b9f8cd8d199c3634fdaf4082200a9cb8a10c207673fa97d0e4483c4824347ce5a72bb83705208adabb082685c24d9326332a28ebdd7c7a05d353f084bcd7259117c20fcf5e8ae14b1d88cb78ef9c77d56344c558b22523679f5cff692f066da2f5529b6fb5f1df77c701ce8de05224819e9492816fb5717c84cf5269ebc7df217768fe33f430a1546bec5617a032c855afafa37190a5f9cc167d65bcf1c930d3766054a70c98b53bf26cf28ebd5f00269e818104d54c21d964e155faeab616a79ab4c7d2261916c3c23f6a9c04df4d7323fa19d37dd296244f7d9bacf0744290c45aa2e9121ce4ce7d85567b726d1e9e7fd9c5f73155cf6b98e338c3414014d74236349803641216d08217ab9713231a80d4816106227a99722a94dd95030b3746a457028c2c12762cfe4af7e0c3bfe26c0ca86f2b36834cbd90e73b37feba2a42022152f60dabcef59d915b8b11a78a2685a97ce0b42c3e30019c7ff613a5b146c511e7dfb4f10552bd9aa07e76252ef660b81ff93f482d42d6f64e7b8f422d0be03b3f963d086dd16dd0cc7b1bf8343d7d7a36c39c450f501a0206647a784c845e8a360099e9e074aed0313760f393a22108835e1a881d3c395229f106350e42574f8e1373205a7a7a823d29db9022a951a92985cf600af44d36978f284befcbfd12bba9c0d849bd14b4ff13c8986c653f95735077fdd16c166bfdafecca6762c68775d9c695c6420267f6b86b9b70a6d539ffc62aabe92861859e8bb504b1d8538e4ba90e57488885532d48b64403217959a47f9110af24251197677b2e9e5d11d58f1eb41be754e1896d3d588f41ede2998a190e23beb4db78db3c553a6182e402b30926e929dd7083cc8a92cc46cd773b95d27785d54d8f05bee4eb6bcc5aaea7cd40740a0335696cb88c0eb5855724cc08bc0032ebc1d1f28d9390bd0ff63d4cc8b1a4d762982b82f192dc4feb9159b74c6b3401894d7407ff379513e8e63d80ce752d925f2f0ab7327c2587c3a2d4e8bf3384efa519dce47df4f8fd078b97959d5a2723dbf74a64e6da478deb8f6f7ea351a39ceeb712c1b6b8449c0edcc9d6920c05b3e03e6ea5294ca00368e8f3cb5cc1fba00ab7a7fd52bcdf1326257eb75018ecee6e1892fd9a7dc93828abf2370c1e3f2296b6243243a19b47186dd4527bc1546f9e248aa084047609ae68130906d4ee2fb4da8db4daad522fd188127aacfe3b14f430dc870fee5f7fcb36144518e573c05b44624e18df85da12eb2489c7b1e4fdb2d39876e67294cdc7d8f30dc2f3d3b0b7942ca494b7463907878887c20657df3879633d7d9f4b2ad3859faa3d8cedd30774249b8915389d96a0a33197015c495446d82476756cc41a499e5d89fdcd5ae536155922c1ce5283b3de147eec4bf2c112fa996f89ed3d2a8505de6929af3683e60940c9514294023a19958f3d4b94019d9743f927abe83e3fe54d24bc9412f0199088a62f71be55b03871eedfe2461a7539d5172e5d01bc87de984d2f88f7d2bb5f3a7cb2b9a8f425ceadd0dcf688dfab7b13461c3a07bc480347b2e3bf35cbb490784070dedd7c64ff98d2dd7aa471b742847d3638c2d6a6b21240c79a244d55b67b02c4f311581ec45ffe274ccc48e0979f96df1388fb8c44d8f968d28411e7e52fee51a1331ae9ae721c871fbb15a91d89e1ed369816ea2102a0d03a069403e23e69d2d9acadc79852b3546607b07807f1161be18f6b1dec49040e973186e34c970961d1291eb8f15b9dfe07c0805e92dde5317743a9b88fd6c08f2f37c49305883cf036ed2357c1de800df101deaf68fad3a5913e255be165f0c33ed4d185a5868b9e4b84ce7bb0a3b2525ef341fac0c304cbb745512a98e7b573cf976ff769a7ca002b649d541d6be2644354ef1d103604c43095385394620f8469e53ff26d21db9aa838e4762e9553c8a7af743a69b9b4f07437c660305c5ade7d755c19a495414c496ef8455e123b2da6083ce05350e8dbfd1bbd4a45c07e2d49d3727d12eb3132162bf6dfeeb0aa5dc870b8ac887924546b4f9b3df2b5570aa6c485935de827341d08103964cdf0dbf52e47609af22cb94294e2b21cb1483714c14c12c620c09bf5f47a9f97b40ae8fc4a151f6a3319ae2fa90211c6b45f71bebf54ad0337853b6a7ecb324051ed185e57b127c08317881b1a72c301ff5b6de10886033af2101c3337ded88d78675d0c931bb9aa2c0be85255de6cd94aa17fad34295753f394c32e4af93f4f07d3f16680aa6a80c931b73d45e99322768591aac73ae86de987576832df51e9239f5b187b82d74666598772e668c9b35351e7eb97c904b30fe926aed9e7fee21f2c4d1497fa95eebbb39e4e05e6c6ed9b31b41588b39c2ad003a274f1318bf826ad74b6297efd8069076b49d273fa2791a4599394354914c8ea0331d7b48ad6c582c1bf187bc827cb2e6006f3bed24ba5859af032840deb9dc71fcaaab3b7120ad884f36db1e3a26cffe424f170bf68911ced6d1e320a4f4884bad14a82b093d33b6f2cc4686226e524cbc38168fc44e122172ee26ba3663a55f124c8e21b25b553b17591808df4410df19bae45cb119186fe9e93766840b38ddd11611edfc87748b9402d82bc3539350c16c7f379161f96f3293b23bfe2cdc978a460adab71b28486a37976a3d3419f28858d9ec0b7e9e6de2ff9f1285dc1f4950c3162297d75a5a0db2d8289d7c7dba07c0ff480e69782fbd4848f544db8cbdf02eb6a0422d00f8508f495d3d22f943437bd44d5ee07ab0759f61bec1f6bf3afa42e58a29f7b6a4c0907ce9f02c9b96e3af847e4e73193f0471b22106d790777cf0f490ce476d33b933d22d75ed469b43b87f509778038225875dad4dee3af16002bc16f7012fee55e15baba73739ce00a7c887565eaede223b267b65a5e2931d3e3bacdca45bd17457653069592e3a896178afecc7dfc7882c1b446beb4ecf3f6163ded8f2c7a8348a3a2d09b5a51bd761382d59417e8f77894da85e3ca64af8ae20a33caf337e55aea52f4330a45e4832733bfaacd20759f297ca195f35dc26064661c492f46e3713ba3ab4459aa56faeaae3b741ef542d4f474e68d6c9af9eb653f4398ba98f97c8eef102d8f700924ec7e9c7ab861ba5c43dd03cd6986fc67171f3df97d52c382eccd525278e366861ce81c05f15345d3c21c81aefbf0683822f72a04037eb89831a110dc1117558da5c626a8263ae8b456d94da75276eea56d03fd2024f4ee4bd7636b3dd65ee8e88415e901146c8279936ecf835d76dec7bf075f4ae8bc9cfaaf8a9f7178be203592b606635fd0bd59c9744ea46cb2ae4359ce9d0994f2efd634b566b3ae9901e576c5a68eac09e7917aade2192015330808c416b8df8715bbd107016b18863820e3de4f24ed0a56d7c68dc92e98fb7aad75326964fe8e96071fb770f2a3f4f970b63f87bdd01dd586e7a3f45ed236bbb809ba66b2bcc8357067b0ba1fb278a1c1eeee45532fbdc234a03ec1dde6f81479c297f04f0f4f0523c2f7b0455c921c89f5e7d727d05b72cd74051b24471dffa7e8465581ab923e63665be4497a9c6c683ca3ddc196ff434d1795fec9a7f01a30e7b9f906a7ab33ed5a2aab7d4b86beabfa32e1f4db3c5ed467c382c72185f3073136b5546b60759a482261994cbba1c71f93ee90eee8f3a81ccfe80888e08d3f7e9faa8d468b73fa7ca0d3131e20ee263853462d41c75b65b109844a52c4a92db6d635b97d81580d5c251165b6101faf908e39f196b1aac82387615f944a6a1bebb19884d1f45fcd2acd235c123191823863fed751671157cb666625dfa7eb0fae93bea42853568929c83f4ea09fbcdf4aef4e7e9ba440da5aeda47484620383cc22a9489b1518ac87a471cc13db8b3bad7232cd6f74de3ea0749db3a32ef280e01220f66ec3ccbe611f5974ce9e08da4623ba7486fe7722e84cd950e47477d197703c985a807bc22c27b37e49b114f6bf7424b16851f777ca5df8050447fdd5cb283c6f479ebf3b91ca15fbaa981c1fff4d3ca6b7a13437a6c9d15d89a4e3d4ce49a7f20fa77125592dac091fde7e32f5a537c0b82f4fcac3ca582599fcd65b2a35736b12300332c91c476a993bbd3d439fd75a25f00afb7c2ba87edc84d7cea6ffd922ae23ac5a42b2f8da1dc48ffcd1f224f8659f4e19417961800eb084eb50d57d93ca414d460d221a14cee19d51d555225aae1fe4d1271be15f63d397b5a351981df5a16011d15c58bd0abc82e7621b479652e1ecdf2a50d30ac78e88f06e06e7315c058bede6216731a89c9fa8c077cff104344ab452657e2bab8a561294bcd6674cbc7eeee3926c9bc9863656bfecd36c561cc52c00fdf5aa765e2ae79ebfc333f07d85ca7f8a93449720d1f3bd92401cbaca5c3330bcee6d09aa40046654dee848e614aa838b134be9f60d1078ac0b3ef142e498bb47f743f93a1f55eceeabef6bfc1c99f56f3793bc58a8c08e1c2a4e9771046af65be378e09c42fe6408f432ba9b8a431dddb4e52a8e5bf7628580b81ba1dbb91a2acb71caaaf3fe9c7c7f6b73d989caba148c7fa0fce6cd3ea6f2bf5b25b6fe5f917c6cd9781f44281b1e9fec062d40f64871976f73832843dd432ecfa079939932bbfd0764c87ea90aa0199aa2bf179c4dace53c6910b1646cde48a86d5d47544c5746d983ac4e4c7f1bf8546abd747c91b41ebb585990f1e32b721b8d96c9dc9806e0fddd1a027969356e716eb94cd072ca19760199d869d17d32b8deac363f0d3e366389a1c215ee88bed08778cd429a21bd0b1274962810d955d6c018fce75cebf7c061c7a490b54455cf7d1510c07ec630f51e30deda11a014316373d6f7ed644bebba2e73f8ba7b71ed56aca6250c579e010cbc424b90afabd3fec3211cff3b4e9a1e532a311a87806", 0x1000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x7, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x92, 0x7ffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x7fe, 0x100000b}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) 01:03:55 executing program 0: bpf$MAP_CREATE(0xb00, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x48) 01:03:55 executing program 1: write$ppp(0xffffffffffffffff, &(0x7f0000000100)="4381f322f14df5c525b8e1c661f8487c2bf14a6d810de18665119e683678e786a64bbaf9be15164aa4b85ddcd958743219e9a36cf653870679b9bab7d1460e75cf3c94d3241a2f91acfcac9dc2b0b2dd0a6b9d792946e4b6646c0cc3ad333caffcca51dc32859d7b9ce46fb2ab238a89676c891a862dea096b1544ae0a0309d5cfc6d0fdeedab14f8259c9905e542330d5aa87804236900b9dce7ba75ca0b5246702bc1c84dd6116054f5e6b7dbac3138acbe179c4f4424ea7f8165f8219d4f68f84f225de8ac8a58590b11587d55325b6c00c4284e2c1a9fac89c7ebd77f9352b8b66ccf67b988f898835f10af0414eb5b41787f1fe2a39f208f58ca22b6a1be70f76c1b5c1eaa6f21c5bbc94240582a98938918de634d2cf59d12e2f09a8e034ad215b817de5c1a02bba89f7b6586657cb6f42162c1d2d5df14a22c7c872bdf073a1a302f44efba4d6b0654c064957dd77d2155a14ce4f403a48d2419497161dd1276f2dbd1eb2e3db105572ec1437b65849979565ddb0fe47ffdaef0088a4196ad04cd52fc64e9116a013020650bf611489f98146e0bae25b04cda45742eaeea929f0943f6b89862cb8a7f2a52debaa82eb71dff580036e5276248e60e2bb8ce0d0eadd438a105a0d72ee0da1bf1c6e451b3a956e4208b073ce3137c9248d92891d65305b388d5475376c81429d47b3ac06765d0fc9d98d697247a6d48d446bdafe2954ff6e66974cdf51a4b5bdf92f3cb3e1737d71190f376d02df19ebdd2b9ba47f824ddef1328987b213107fa32b55d7d04f48cbdf8134c6f8a6aee7aa5c8e6bf88e5541833f875f2109087c3909758c6082612f5e5eb49d0da28b9f8cd8d199c3634fdaf4082200a9cb8a10c207673fa97d0e4483c4824347ce5a72bb83705208adabb082685c24d9326332a28ebdd7c7a05d353f084bcd7259117c20fcf5e8ae14b1d88cb78ef9c77d56344c558b22523679f5cff692f066da2f5529b6fb5f1df77c701ce8de05224819e9492816fb5717c84cf5269ebc7df217768fe33f430a1546bec5617a032c855afafa37190a5f9cc167d65bcf1c930d3766054a70c98b53bf26cf28ebd5f00269e818104d54c21d964e155faeab616a79ab4c7d2261916c3c23f6a9c04df4d7323fa19d37dd296244f7d9bacf0744290c45aa2e9121ce4ce7d85567b726d1e9e7fd9c5f73155cf6b98e338c3414014d74236349803641216d08217ab9713231a80d4816106227a99722a94dd95030b3746a457028c2c12762cfe4af7e0c3bfe26c0ca86f2b36834cbd90e73b37feba2a42022152f60dabcef59d915b8b11a78a2685a97ce0b42c3e30019c7ff613a5b146c511e7dfb4f10552bd9aa07e76252ef660b81ff93f482d42d6f64e7b8f422d0be03b3f963d086dd16dd0cc7b1bf8343d7d7a36c39c450f501a0206647a784c845e8a360099e9e074aed0313760f393a22108835e1a881d3c395229f106350e42574f8e1373205a7a7a823d29db9022a951a92985cf600af44d36978f284befcbfd12bba9c0d849bd14b4ff13c8986c653f95735077fdd16c166bfdafecca6762c68775d9c695c6420267f6b86b9b70a6d539ffc62aabe92861859e8bb504b1d8538e4ba90e57488885532d48b64403217959a47f9110af24251197677b2e9e5d11d58f1eb41be754e1896d3d588f41ede2998a190e23beb4db78db3c553a6182e402b30926e929dd7083cc8a92cc46cd773b95d27785d54d8f05bee4eb6bcc5aaea7cd40740a0335696cb88c0eb5855724cc08bc0032ebc1d1f28d9390bd0ff63d4cc8b1a4d762982b82f192dc4feb9159b74c6b3401894d7407ff379513e8e63d80ce752d925f2f0ab7327c2587c3a2d4e8bf3384efa519dce47df4f8fd078b97959d5a2723dbf74a64e6da478deb8f6f7ea351a39ceeb712c1b6b8449c0edcc9d6920c05b3e03e6ea5294ca00368e8f3cb5cc1fba00ab7a7fd52bcdf1326257eb75018ecee6e1892fd9a7dc93828abf2370c1e3f2296b6243243a19b47186dd4527bc1546f9e248aa084047609ae68130906d4ee2fb4da8db4daad522fd188127aacfe3b14f430dc870fee5f7fcb36144518e573c05b44624e18df85da12eb2489c7b1e4fdb2d39876e67294cdc7d8f30dc2f3d3b0b7942ca494b7463907878887c20657df3879633d7d9f4b2ad3859faa3d8cedd30774249b8915389d96a0a33197015c495446d82476756cc41a499e5d89fdcd5ae536155922c1ce5283b3de147eec4bf2c112fa996f89ed3d2a8505de6929af3683e60940c9514294023a19958f3d4b94019d9743f927abe83e3fe54d24bc9412f0199088a62f71be55b03871eedfe2461a7539d5172e5d01bc87de984d2f88f7d2bb5f3a7cb2b9a8f425ceadd0dcf688dfab7b13461c3a07bc480347b2e3bf35cbb490784070dedd7c64ff98d2dd7aa471b742847d3638c2d6a6b21240c79a244d55b67b02c4f311581ec45ffe274ccc48e0979f96df1388fb8c44d8f968d28411e7e52fee51a1331ae9ae721c871fbb15a91d89e1ed369816ea2102a0d03a069403e23e69d2d9acadc79852b3546607b07807f1161be18f6b1dec49040e973186e34c970961d1291eb8f15b9dfe07c0805e92dde5317743a9b88fd6c08f2f37c49305883cf036ed2357c1de800df101deaf68fad3a5913e255be165f0c33ed4d185a5868b9e4b84ce7bb0a3b2525ef341fac0c304cbb745512a98e7b573cf976ff769a7ca002b649d541d6be2644354ef1d103604c43095385394620f8469e53ff26d21db9aa838e4762e9553c8a7af743a69b9b4f07437c660305c5ade7d755c19a495414c496ef8455e123b2da6083ce05350e8dbfd1bbd4a45c07e2d49d3727d12eb3132162bf6dfeeb0aa5dc870b8ac887924546b4f9b3df2b5570aa6c485935de827341d08103964cdf0dbf52e47609af22cb94294e2b21cb1483714c14c12c620c09bf5f47a9f97b40ae8fc4a151f6a3319ae2fa90211c6b45f71bebf54ad0337853b6a7ecb324051ed185e57b127c08317881b1a72c301ff5b6de10886033af2101c3337ded88d78675d0c931bb9aa2c0be85255de6cd94aa17fad34295753f394c32e4af93f4f07d3f16680aa6a80c931b73d45e99322768591aac73ae86de987576832df51e9239f5b187b82d74666598772e668c9b35351e7eb97c904b30fe926aed9e7fee21f2c4d1497fa95eebbb39e4e05e6c6ed9b31b41588b39c2ad003a274f1318bf826ad74b6297efd8069076b49d273fa2791a4599394354914c8ea0331d7b48ad6c582c1bf187bc827cb2e6006f3bed24ba5859af032840deb9dc71fcaaab3b7120ad884f36db1e3a26cffe424f170bf68911ced6d1e320a4f4884bad14a82b093d33b6f2cc4686226e524cbc38168fc44e122172ee26ba3663a55f124c8e21b25b553b17591808df4410df19bae45cb119186fe9e93766840b38ddd11611edfc87748b9402d82bc3539350c16c7f379161f96f3293b23bfe2cdc978a460adab71b28486a37976a3d3419f28858d9ec0b7e9e6de2ff9f1285dc1f4950c3162297d75a5a0db2d8289d7c7dba07c0ff480e69782fbd4848f544db8cbdf02eb6a0422d00f8508f495d3d22f943437bd44d5ee07ab0759f61bec1f6bf3afa42e58a29f7b6a4c0907ce9f02c9b96e3af847e4e73193f0471b22106d790777cf0f490ce476d33b933d22d75ed469b43b87f509778038225875dad4dee3af16002bc16f7012fee55e15baba73739ce00a7c887565eaede223b267b65a5e2931d3e3bacdca45bd17457653069592e3a896178afecc7dfc7882c1b446beb4ecf3f6163ded8f2c7a8348a3a2d09b5a51bd761382d59417e8f77894da85e3ca64af8ae20a33caf337e55aea52f4330a45e4832733bfaacd20759f297ca195f35dc26064661c492f46e3713ba3ab4459aa56faeaae3b741ef542d4f474e68d6c9af9eb653f4398ba98f97c8eef102d8f700924ec7e9c7ab861ba5c43dd03cd6986fc67171f3df97d52c382eccd525278e366861ce81c05f15345d3c21c81aefbf0683822f72a04037eb89831a110dc1117558da5c626a8263ae8b456d94da75276eea56d03fd2024f4ee4bd7636b3dd65ee8e88415e901146c8279936ecf835d76dec7bf075f4ae8bc9cfaaf8a9f7178be203592b606635fd0bd59c9744ea46cb2ae4359ce9d0994f2efd634b566b3ae9901e576c5a68eac09e7917aade2192015330808c416b8df8715bbd107016b18863820e3de4f24ed0a56d7c68dc92e98fb7aad75326964fe8e96071fb770f2a3f4f970b63f87bdd01dd586e7a3f45ed236bbb809ba66b2bcc8357067b0ba1fb278a1c1eeee45532fbdc234a03ec1dde6f81479c297f04f0f4f0523c2f7b0455c921c89f5e7d727d05b72cd74051b24471dffa7e8465581ab923e63665be4497a9c6c683ca3ddc196ff434d1795fec9a7f01a30e7b9f906a7ab33ed5a2aab7d4b86beabfa32e1f4db3c5ed467c382c72185f3073136b5546b60759a482261994cbba1c71f93ee90eee8f3a81ccfe80888e08d3f7e9faa8d468b73fa7ca0d3131e20ee263853462d41c75b65b109844a52c4a92db6d635b97d81580d5c251165b6101faf908e39f196b1aac82387615f944a6a1bebb19884d1f45fcd2acd235c123191823863fed751671157cb666625dfa7eb0fae93bea42853568929c83f4ea09fbcdf4aef4e7e9ba440da5aeda47484620383cc22a9489b1518ac87a471cc13db8b3bad7232cd6f74de3ea0749db3a32ef280e01220f66ec3ccbe611f5974ce9e08da4623ba7486fe7722e84cd950e47477d197703c985a807bc22c27b37e49b114f6bf7424b16851f777ca5df8050447fdd5cb283c6f479ebf3b91ca15fbaa981c1fff4d3ca6b7a13437a6c9d15d89a4e3d4ce49a7f20fa77125592dac091fde7e32f5a537c0b82f4fcac3ca582599fcd65b2a35736b12300332c91c476a993bbd3d439fd75a25f00afb7c2ba87edc84d7cea6ffd922ae23ac5a42b2f8da1dc48ffcd1f224f8659f4e19417961800eb084eb50d57d93ca414d460d221a14cee19d51d555225aae1fe4d1271be15f63d397b5a351981df5a16011d15c58bd0abc82e7621b479652e1ecdf2a50d30ac78e88f06e06e7315c058bede6216731a89c9fa8c077cff104344ab452657e2bab8a561294bcd6674cbc7eeee3926c9bc9863656bfecd36c561cc52c00fdf5aa765e2ae79ebfc333f07d85ca7f8a93449720d1f3bd92401cbaca5c3330bcee6d09aa40046654dee848e614aa838b134be9f60d1078ac0b3ef142e498bb47f743f93a1f55eceeabef6bfc1c99f56f3793bc58a8c08e1c2a4e9771046af65be378e09c42fe6408f432ba9b8a431dddb4e52a8e5bf7628580b81ba1dbb91a2acb71caaaf3fe9c7c7f6b73d989caba148c7fa0fce6cd3ea6f2bf5b25b6fe5f917c6cd9781f44281b1e9fec062d40f64871976f73832843dd432ecfa079939932bbfd0764c87ea90aa0199aa2bf179c4dace53c6910b1646cde48a86d5d47544c5746d983ac4e4c7f1bf8546abd747c91b41ebb585990f1e32b721b8d96c9dc9806e0fddd1a027969356e716eb94cd072ca19760199d869d17d32b8deac363f0d3e366389a1c215ee88bed08778cd429a21bd0b1274962810d955d6c018fce75cebf7c061c7a490b54455cf7d1510c07ec630f51e30deda11a014316373d6f7ed644bebba2e73f8ba7b71ed56aca6250c579e010cbc424b90afabd3fec3211cff3b4e9a1e532a311a87806", 0x1000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter={0x1e, 0x20, 0x0, 0x9ce, 0x100, r0, 0xffff7661, '\x00', r2, r3, 0x5, 0xcc, 0x3, 0xb}, 0x48) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x92, 0x7ffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x7fe, 0x100000b}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:55 executing program 0: bpf$MAP_CREATE(0xc00, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:55 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x48) 01:03:55 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x5, 0x20602) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x7fff, 0x401) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async, rerun: 32) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (rerun: 64) socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 64) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter={0x1e, 0x20, 0x0, 0x9ce, 0x100, r0, 0xffff7661, '\x00', r2, r3, 0x5, 0xcc, 0x3, 0xb}, 0x48) 01:03:55 executing program 4: r0 = getpgrp(0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=r0, 0x12) syz_open_procfs$namespace(r0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/mnt\x00') setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000040)=0x3, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000140)=0x6, 0x4) ioctl$PPPIOCUNBRIDGECHAN(0xffffffffffffffff, 0x7434) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:55 executing program 1: write$ppp(0xffffffffffffffff, &(0x7f0000000100)="4381f322f14df5c525b8e1c661f8487c2bf14a6d810de18665119e683678e786a64bbaf9be15164aa4b85ddcd958743219e9a36cf653870679b9bab7d1460e75cf3c94d3241a2f91acfcac9dc2b0b2dd0a6b9d792946e4b6646c0cc3ad333caffcca51dc32859d7b9ce46fb2ab238a89676c891a862dea096b1544ae0a0309d5cfc6d0fdeedab14f8259c9905e542330d5aa87804236900b9dce7ba75ca0b5246702bc1c84dd6116054f5e6b7dbac3138acbe179c4f4424ea7f8165f8219d4f68f84f225de8ac8a58590b11587d55325b6c00c4284e2c1a9fac89c7ebd77f9352b8b66ccf67b988f898835f10af0414eb5b41787f1fe2a39f208f58ca22b6a1be70f76c1b5c1eaa6f21c5bbc94240582a98938918de634d2cf59d12e2f09a8e034ad215b817de5c1a02bba89f7b6586657cb6f42162c1d2d5df14a22c7c872bdf073a1a302f44efba4d6b0654c064957dd77d2155a14ce4f403a48d2419497161dd1276f2dbd1eb2e3db105572ec1437b65849979565ddb0fe47ffdaef0088a4196ad04cd52fc64e9116a013020650bf611489f98146e0bae25b04cda45742eaeea929f0943f6b89862cb8a7f2a52debaa82eb71dff580036e5276248e60e2bb8ce0d0eadd438a105a0d72ee0da1bf1c6e451b3a956e4208b073ce3137c9248d92891d65305b388d5475376c81429d47b3ac06765d0fc9d98d697247a6d48d446bdafe2954ff6e66974cdf51a4b5bdf92f3cb3e1737d71190f376d02df19ebdd2b9ba47f824ddef1328987b213107fa32b55d7d04f48cbdf8134c6f8a6aee7aa5c8e6bf88e5541833f875f2109087c3909758c6082612f5e5eb49d0da28b9f8cd8d199c3634fdaf4082200a9cb8a10c207673fa97d0e4483c4824347ce5a72bb83705208adabb082685c24d9326332a28ebdd7c7a05d353f084bcd7259117c20fcf5e8ae14b1d88cb78ef9c77d56344c558b22523679f5cff692f066da2f5529b6fb5f1df77c701ce8de05224819e9492816fb5717c84cf5269ebc7df217768fe33f430a1546bec5617a032c855afafa37190a5f9cc167d65bcf1c930d3766054a70c98b53bf26cf28ebd5f00269e818104d54c21d964e155faeab616a79ab4c7d2261916c3c23f6a9c04df4d7323fa19d37dd296244f7d9bacf0744290c45aa2e9121ce4ce7d85567b726d1e9e7fd9c5f73155cf6b98e338c3414014d74236349803641216d08217ab9713231a80d4816106227a99722a94dd95030b3746a457028c2c12762cfe4af7e0c3bfe26c0ca86f2b36834cbd90e73b37feba2a42022152f60dabcef59d915b8b11a78a2685a97ce0b42c3e30019c7ff613a5b146c511e7dfb4f10552bd9aa07e76252ef660b81ff93f482d42d6f64e7b8f422d0be03b3f963d086dd16dd0cc7b1bf8343d7d7a36c39c450f501a0206647a784c845e8a360099e9e074aed0313760f393a22108835e1a881d3c395229f106350e42574f8e1373205a7a7a823d29db9022a951a92985cf600af44d36978f284befcbfd12bba9c0d849bd14b4ff13c8986c653f95735077fdd16c166bfdafecca6762c68775d9c695c6420267f6b86b9b70a6d539ffc62aabe92861859e8bb504b1d8538e4ba90e57488885532d48b64403217959a47f9110af24251197677b2e9e5d11d58f1eb41be754e1896d3d588f41ede2998a190e23beb4db78db3c553a6182e402b30926e929dd7083cc8a92cc46cd773b95d27785d54d8f05bee4eb6bcc5aaea7cd40740a0335696cb88c0eb5855724cc08bc0032ebc1d1f28d9390bd0ff63d4cc8b1a4d762982b82f192dc4feb9159b74c6b3401894d7407ff379513e8e63d80ce752d925f2f0ab7327c2587c3a2d4e8bf3384efa519dce47df4f8fd078b97959d5a2723dbf74a64e6da478deb8f6f7ea351a39ceeb712c1b6b8449c0edcc9d6920c05b3e03e6ea5294ca00368e8f3cb5cc1fba00ab7a7fd52bcdf1326257eb75018ecee6e1892fd9a7dc93828abf2370c1e3f2296b6243243a19b47186dd4527bc1546f9e248aa084047609ae68130906d4ee2fb4da8db4daad522fd188127aacfe3b14f430dc870fee5f7fcb36144518e573c05b44624e18df85da12eb2489c7b1e4fdb2d39876e67294cdc7d8f30dc2f3d3b0b7942ca494b7463907878887c20657df3879633d7d9f4b2ad3859faa3d8cedd30774249b8915389d96a0a33197015c495446d82476756cc41a499e5d89fdcd5ae536155922c1ce5283b3de147eec4bf2c112fa996f89ed3d2a8505de6929af3683e60940c9514294023a19958f3d4b94019d9743f927abe83e3fe54d24bc9412f0199088a62f71be55b03871eedfe2461a7539d5172e5d01bc87de984d2f88f7d2bb5f3a7cb2b9a8f425ceadd0dcf688dfab7b13461c3a07bc480347b2e3bf35cbb490784070dedd7c64ff98d2dd7aa471b742847d3638c2d6a6b21240c79a244d55b67b02c4f311581ec45ffe274ccc48e0979f96df1388fb8c44d8f968d28411e7e52fee51a1331ae9ae721c871fbb15a91d89e1ed369816ea2102a0d03a069403e23e69d2d9acadc79852b3546607b07807f1161be18f6b1dec49040e973186e34c970961d1291eb8f15b9dfe07c0805e92dde5317743a9b88fd6c08f2f37c49305883cf036ed2357c1de800df101deaf68fad3a5913e255be165f0c33ed4d185a5868b9e4b84ce7bb0a3b2525ef341fac0c304cbb745512a98e7b573cf976ff769a7ca002b649d541d6be2644354ef1d103604c43095385394620f8469e53ff26d21db9aa838e4762e9553c8a7af743a69b9b4f07437c660305c5ade7d755c19a495414c496ef8455e123b2da6083ce05350e8dbfd1bbd4a45c07e2d49d3727d12eb3132162bf6dfeeb0aa5dc870b8ac887924546b4f9b3df2b5570aa6c485935de827341d08103964cdf0dbf52e47609af22cb94294e2b21cb1483714c14c12c620c09bf5f47a9f97b40ae8fc4a151f6a3319ae2fa90211c6b45f71bebf54ad0337853b6a7ecb324051ed185e57b127c08317881b1a72c301ff5b6de10886033af2101c3337ded88d78675d0c931bb9aa2c0be85255de6cd94aa17fad34295753f394c32e4af93f4f07d3f16680aa6a80c931b73d45e99322768591aac73ae86de987576832df51e9239f5b187b82d74666598772e668c9b35351e7eb97c904b30fe926aed9e7fee21f2c4d1497fa95eebbb39e4e05e6c6ed9b31b41588b39c2ad003a274f1318bf826ad74b6297efd8069076b49d273fa2791a4599394354914c8ea0331d7b48ad6c582c1bf187bc827cb2e6006f3bed24ba5859af032840deb9dc71fcaaab3b7120ad884f36db1e3a26cffe424f170bf68911ced6d1e320a4f4884bad14a82b093d33b6f2cc4686226e524cbc38168fc44e122172ee26ba3663a55f124c8e21b25b553b17591808df4410df19bae45cb119186fe9e93766840b38ddd11611edfc87748b9402d82bc3539350c16c7f379161f96f3293b23bfe2cdc978a460adab71b28486a37976a3d3419f28858d9ec0b7e9e6de2ff9f1285dc1f4950c3162297d75a5a0db2d8289d7c7dba07c0ff480e69782fbd4848f544db8cbdf02eb6a0422d00f8508f495d3d22f943437bd44d5ee07ab0759f61bec1f6bf3afa42e58a29f7b6a4c0907ce9f02c9b96e3af847e4e73193f0471b22106d790777cf0f490ce476d33b933d22d75ed469b43b87f509778038225875dad4dee3af16002bc16f7012fee55e15baba73739ce00a7c887565eaede223b267b65a5e2931d3e3bacdca45bd17457653069592e3a896178afecc7dfc7882c1b446beb4ecf3f6163ded8f2c7a8348a3a2d09b5a51bd761382d59417e8f77894da85e3ca64af8ae20a33caf337e55aea52f4330a45e4832733bfaacd20759f297ca195f35dc26064661c492f46e3713ba3ab4459aa56faeaae3b741ef542d4f474e68d6c9af9eb653f4398ba98f97c8eef102d8f700924ec7e9c7ab861ba5c43dd03cd6986fc67171f3df97d52c382eccd525278e366861ce81c05f15345d3c21c81aefbf0683822f72a04037eb89831a110dc1117558da5c626a8263ae8b456d94da75276eea56d03fd2024f4ee4bd7636b3dd65ee8e88415e901146c8279936ecf835d76dec7bf075f4ae8bc9cfaaf8a9f7178be203592b606635fd0bd59c9744ea46cb2ae4359ce9d0994f2efd634b566b3ae9901e576c5a68eac09e7917aade2192015330808c416b8df8715bbd107016b18863820e3de4f24ed0a56d7c68dc92e98fb7aad75326964fe8e96071fb770f2a3f4f970b63f87bdd01dd586e7a3f45ed236bbb809ba66b2bcc8357067b0ba1fb278a1c1eeee45532fbdc234a03ec1dde6f81479c297f04f0f4f0523c2f7b0455c921c89f5e7d727d05b72cd74051b24471dffa7e8465581ab923e63665be4497a9c6c683ca3ddc196ff434d1795fec9a7f01a30e7b9f906a7ab33ed5a2aab7d4b86beabfa32e1f4db3c5ed467c382c72185f3073136b5546b60759a482261994cbba1c71f93ee90eee8f3a81ccfe80888e08d3f7e9faa8d468b73fa7ca0d3131e20ee263853462d41c75b65b109844a52c4a92db6d635b97d81580d5c251165b6101faf908e39f196b1aac82387615f944a6a1bebb19884d1f45fcd2acd235c123191823863fed751671157cb666625dfa7eb0fae93bea42853568929c83f4ea09fbcdf4aef4e7e9ba440da5aeda47484620383cc22a9489b1518ac87a471cc13db8b3bad7232cd6f74de3ea0749db3a32ef280e01220f66ec3ccbe611f5974ce9e08da4623ba7486fe7722e84cd950e47477d197703c985a807bc22c27b37e49b114f6bf7424b16851f777ca5df8050447fdd5cb283c6f479ebf3b91ca15fbaa981c1fff4d3ca6b7a13437a6c9d15d89a4e3d4ce49a7f20fa77125592dac091fde7e32f5a537c0b82f4fcac3ca582599fcd65b2a35736b12300332c91c476a993bbd3d439fd75a25f00afb7c2ba87edc84d7cea6ffd922ae23ac5a42b2f8da1dc48ffcd1f224f8659f4e19417961800eb084eb50d57d93ca414d460d221a14cee19d51d555225aae1fe4d1271be15f63d397b5a351981df5a16011d15c58bd0abc82e7621b479652e1ecdf2a50d30ac78e88f06e06e7315c058bede6216731a89c9fa8c077cff104344ab452657e2bab8a561294bcd6674cbc7eeee3926c9bc9863656bfecd36c561cc52c00fdf5aa765e2ae79ebfc333f07d85ca7f8a93449720d1f3bd92401cbaca5c3330bcee6d09aa40046654dee848e614aa838b134be9f60d1078ac0b3ef142e498bb47f743f93a1f55eceeabef6bfc1c99f56f3793bc58a8c08e1c2a4e9771046af65be378e09c42fe6408f432ba9b8a431dddb4e52a8e5bf7628580b81ba1dbb91a2acb71caaaf3fe9c7c7f6b73d989caba148c7fa0fce6cd3ea6f2bf5b25b6fe5f917c6cd9781f44281b1e9fec062d40f64871976f73832843dd432ecfa079939932bbfd0764c87ea90aa0199aa2bf179c4dace53c6910b1646cde48a86d5d47544c5746d983ac4e4c7f1bf8546abd747c91b41ebb585990f1e32b721b8d96c9dc9806e0fddd1a027969356e716eb94cd072ca19760199d869d17d32b8deac363f0d3e366389a1c215ee88bed08778cd429a21bd0b1274962810d955d6c018fce75cebf7c061c7a490b54455cf7d1510c07ec630f51e30deda11a014316373d6f7ed644bebba2e73f8ba7b71ed56aca6250c579e010cbc424b90afabd3fec3211cff3b4e9a1e532a311a87806", 0x1000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:55 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x8000005, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4, 0x1, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 0: bpf$MAP_CREATE(0xd00, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x5, 0x20602) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x7fff, 0x401) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2000}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) socket$inet6_udp(0xa, 0x2, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter={0x1e, 0x20, 0x0, 0x9ce, 0x100, r0, 0xffff7661, '\x00', r2, r3, 0x5, 0xcc, 0x3, 0xb}, 0x48) 01:03:56 executing program 4: r0 = getpgrp(0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=r0, 0x12) (async) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=r0, 0x12) syz_open_procfs$namespace(r0, 0x0) (async) syz_open_procfs$namespace(r0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/mnt\x00') setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000040)=0x3, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000140)=0x6, 0x4) ioctl$PPPIOCUNBRIDGECHAN(0xffffffffffffffff, 0x7434) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:56 executing program 1: bind$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @multicast2}}, 0x24) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x1b, 0x6, 0x28, r0, 0x7fffffff, '\x00', r1, r2, 0x1, 0x1, 0x4, 0x2}, 0x48) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x5, 0x20602) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x7fff, 0x401) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0x5, 0x20602) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x7fff, 0x401) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x8, 0x2000}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:03:56 executing program 0: bpf$MAP_CREATE(0xe00, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x8000005, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4, 0x1, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @le_set_scan_param={{0x200b, 0x7}, {0x8, 0x7, 0x101, 0x4, 0x5}}}, 0xb) 01:03:56 executing program 4: r0 = getpgrp(0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=r0, 0x12) (async) syz_open_procfs$namespace(r0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/mnt\x00') setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000040)=0x3, 0x4) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000140)=0x6, 0x4) ioctl$PPPIOCUNBRIDGECHAN(0xffffffffffffffff, 0x7434) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:56 executing program 1: bind$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @multicast2}}, 0x24) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x1b, 0x6, 0x28, r0, 0x7fffffff, '\x00', r1, r2, 0x1, 0x1, 0x4, 0x2}, 0x48) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x8000005}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x95, 0x8000005, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x4, 0x1, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 0: bpf$MAP_CREATE(0xf00, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 4: sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x24, @short={0x2, 0x0, 0xaaa3}}, 0x14, &(0x7f0000000040)={&(0x7f0000000100)="125e06c75974ed01a6ac7b0c085fdaabd95ad0db7f76566c7c15e371fb67ce3c029589f15b0fb3518b6f6c6ca01bb9d0c86f235893f5bae6660eda0e6c3e876bfa0a1f1a505af6696a3efe3f0625149500b99013d67e45de14d9153a2d108290907f2d0a8224efffe642f6e65963d7c3dce1ae6b50c2280fe08abf35f0fe3acf07a707eda92ab34c096d4c1cc2de3baea6f2ea635adb6eebdfd75a92361de6439c953e80ca416e1a4ed03844d151d56a87c5918fe7cccbcf9bf75fa4b616f3b1416282ab36b25a645878e2acbfc4ac8162663244", 0xd4}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000480)={0x2, 0x5, 0x3, 0x0, 0xf}) sendmsg$802154_raw(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f0000000400)={&(0x7f00000003c0)="ae58280943247806599734ddb6", 0xd}, 0x1, 0x0, 0x0, 0x4000}, 0x24004000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x29, 0x23, 0xf8, 0xffffffe0, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, 0x7800, 0x8, 0x4, 0x80000001}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = syz_open_dev$amidi(&(0x7f0000000300), 0x7, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r1, 0x40045731, &(0x7f0000000340)=0xfffffffd) 01:03:56 executing program 0: bpf$MAP_CREATE(0x1100, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$dri(&(0x7f0000000080), 0x5a, 0x10000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x7f, 0x40042) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @le_set_scan_param={{0x200b, 0x7}, {0x8, 0x7, 0x101, 0x4, 0x5}}}, 0xb) 01:03:56 executing program 1: bind$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @multicast2}}, 0x24) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x1b, 0x6, 0x28, r0, 0x7fffffff, '\x00', r1, r2, 0x1, 0x1, 0x4, 0x2}, 0x48) 01:03:56 executing program 4: sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x24, @short={0x2, 0x0, 0xaaa3}}, 0x14, &(0x7f0000000040)={&(0x7f0000000100)="125e06c75974ed01a6ac7b0c085fdaabd95ad0db7f76566c7c15e371fb67ce3c029589f15b0fb3518b6f6c6ca01bb9d0c86f235893f5bae6660eda0e6c3e876bfa0a1f1a505af6696a3efe3f0625149500b99013d67e45de14d9153a2d108290907f2d0a8224efffe642f6e65963d7c3dce1ae6b50c2280fe08abf35f0fe3acf07a707eda92ab34c096d4c1cc2de3baea6f2ea635adb6eebdfd75a92361de6439c953e80ca416e1a4ed03844d151d56a87c5918fe7cccbcf9bf75fa4b616f3b1416282ab36b25a645878e2acbfc4ac8162663244", 0xd4}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000480)={0x2, 0x5, 0x3, 0x0, 0xf}) sendmsg$802154_raw(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f0000000400)={&(0x7f00000003c0)="ae58280943247806599734ddb6", 0xd}, 0x1, 0x0, 0x0, 0x4000}, 0x24004000) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x29, 0x23, 0xf8, 0xffffffe0, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, 0x7800, 0x8, 0x4, 0x80000001}}) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r1 = syz_open_dev$amidi(&(0x7f0000000300), 0x7, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r1, 0x40045731, &(0x7f0000000340)=0xfffffffd) 01:03:56 executing program 0: bpf$MAP_CREATE(0x1200, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x7f, 0x40042) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @le_set_scan_param={{0x200b, 0x7}, {0x8, 0x7, 0x101, 0x4, 0x5}}}, 0xb) (async) write$bt_hci(r0, &(0x7f0000000000)={0x1, @le_set_scan_param={{0x200b, 0x7}, {0x8, 0x7, 0x101, 0x4, 0x5}}}, 0xb) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x5a, 0x10000) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) 01:03:56 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x1ff, 0xfe6, 0x3, 0x6, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0x7f, 0x6, 0x1, @remote, @mcast2, 0x7800, 0x1, 0x4, 0x8}}) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x7f, 0x40042) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 4: sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x24, @short={0x2, 0x0, 0xaaa3}}, 0x14, &(0x7f0000000040)={&(0x7f0000000100)="125e06c75974ed01a6ac7b0c085fdaabd95ad0db7f76566c7c15e371fb67ce3c029589f15b0fb3518b6f6c6ca01bb9d0c86f235893f5bae6660eda0e6c3e876bfa0a1f1a505af6696a3efe3f0625149500b99013d67e45de14d9153a2d108290907f2d0a8224efffe642f6e65963d7c3dce1ae6b50c2280fe08abf35f0fe3acf07a707eda92ab34c096d4c1cc2de3baea6f2ea635adb6eebdfd75a92361de6439c953e80ca416e1a4ed03844d151d56a87c5918fe7cccbcf9bf75fa4b616f3b1416282ab36b25a645878e2acbfc4ac8162663244", 0xd4}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000480)={0x2, 0x5, 0x3, 0x0, 0xf}) (async, rerun: 64) sendmsg$802154_raw(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f0000000400)={&(0x7f00000003c0)="ae58280943247806599734ddb6", 0xd}, 0x1, 0x0, 0x0, 0x4000}, 0x24004000) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x29, 0x23, 0xf8, 0xffffffe0, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, 0x7800, 0x8, 0x4, 0x80000001}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = syz_open_dev$amidi(&(0x7f0000000300), 0x7, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r1, 0x40045731, &(0x7f0000000340)=0xfffffffd) 01:03:56 executing program 0: bpf$MAP_CREATE(0x1300, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) 01:03:56 executing program 1: socket$inet6_udplite(0xa, 0x2, 0x88) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x1ff, 0xfe6, 0x3, 0x6, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0x7f, 0x6, 0x1, @remote, @mcast2, 0x7800, 0x1, 0x4, 0x8}}) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x5a, 0x10000) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000140)) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) 01:03:56 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x1ff, 0xfe6, 0x3, 0x6, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x1}, 0x48) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0x7f, 0x6, 0x1, @remote, @mcast2, 0x7800, 0x1, 0x4, 0x8}}) 01:03:56 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x2) 01:03:56 executing program 0: bpf$MAP_CREATE(0x1400, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfe) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x3, 0x800, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x2) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) 01:03:56 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x2) (async) 01:03:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000140)) 01:03:56 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfe) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async, rerun: 32) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x3, 0x800, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:56 executing program 0: bpf$MAP_CREATE(0x1800, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 0: bpf$MAP_CREATE(0x1000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000000)) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfe) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x3, 0x800, 0x8}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfe) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x3, 0x800, 0x8}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:03:57 executing program 1: sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x74, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3f}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}]}, 0x74}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:57 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000140)) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000140)) (async) 01:03:57 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000000)='?9') bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 01:03:57 executing program 0: bpf$MAP_CREATE(0x2000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000000)) 01:03:57 executing program 1: sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x74, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3f}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}]}, 0x74}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x74, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3f}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}]}, 0x74}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) 01:03:57 executing program 0: bpf$MAP_CREATE(0x3000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000340), 0xcef, 0x101040) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000001c0)) ioctl$TUNDETACHFILTER(r3, 0x401054d6, 0x0) r4 = accept4$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14, 0x800) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14) sendmsg$key(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x2, 0x18, 0x6, 0x6, 0x5, 0x0, 0x70bd28, 0x25dfdbfd, [@sadb_sa={0x2, 0x1, 0x4d2, 0x1, 0x81, 0x1c, 0x3}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e23}]}, 0x28}}, 0x40010) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000000)) 01:03:57 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000000)='?9') (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 01:03:57 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x100) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xfff, 0x80000) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_dccp_buf(r3, 0x21, 0xd, &(0x7f00000002c0)="9fcc4d5bcc5b06bff6189a0addac8c9f0b6fbabda5e41b44ac68b8c81362285b96fa41442f8cbac30cf49f73e25b694e874ac27d98981bf0066cc5861521968c0166e9bf67e47bdde6b32e1ecc53063b7225f92e0f474d42eff44aff097a509966eae3a9daf8b3070933", 0x6a) setsockopt$packet_int(r2, 0x107, 0x11, &(0x7f00000001c0)=0xb0b0, 0x4) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r6, 0x810c5701, &(0x7f0000000400)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f00000000c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)={r7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x1, 0x1, 0x0, 0x0}) socketpair(0x2b, 0x2, 0xfffffffe, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r9, &(0x7f0000000280)=""/13, 0xd, 0x2, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x9, 0x81, 0x20, 0x1000}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r8}) 01:03:57 executing program 1: sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x74, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3f}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}]}, 0x74}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:03:57 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x100) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xfff, 0x80000) (async, rerun: 32) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_dccp_buf(r3, 0x21, 0xd, &(0x7f00000002c0)="9fcc4d5bcc5b06bff6189a0addac8c9f0b6fbabda5e41b44ac68b8c81362285b96fa41442f8cbac30cf49f73e25b694e874ac27d98981bf0066cc5861521968c0166e9bf67e47bdde6b32e1ecc53063b7225f92e0f474d42eff44aff097a509966eae3a9daf8b3070933", 0x6a) setsockopt$packet_int(r2, 0x107, 0x11, &(0x7f00000001c0)=0xb0b0, 0x4) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r6, 0x810c5701, &(0x7f0000000400)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f00000000c0)={r7}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)={r7}) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x1, 0x1, 0x0, 0x0}) (async) socketpair(0x2b, 0x2, 0xfffffffe, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r9, &(0x7f0000000280)=""/13, 0xd, 0x2, 0x0, 0x0) (async, rerun: 64) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x9, 0x81, 0x20, 0x1000}]}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x6}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r8}) (rerun: 32) 01:03:57 executing program 0: bpf$MAP_CREATE(0x4000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0x6, 0xffff592e, 0x1f80000, 0x40, r0, 0xf4a8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x5, 0xe}, 0x48) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x1fd, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'vcan0\x00', 0x200}) 01:03:57 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000000)='?9') (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000340), 0xcef, 0x101040) (async) syz_open_dev$dri(&(0x7f0000000340), 0xcef, 0x101040) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000001c0)) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000001c0)) ioctl$TUNDETACHFILTER(r3, 0x401054d6, 0x0) r4 = accept4$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14, 0x800) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14) sendmsg$key(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x2, 0x18, 0x6, 0x6, 0x5, 0x0, 0x70bd28, 0x25dfdbfd, [@sadb_sa={0x2, 0x1, 0x4d2, 0x1, 0x81, 0x1c, 0x3}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e23}]}, 0x28}}, 0x40010) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0x6, 0xffff592e, 0x1f80000, 0x40, r0, 0xf4a8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x5, 0xe}, 0x48) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x1fd, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'vcan0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0x6, 0xffff592e, 0x1f80000, 0x40, r0, 0xf4a8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x5, 0xe}, 0x48) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x1fd, 0x4) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'vcan0\x00', 0x200}) (async) 01:03:57 executing program 0: bpf$MAP_CREATE(0x5000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 1: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x800) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r0, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 01:03:57 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x100) r1 = syz_open_dev$dri(&(0x7f0000000080), 0xfff, 0x80000) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_dccp_buf(r3, 0x21, 0xd, &(0x7f00000002c0)="9fcc4d5bcc5b06bff6189a0addac8c9f0b6fbabda5e41b44ac68b8c81362285b96fa41442f8cbac30cf49f73e25b694e874ac27d98981bf0066cc5861521968c0166e9bf67e47bdde6b32e1ecc53063b7225f92e0f474d42eff44aff097a509966eae3a9daf8b3070933", 0x6a) setsockopt$packet_int(r2, 0x107, 0x11, &(0x7f00000001c0)=0xb0b0, 0x4) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r6, 0x810c5701, &(0x7f0000000400)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f00000000c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)={r7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x1, 0x1, 0x0, 0x0}) socketpair(0x2b, 0x2, 0xfffffffe, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r9, &(0x7f0000000280)=""/13, 0xd, 0x2, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x9, 0x81, 0x20, 0x1000}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r8}) syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x100) (async) syz_open_dev$dri(&(0x7f0000000080), 0xfff, 0x80000) (async) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) socket$inet_dccp(0x2, 0x6, 0x0) (async) setsockopt$inet_dccp_buf(r3, 0x21, 0xd, &(0x7f00000002c0)="9fcc4d5bcc5b06bff6189a0addac8c9f0b6fbabda5e41b44ac68b8c81362285b96fa41442f8cbac30cf49f73e25b694e874ac27d98981bf0066cc5861521968c0166e9bf67e47bdde6b32e1ecc53063b7225f92e0f474d42eff44aff097a509966eae3a9daf8b3070933", 0x6a) (async) setsockopt$packet_int(r2, 0x107, 0x11, &(0x7f00000001c0)=0xb0b0, 0x4) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r6, 0x810c5701, &(0x7f0000000400)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f00000000c0)={r7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)={r7}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x1, 0x1}) (async) socketpair(0x2b, 0x2, 0xfffffffe, &(0x7f0000000540)) (async) recvfrom$rxrpc(r9, &(0x7f0000000280)=""/13, 0xd, 0x2, 0x0, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x9, 0x81, 0x20, 0x1000}]}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x6}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r8}) (async) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000340), 0xcef, 0x101040) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x1, 0x800, 0x5}) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000001c0)) (async) ioctl$TUNDETACHFILTER(r3, 0x401054d6, 0x0) (async) r4 = accept4$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14, 0x800) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14) sendmsg$key(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x2, 0x18, 0x6, 0x6, 0x5, 0x0, 0x70bd28, 0x25dfdbfd, [@sadb_sa={0x2, 0x1, 0x4d2, 0x1, 0x81, 0x1c, 0x3}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e23}]}, 0x28}}, 0x40010) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x450, 0x1}, 0x48) socket$rxrpc(0x21, 0x2, 0xa) socket$rxrpc(0x21, 0x2, 0xa) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x4, 0xffffff70) 01:03:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0x6, 0xffff592e, 0x1f80000, 0x40, r0, 0xf4a8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x5, 0xe}, 0x48) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x1fd, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'vcan0\x00', 0x200}) 01:03:57 executing program 1: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) (async) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x800) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r0, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 01:03:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x450, 0x1}, 0x48) socket$rxrpc(0x21, 0x2, 0xa) socket$rxrpc(0x21, 0x2, 0xa) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x4, 0xffffff70) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x450, 0x1}, 0x48) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) socket$rxrpc(0x21, 0x2, 0x2) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) (async) socket$rxrpc(0x21, 0x2, 0x2) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) (async) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x4, 0xffffff70) (async) 01:03:57 executing program 2: clock_gettime(0x5, &(0x7f0000000000)) clock_getres(0x5, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0x36b, 0x4, 0x80000000, 0x2, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000001c0)) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x3, 0x2, 0x1ff, 0x2, 0x6}, 0x1, 0xef1}) 01:03:57 executing program 0: bpf$MAP_CREATE(0x6000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x20000) pipe2$watch_queue(&(0x7f0000000500), 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0xb, 0x3a2, 0x8006, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$PPPIOCSDEBUG(r5, 0x40047440, &(0x7f0000000100)=0x8) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r7, 0x400448df, &(0x7f0000000500)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0x808, 0x55}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xc7, 0xf0b4, 0x4}) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0)={0xffffffffffffffff}, 0x4) pselect6(0x40, &(0x7f0000000380)={0x2, 0x7, 0x0, 0x9, 0x101, 0x7, 0x9, 0x8e8d}, &(0x7f00000003c0)={0x3f427ea, 0x9, 0x4, 0x400, 0x9d39824, 0x5, 0x9, 0x8000}, &(0x7f0000000400)={0x1, 0x9, 0x6, 0x1, 0x4, 0x5, 0x64f1, 0xf8d2}, &(0x7f0000000440)={0x0, 0x989680}, &(0x7f00000004c0)={&(0x7f0000000480)={[0x2]}, 0x8}) ioctl$TUNSETFILTEREBPF(r4, 0x800454e1, &(0x7f0000000200)=r8) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r6, 0x400, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc005}, 0x11) 01:03:57 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000011c0), 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x408, 0x6, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000001200)={0x6, 0xa17a64cc, 0x3ff}) getsockopt$nfc_llcp(r2, 0x118, 0x4, &(0x7f00000001c0)=""/4096, 0x1000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:57 executing program 2: clock_gettime(0x5, &(0x7f0000000000)) clock_getres(0x5, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0x36b, 0x4, 0x80000000, 0x2, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000001c0)) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x3, 0x2, 0x1ff, 0x2, 0x6}, 0x1, 0xef1}) clock_gettime(0x5, &(0x7f0000000000)) (async) clock_getres(0x5, &(0x7f0000000040)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0x36b, 0x4, 0x80000000, 0x2, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x48) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000001c0)) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x3, 0x2, 0x1ff, 0x2, 0x6}, 0x1, 0xef1}) (async) 01:03:57 executing program 0: bpf$MAP_CREATE(0x7000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 1: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0}, 0x48) (async, rerun: 64) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x800) (rerun: 64) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r0, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 01:03:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x450, 0x1}, 0x48) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) socket$rxrpc(0x21, 0x2, 0xa) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) (async) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x4, 0xffffff70) 01:03:57 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000011c0), 0x10) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x408, 0x6, 0x1, 0x0, 0x0}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000001200)={0x6, 0xa17a64cc, 0x3ff}) (async, rerun: 32) getsockopt$nfc_llcp(r2, 0x118, 0x4, &(0x7f00000001c0)=""/4096, 0x1000) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:57 executing program 1: accept$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000000)) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) accept4$nfc_llcp(r0, &(0x7f0000000340), &(0x7f00000002c0)=0x60, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00'], 0x14}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x304, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x48051) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f00000000c0)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_CSUM={0x5}]}, 0x1c}}, 0x24000000) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x20000) pipe2$watch_queue(&(0x7f0000000500), 0x80) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0xb, 0x3a2, 0x8006}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0xb, 0x3a2, 0x8006, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$PPPIOCSDEBUG(r5, 0x40047440, &(0x7f0000000100)=0x8) (async) ioctl$PPPIOCSDEBUG(r5, 0x40047440, &(0x7f0000000100)=0x8) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r7, 0x400448df, &(0x7f0000000500)) (async) ioctl$sock_bt_hci(r7, 0x400448df, &(0x7f0000000500)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0x808, 0x55}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xc7, 0xf0b4, 0x4}) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0)={0xffffffffffffffff}, 0x4) pselect6(0x40, &(0x7f0000000380)={0x2, 0x7, 0x0, 0x9, 0x101, 0x7, 0x9, 0x8e8d}, &(0x7f00000003c0)={0x3f427ea, 0x9, 0x4, 0x400, 0x9d39824, 0x5, 0x9, 0x8000}, &(0x7f0000000400)={0x1, 0x9, 0x6, 0x1, 0x4, 0x5, 0x64f1, 0xf8d2}, &(0x7f0000000440)={0x0, 0x989680}, &(0x7f00000004c0)={&(0x7f0000000480)={[0x2]}, 0x8}) ioctl$TUNSETFILTEREBPF(r4, 0x800454e1, &(0x7f0000000200)=r8) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r6, 0x400, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc005}, 0x11) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r6, 0x400, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc005}, 0x11) 01:03:57 executing program 0: bpf$MAP_CREATE(0x8000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=""/4096, 0x1000, 0x0, &(0x7f0000001180)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}, 0x24) accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000000)={0x5, 0x21006}) 01:03:57 executing program 2: clock_gettime(0x5, &(0x7f0000000000)) (async) clock_getres(0x5, &(0x7f0000000040)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0x36b, 0x4, 0x80000000, 0x2, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x48) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000001c0)) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x3, 0x2, 0x1ff, 0x2, 0x6}, 0x1, 0xef1}) 01:03:57 executing program 1: accept$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000000)) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) (async, rerun: 64) accept4$nfc_llcp(r0, &(0x7f0000000340), &(0x7f00000002c0)=0x60, 0x0) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00'], 0x14}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x304, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x48051) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async, rerun: 32) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f00000000c0)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_CSUM={0x5}]}, 0x1c}}, 0x24000000) 01:03:57 executing program 0: bpf$MAP_CREATE(0x9000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:57 executing program 3: syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000011c0), 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x408, 0x6, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000001200)={0x6, 0xa17a64cc, 0x3ff}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000001200)={0x6, 0xa17a64cc, 0x3ff}) getsockopt$nfc_llcp(r2, 0x118, 0x4, &(0x7f00000001c0)=""/4096, 0x1000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=""/4096, 0x1000, 0x0, &(0x7f0000001180)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}, 0x24) accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000000)={0x5, 0x21006}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=""/4096, 0x1000, 0x0, &(0x7f0000001180)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}, 0x24) (async) accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60) (async) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000000)={0x5, 0x21006}) (async) 01:03:57 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x20000) pipe2$watch_queue(&(0x7f0000000500), 0x80) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0xb, 0x3a2, 0x8006, 0x0, 0x0}) (async, rerun: 32) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) (rerun: 32) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) ioctl$PPPIOCSDEBUG(r5, 0x40047440, &(0x7f0000000100)=0x8) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r7, 0x400448df, &(0x7f0000000500)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x5, 0x808, 0x55}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xc7, 0xf0b4, 0x4}) (async) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0)={0xffffffffffffffff}, 0x4) (async) pselect6(0x40, &(0x7f0000000380)={0x2, 0x7, 0x0, 0x9, 0x101, 0x7, 0x9, 0x8e8d}, &(0x7f00000003c0)={0x3f427ea, 0x9, 0x4, 0x400, 0x9d39824, 0x5, 0x9, 0x8000}, &(0x7f0000000400)={0x1, 0x9, 0x6, 0x1, 0x4, 0x5, 0x64f1, 0xf8d2}, &(0x7f0000000440)={0x0, 0x989680}, &(0x7f00000004c0)={&(0x7f0000000480)={[0x2]}, 0x8}) ioctl$TUNSETFILTEREBPF(r4, 0x800454e1, &(0x7f0000000200)=r8) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r6, 0x400, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc005}, 0x11) 01:03:57 executing program 2: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x3, 0x46, 0x1040, r0, 0x80, '\x00', 0x0, r1, 0x2, 0x4, 0x5, 0xe}, 0x48) 01:03:58 executing program 0: bpf$MAP_CREATE(0xa000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000180)=""/4096, 0x1000, 0x0, &(0x7f0000001180)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}, 0x24) (async) accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60) (async, rerun: 64) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000000)={0x5, 0x21006}) (rerun: 64) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) syz_open_dev$dri(&(0x7f0000000180), 0x9a41, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xa57, 0x2, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:58 executing program 2: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x3, 0x46, 0x1040, r0, 0x80, '\x00', 0x0, r1, 0x2, 0x4, 0x5, 0xe}, 0x48) 01:03:58 executing program 1: accept$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000000)) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) (async) accept4$nfc_llcp(r0, &(0x7f0000000340), &(0x7f00000002c0)=0x60, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00'], 0x14}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x304, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x48051) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (rerun: 32) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f00000000c0)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_CSUM={0x5}]}, 0x1c}}, 0x24000000) 01:03:58 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r2 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r2, &(0x7f00000001c0)={0x22, 0x0, 0x1, 0x20, 0x8}, 0x6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) syz_open_dev$dri(&(0x7f0000000180), 0x9a41, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xa57, 0x2, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:58 executing program 0: bpf$MAP_CREATE(0xb000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x94, 0x49, 0x39c4, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x0, 0xb}, 0x48) 01:03:58 executing program 2: pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x3, 0x46, 0x1040, r0, 0x80, '\x00', 0x0, r1, 0x2, 0x4, 0x5, 0xe}, 0x48) 01:03:58 executing program 0: bpf$MAP_CREATE(0xc000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r2 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r2, &(0x7f00000001c0)={0x22, 0x0, 0x1, 0x20, 0x8}, 0x6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:03:58 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x94, 0x49, 0x39c4, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x0, 0xb}, 0x48) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) syz_open_dev$dri(&(0x7f0000000180), 0x9a41, 0x20000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xa57, 0x2, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1f, 0x369cbe61, 0x7c3, 0x4, r0, 0x6, '\x00', 0x0, r1, 0x3, 0x4, 0x3, 0x5}, 0x48) 01:03:58 executing program 0: bpf$MAP_CREATE(0xd000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 1: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x6, 0x80, 0x4, 0x1, 0x39, @local, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x700, 0x20, 0x8, 0x3}}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x9, 0xfff, 0x6e, 0xffffffffffffffff, 0x0, '\x00', r0, 0xffffffffffffffff, 0x4, 0x0, 0x0, 0xd}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000002c0)={0xfffffe01, [0x10fa, 0x960], 0x2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000280)={0xfff, 'syz0\x00'}) 01:03:58 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r2 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r2, &(0x7f00000001c0)={0x22, 0x0, 0x1, 0x20, 0x8}, 0x6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) socket$isdn_base(0x22, 0x3, 0x0) (async) bind$isdn_base(r2, &(0x7f00000001c0)={0x22, 0x0, 0x1, 0x20, 0x8}, 0x6) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) (async) 01:03:58 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x94, 0x49, 0x39c4, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x0, 0xb}, 0x48) 01:03:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1f, 0x369cbe61, 0x7c3, 0x4, r0, 0x6, '\x00', 0x0, r1, 0x3, 0x4, 0x3, 0x5}, 0x48) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x10000006, 0x9b, 0xb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x20, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r2, 0xc0245720, &(0x7f0000000140)={0x1}) 01:03:58 executing program 0: bpf$MAP_CREATE(0xe000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r3, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x4, 0x0, 0x6, 0x42, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x5, 0x9}, 0x48) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r9) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r11) r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r12) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, &(0x7f0000000000)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x0, 0x4, 0xe964a7c178c89041, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @cb_func={0x18, 0x5d7db3ebcdaa1641, 0x4, 0x0, 0xfffffffffffffffa}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x46}], &(0x7f0000000100)='GPL\x00', 0x7, 0x96, &(0x7f0000000140)=""/150, 0x40f00, 0x6, '\x00', r3, 0x24, r4, 0x8, &(0x7f0000000200)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0xd, 0x3, 0x9}, 0x10, 0x0, r5, 0x0, &(0x7f0000000380)=[r6, r7, r0, r8, r9, r10, r11, r12]}, 0x80) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x10000006, 0x9b, 0xb}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x10000006, 0x9b, 0xb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x20, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r2, 0xc0245720, &(0x7f0000000140)={0x1}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r2, 0xc0245720, &(0x7f0000000140)={0x1}) 01:03:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x3a}}, 0x0) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000180)) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:03:58 executing program 0: bpf$MAP_CREATE(0xf000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 1: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x6, 0x80, 0x4, 0x1, 0x39, @local, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x700, 0x20, 0x8, 0x3}}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x9, 0xfff, 0x6e, 0xffffffffffffffff, 0x0, '\x00', r0, 0xffffffffffffffff, 0x4, 0x0, 0x0, 0xd}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000002c0)={0xfffffe01, [0x10fa, 0x960], 0x2}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000280)={0xfff, 'syz0\x00'}) 01:03:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1f, 0x369cbe61, 0x7c3, 0x4, r0, 0x6, '\x00', 0x0, r1, 0x3, 0x4, 0x3, 0x5}, 0x48) 01:03:58 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r3, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x4, 0x0, 0x6, 0x42, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x5, 0x9}, 0x48) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r9) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r11) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r11) r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r12) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r12) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, &(0x7f0000000000)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x0, 0x4, 0xe964a7c178c89041, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @cb_func={0x18, 0x5d7db3ebcdaa1641, 0x4, 0x0, 0xfffffffffffffffa}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x46}], &(0x7f0000000100)='GPL\x00', 0x7, 0x96, &(0x7f0000000140)=""/150, 0x40f00, 0x6, '\x00', r3, 0x24, r4, 0x8, &(0x7f0000000200)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0xd, 0x3, 0x9}, 0x10, 0x0, r5, 0x0, &(0x7f0000000380)=[r6, r7, r0, r8, r9, r10, r11, r12]}, 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, &(0x7f0000000000)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x0, 0x4, 0xe964a7c178c89041, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @cb_func={0x18, 0x5d7db3ebcdaa1641, 0x4, 0x0, 0xfffffffffffffffa}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x46}], &(0x7f0000000100)='GPL\x00', 0x7, 0x96, &(0x7f0000000140)=""/150, 0x40f00, 0x6, '\x00', r3, 0x24, r4, 0x8, &(0x7f0000000200)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0xd, 0x3, 0x9}, 0x10, 0x0, r5, 0x0, &(0x7f0000000380)=[r6, r7, r0, r8, r9, r10, r11, r12]}, 0x80) 01:03:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x3a}}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000180)) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x10000006, 0x9b, 0xb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) r2 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x20, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r2, 0xc0245720, &(0x7f0000000140)={0x1}) 01:03:58 executing program 0: bpf$MAP_CREATE(0x10000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040)={'hsr0\x00'}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r3, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x50ca, 0x3, 0x1, 0xc00, r0, 0x7f, '\x00', r3, r4, 0x1, 0x2, 0x3, 0x7}, 0x48) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r5, 0x800454d3, &(0x7f0000000140)) 01:03:58 executing program 1: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x6, 0x80, 0x4, 0x1, 0x39, @local, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x700, 0x20, 0x8, 0x3}}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x9, 0xfff, 0x6e, 0xffffffffffffffff, 0x0, '\x00', r0, 0xffffffffffffffff, 0x4, 0x0, 0x0, 0xd}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000002c0)={0xfffffe01, [0x10fa, 0x960], 0x2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000280)={0xfff, 'syz0\x00'}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x6, 0x80, 0x4, 0x1, 0x39, @local, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x700, 0x20, 0x8, 0x3}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x9, 0xfff, 0x6e, 0xffffffffffffffff, 0x0, '\x00', r0, 0xffffffffffffffff, 0x4, 0x0, 0x0, 0xd}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) (async) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000002c0)={0xfffffe01, [0x10fa, 0x960], 0x2}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000280)={0xfff, 'syz0\x00'}) (async) 01:03:58 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (rerun: 32) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r3, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x4, 0x0, 0x6, 0x42, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x5, 0x9}, 0x48) (async) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r9) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r10) (async, rerun: 32) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r11) r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r12) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, &(0x7f0000000000)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x0, 0x4, 0xe964a7c178c89041, 0x3, 0xfffffffffffffff0, 0xfffffffffffffffc}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @cb_func={0x18, 0x5d7db3ebcdaa1641, 0x4, 0x0, 0xfffffffffffffffa}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x46}], &(0x7f0000000100)='GPL\x00', 0x7, 0x96, &(0x7f0000000140)=""/150, 0x40f00, 0x6, '\x00', r3, 0x24, r4, 0x8, &(0x7f0000000200)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0xd, 0x3, 0x9}, 0x10, 0x0, r5, 0x0, &(0x7f0000000380)=[r6, r7, r0, r8, r9, r10, r11, r12]}, 0x80) 01:03:58 executing program 0: bpf$MAP_CREATE(0x11000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040)={'hsr0\x00'}) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (rerun: 32) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r3, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x50ca, 0x3, 0x1, 0xc00, r0, 0x7f, '\x00', r3, r4, 0x1, 0x2, 0x3, 0x7}, 0x48) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r5, 0x800454d3, &(0x7f0000000140)) 01:03:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x3a}}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000180)) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) (rerun: 64) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x80097, 0xffffffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3ff, 0xff, 0x4}) 01:03:58 executing program 1: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x101000) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x109c04) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) 01:03:58 executing program 0: bpf$MAP_CREATE(0x12000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async, rerun: 32) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) (rerun: 32) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040)={'hsr0\x00'}) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r3, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x50ca, 0x3, 0x1, 0xc00, r0, 0x7f, '\x00', r3, r4, 0x1, 0x2, 0x3, 0x7}, 0x48) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r5, 0x800454d3, &(0x7f0000000140)) 01:03:58 executing program 4: pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_open_pts(r0, 0x2000) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x4, 0x8, 0x5, 0xfffffff9, 0x8, @loopback, @private2, 0x40, 0x10, 0x3, 0x78}}) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000000)=0x20, 0x4) 01:03:58 executing program 1: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x101000) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x109c04) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x109c04) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) 01:03:58 executing program 0: bpf$MAP_CREATE(0x13000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000080)) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x3, 0xf66f9e085c223936) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f00000001c0)=0x6) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x80097, 0xffffffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3ff, 0xff, 0x4}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x80097, 0xffffffff}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3ff, 0xff, 0x4}) (async) 01:03:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x13a, 0x1}, 0x48) 01:03:58 executing program 4: pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_open_pts(r0, 0x2000) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x4, 0x8, 0x5, 0xfffffff9, 0x8, @loopback, @private2, 0x40, 0x10, 0x3, 0x78}}) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000000)=0x20, 0x4) pipe2$watch_queue(&(0x7f0000000040), 0x80) (async) syz_open_pts(r0, 0x2000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x4, 0x8, 0x5, 0xfffffff9, 0x8, @loopback, @private2, 0x40, 0x10, 0x3, 0x78}}) (async) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000000)=0x20, 0x4) (async) 01:03:58 executing program 1: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x101000) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x109c04) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) 01:03:58 executing program 0: bpf$MAP_CREATE(0x14000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:58 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000080)) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x3, 0xf66f9e085c223936) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f00000001c0)=0x6) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000080)) (async) syz_open_dev$sndmidi(&(0x7f0000000180), 0x3, 0xf66f9e085c223936) (async) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f00000001c0)=0x6) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) (async) 01:03:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x13a, 0x1}, 0x48) 01:03:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x80097, 0xffffffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3ff, 0xff, 0x4}) 01:03:58 executing program 4: pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_open_pts(r0, 0x2000) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (rerun: 64) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x4, 0x8, 0x5, 0xfffffff9, 0x8, @loopback, @private2, 0x40, 0x10, 0x3, 0x78}}) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000000)=0x20, 0x4) 01:03:58 executing program 5: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000080)) (async) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x3, 0xf66f9e085c223936) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f00000001c0)=0x6) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:03:58 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000011c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001200)=@base={0x1d, 0x80000001, 0x4, 0x1, 0x1, r2, 0x20, '\x00', 0x0, r0, 0x3, 0x2, 0x4}, 0x48) pipe2$watch_queue(&(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x9, 0x3, &(0x7f0000000040)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0xfffffffb, 0x1000, &(0x7f0000000140)=""/4096, 0x41100, 0xa, '\x00', 0x0, 0x5, 0xffffffffffffffff, 0x8, &(0x7f0000001140)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000001180)={0x5, 0x2, 0xfffffffc, 0x85e6}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000012c0)=[r1, r3, r4]}, 0x80) 01:03:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x13a, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x13a, 0x1}, 0x48) (async) 01:03:58 executing program 0: bpf$MAP_CREATE(0x18000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xc, 0x97, 0xffffffff, 0x0, 0x0}) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000080)=0x3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x5, 0x4, 0xa226}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4400d}, 0x80) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000011c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001200)=@base={0x1d, 0x80000001, 0x4, 0x1, 0x1, r2, 0x20, '\x00', 0x0, r0, 0x3, 0x2, 0x4}, 0x48) pipe2$watch_queue(&(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x9, 0x3, &(0x7f0000000040)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0xfffffffb, 0x1000, &(0x7f0000000140)=""/4096, 0x41100, 0xa, '\x00', 0x0, 0x5, 0xffffffffffffffff, 0x8, &(0x7f0000001140)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000001180)={0x5, 0x2, 0xfffffffc, 0x85e6}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000012c0)=[r1, r3, r4]}, 0x80) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xf5, 0x3f, 0x4, 0x400, r1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2, 0x8}, 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) ioctl$PPPIOCDISCONN(r0, 0x7439) socket$isdn_base(0x22, 0x3, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r3, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) 01:03:59 executing program 5: pselect6(0x40, &(0x7f0000000080)={0x7, 0x8, 0xffff, 0x7f, 0x7, 0x2, 0x40, 0x7f9}, &(0x7f0000000140)={0x7, 0x4, 0x1, 0x4, 0x60, 0x8000000000000001, 0x1, 0x8}, &(0x7f0000000180)={0x20, 0x20, 0x8, 0x9, 0x873a, 0x1, 0x9, 0x30000000000}, &(0x7f00000001c0), &(0x7f0000000240)={&(0x7f0000000200)={[0x50000000000000]}, 0x8}) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000002c0)={0x0, 0x1, 0x6, @random="405cd7d89311"}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000280)=0x2) 01:03:59 executing program 0: bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000140)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x4, r1, 0x30, 0x1, @in={0x2, 0x4e22, @multicast1}}}, 0xa0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:59 executing program 5: pselect6(0x40, &(0x7f0000000080)={0x7, 0x8, 0xffff, 0x7f, 0x7, 0x2, 0x40, 0x7f9}, &(0x7f0000000140)={0x7, 0x4, 0x1, 0x4, 0x60, 0x8000000000000001, 0x1, 0x8}, &(0x7f0000000180)={0x20, 0x20, 0x8, 0x9, 0x873a, 0x1, 0x9, 0x30000000000}, &(0x7f00000001c0), &(0x7f0000000240)={&(0x7f0000000200)={[0x50000000000000]}, 0x8}) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000002c0)={0x0, 0x1, 0x6, @random="405cd7d89311"}, 0x10) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000280)=0x2) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xf5, 0x3f, 0x4, 0x400, r1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2, 0x8}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) ioctl$PPPIOCDISCONN(r0, 0x7439) socket$isdn_base(0x22, 0x3, 0x0) (async) socket$isdn_base(0x22, 0x3, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r3, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000011c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001200)=@base={0x1d, 0x80000001, 0x4, 0x1, 0x1, r2, 0x20, '\x00', 0x0, r0, 0x3, 0x2, 0x4}, 0x48) pipe2$watch_queue(&(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x9, 0x3, &(0x7f0000000040)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0xfffffffb, 0x1000, &(0x7f0000000140)=""/4096, 0x41100, 0xa, '\x00', 0x0, 0x5, 0xffffffffffffffff, 0x8, &(0x7f0000001140)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000001180)={0x5, 0x2, 0xfffffffc, 0x85e6}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000012c0)=[r1, r3, r4]}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000011c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000001380), 0x80) (async) bpf$MAP_CREATE(0x0, &(0x7f0000001200)=@base={0x1d, 0x80000001, 0x4, 0x1, 0x1, r2, 0x20, '\x00', 0x0, r0, 0x3, 0x2, 0x4}, 0x48) (async) pipe2$watch_queue(&(0x7f0000001280), 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x9, 0x3, &(0x7f0000000040)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0xfffffffb, 0x1000, &(0x7f0000000140)=""/4096, 0x41100, 0xa, '\x00', 0x0, 0x5, 0xffffffffffffffff, 0x8, &(0x7f0000001140)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000001180)={0x5, 0x2, 0xfffffffc, 0x85e6}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000012c0)=[r1, r3, r4]}, 0x80) (async) 01:03:59 executing program 0: bpf$MAP_CREATE(0x200000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 0: bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xc, 0x97, 0xffffffff, 0x0, 0x0}) (async, rerun: 32) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000080)=0x3) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x5, 0x4, 0xa226}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async, rerun: 32) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4400d}, 0x80) (rerun: 32) 01:03:59 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000140)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x4, r1, 0x30, 0x1, @in={0x2, 0x4e22, @multicast1}}}, 0xa0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xf5, 0x3f, 0x4, 0x400, r1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2, 0x8}, 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) ioctl$PPPIOCDISCONN(r0, 0x7439) (async) socket$isdn_base(0x22, 0x3, 0x0) (async) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r3, 0x1}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) 01:03:59 executing program 1: ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000000)={'pim6reg0\x00'}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400400, 0x0) syz_extract_tcp_res(&(0x7f0000000140)={0x41424344}, 0x100, 0x7f) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x3, 0x1, 0x100, 0x200, 0x5}, @ipv4=@tcp={{0x1e, 0x4, 0x1, 0x2, 0xb9, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x27, 0xc6, [@multicast1, @local, @remote, @empty, @rand_addr=0x64010102, @empty, @rand_addr=0x64010101, @local, @broadcast]}, @rr={0x7, 0x1f, 0x39, [@rand_addr=0x64010100, @broadcast, @multicast1, @local, @private=0xa010102, @local, @loopback]}, @lsrr={0x83, 0x3, 0x53}, @rr={0x7, 0xb, 0xfb, [@local, @initdev={0xac, 0x1e, 0x3, 0x0}]}, @rr={0x7, 0xb, 0x8e, [@private=0xa010101, @empty]}, @timestamp_prespec={0x44, 0x4, 0xa4, 0x3, 0x8}]}}, {{0x4e23, 0x4e22, r1, 0x41424344, 0x1, 0x0, 0xb, 0x10, 0x8, 0x0, 0x3, {[@generic={0x13, 0xb, "27728020e820dec12a"}, @exp_smc={0xfe, 0x6}, @eol, @mss={0x2, 0x4, 0x30}, @nop]}}, {"ec86505aeac79316b26e3e25779aeba4b4abd9326a"}}}}, 0xc3) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0x2, &(0x7f0000000280)="1eb354018b85e16fc9485abe5555b46a5a3d8e7eddc81981a8ac60df318de2521f4fc54c63f42a7549f4c7e4ebc263fb83fc4e6450076f31af6214e03cf471d5e127b655846f16c2fae977d873e5a4e88f08c8cef466a973025cb1a2cb734bc29b95a18fc25a3eb0c388cc202792fa53437762a4917ca758285282560b6ad414d3ff2fb194ef575845d0afbaf8b28fd8c57bc8bcdba8e7345fcc400fe8f2b0e6ed242ab431225c806ccf5a0fa61d28d1f54d79f4fcbe1d49baa22fdc69b2f1dc4d2b1ca271d1ca6fcd20f76a", 0xcc) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000040)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x8) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x2, 0x7, 0xfffffff9, 0x80, r2, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0xc}, 0x48) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000016c0), 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) read$midi(r7, &(0x7f00000006c0)=""/4096, 0x1000) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x7, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x5}, @map_val={0x18, 0x2, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8000}]}, &(0x7f0000000440)='syzkaller\x00', 0x2, 0x83, &(0x7f0000000480)=""/131, 0x41000, 0x1, '\x00', 0x0, 0x22, r4, 0x8, &(0x7f0000000580)={0x7, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x3, 0x2, 0x3, 0xfffffff9}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[r5, r6, r2]}, 0x80) socket$packet(0x11, 0x2, 0x300) 01:03:59 executing program 5: pselect6(0x40, &(0x7f0000000080)={0x7, 0x8, 0xffff, 0x7f, 0x7, 0x2, 0x40, 0x7f9}, &(0x7f0000000140)={0x7, 0x4, 0x1, 0x4, 0x60, 0x8000000000000001, 0x1, 0x8}, &(0x7f0000000180)={0x20, 0x20, 0x8, 0x9, 0x873a, 0x1, 0x9, 0x30000000000}, &(0x7f00000001c0), &(0x7f0000000240)={&(0x7f0000000200)={[0x50000000000000]}, 0x8}) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000002c0)={0x0, 0x1, 0x6, @random="405cd7d89311"}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000280)=0x2) pselect6(0x40, &(0x7f0000000080)={0x7, 0x8, 0xffff, 0x7f, 0x7, 0x2, 0x40, 0x7f9}, &(0x7f0000000140)={0x7, 0x4, 0x1, 0x4, 0x60, 0x8000000000000001, 0x1, 0x8}, &(0x7f0000000180)={0x20, 0x20, 0x8, 0x9, 0x873a, 0x1, 0x9, 0x30000000000}, &(0x7f00000001c0), &(0x7f0000000240)={&(0x7f0000000200)={[0x50000000000000]}, 0x8}) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000002c0)={0x0, 0x1, 0x6, @random="405cd7d89311"}, 0x10) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000280)=0x2) (async) 01:03:59 executing program 0: bpf$MAP_CREATE(0x400000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xc, 0x97, 0xffffffff, 0x0, 0x0}) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000080)=0x3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x5, 0x4, 0xa226}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4400d}, 0x80) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xc, 0x97, 0xffffffff}) (async) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000080)=0x3) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x5, 0x4, 0xa226}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4400d}, 0x80) (async) 01:03:59 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x2, 0xa}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000140)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x4, r1, 0x30, 0x1, @in={0x2, 0x4e22, @multicast1}}}, 0xa0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:59 executing program 0: bpf$MAP_CREATE(0x500000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000180)=0x5f10, 0x4) select(0x40, &(0x7f0000000000)={0x8000, 0x3f, 0x8000000000000001, 0x8000, 0x7, 0xa9, 0x7, 0x4}, &(0x7f0000000040)={0x2, 0xfffffffffffffff8, 0x81, 0x3, 0x100, 0x1ff, 0x22d2, 0x3}, &(0x7f0000000100)={0x81, 0xffff, 0x7, 0x8000, 0x1, 0xffffffff, 0x4, 0x2000400}, &(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) (async) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:59 executing program 1: ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000000)={'pim6reg0\x00'}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400400, 0x0) syz_extract_tcp_res(&(0x7f0000000140)={0x41424344}, 0x100, 0x7f) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x3, 0x1, 0x100, 0x200, 0x5}, @ipv4=@tcp={{0x1e, 0x4, 0x1, 0x2, 0xb9, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x27, 0xc6, [@multicast1, @local, @remote, @empty, @rand_addr=0x64010102, @empty, @rand_addr=0x64010101, @local, @broadcast]}, @rr={0x7, 0x1f, 0x39, [@rand_addr=0x64010100, @broadcast, @multicast1, @local, @private=0xa010102, @local, @loopback]}, @lsrr={0x83, 0x3, 0x53}, @rr={0x7, 0xb, 0xfb, [@local, @initdev={0xac, 0x1e, 0x3, 0x0}]}, @rr={0x7, 0xb, 0x8e, [@private=0xa010101, @empty]}, @timestamp_prespec={0x44, 0x4, 0xa4, 0x3, 0x8}]}}, {{0x4e23, 0x4e22, r1, 0x41424344, 0x1, 0x0, 0xb, 0x10, 0x8, 0x0, 0x3, {[@generic={0x13, 0xb, "27728020e820dec12a"}, @exp_smc={0xfe, 0x6}, @eol, @mss={0x2, 0x4, 0x30}, @nop]}}, {"ec86505aeac79316b26e3e25779aeba4b4abd9326a"}}}}, 0xc3) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0x2, &(0x7f0000000280)="1eb354018b85e16fc9485abe5555b46a5a3d8e7eddc81981a8ac60df318de2521f4fc54c63f42a7549f4c7e4ebc263fb83fc4e6450076f31af6214e03cf471d5e127b655846f16c2fae977d873e5a4e88f08c8cef466a973025cb1a2cb734bc29b95a18fc25a3eb0c388cc202792fa53437762a4917ca758285282560b6ad414d3ff2fb194ef575845d0afbaf8b28fd8c57bc8bcdba8e7345fcc400fe8f2b0e6ed242ab431225c806ccf5a0fa61d28d1f54d79f4fcbe1d49baa22fdc69b2f1dc4d2b1ca271d1ca6fcd20f76a", 0xcc) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000040)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x8) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x2, 0x7, 0xfffffff9, 0x80, r2, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0xc}, 0x48) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000016c0), 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) read$midi(r7, &(0x7f00000006c0)=""/4096, 0x1000) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x7, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x5}, @map_val={0x18, 0x2, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8000}]}, &(0x7f0000000440)='syzkaller\x00', 0x2, 0x83, &(0x7f0000000480)=""/131, 0x41000, 0x1, '\x00', 0x0, 0x22, r4, 0x8, &(0x7f0000000580)={0x7, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x3, 0x2, 0x3, 0xfffffff9}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[r5, r6, r2]}, 0x80) socket$packet(0x11, 0x2, 0x300) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000000)={'pim6reg0\x00'}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400400, 0x0) (async) syz_extract_tcp_res(&(0x7f0000000140), 0x100, 0x7f) (async) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x3, 0x1, 0x100, 0x200, 0x5}, @ipv4=@tcp={{0x1e, 0x4, 0x1, 0x2, 0xb9, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x27, 0xc6, [@multicast1, @local, @remote, @empty, @rand_addr=0x64010102, @empty, @rand_addr=0x64010101, @local, @broadcast]}, @rr={0x7, 0x1f, 0x39, [@rand_addr=0x64010100, @broadcast, @multicast1, @local, @private=0xa010102, @local, @loopback]}, @lsrr={0x83, 0x3, 0x53}, @rr={0x7, 0xb, 0xfb, [@local, @initdev={0xac, 0x1e, 0x3, 0x0}]}, @rr={0x7, 0xb, 0x8e, [@private=0xa010101, @empty]}, @timestamp_prespec={0x44, 0x4, 0xa4, 0x3, 0x8}]}}, {{0x4e23, 0x4e22, r1, 0x41424344, 0x1, 0x0, 0xb, 0x10, 0x8, 0x0, 0x3, {[@generic={0x13, 0xb, "27728020e820dec12a"}, @exp_smc={0xfe, 0x6}, @eol, @mss={0x2, 0x4, 0x30}, @nop]}}, {"ec86505aeac79316b26e3e25779aeba4b4abd9326a"}}}}, 0xc3) (async) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0x2, &(0x7f0000000280)="1eb354018b85e16fc9485abe5555b46a5a3d8e7eddc81981a8ac60df318de2521f4fc54c63f42a7549f4c7e4ebc263fb83fc4e6450076f31af6214e03cf471d5e127b655846f16c2fae977d873e5a4e88f08c8cef466a973025cb1a2cb734bc29b95a18fc25a3eb0c388cc202792fa53437762a4917ca758285282560b6ad414d3ff2fb194ef575845d0afbaf8b28fd8c57bc8bcdba8e7345fcc400fe8f2b0e6ed242ab431225c806ccf5a0fa61d28d1f54d79f4fcbe1d49baa22fdc69b2f1dc4d2b1ca271d1ca6fcd20f76a", 0xcc) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000040)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x8) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x2, 0x7, 0xfffffff9, 0x80, r2, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0xc}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000016c0), 0x80) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) (async) read$midi(r7, &(0x7f00000006c0)=""/4096, 0x1000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x7, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x5}, @map_val={0x18, 0x2, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8000}]}, &(0x7f0000000440)='syzkaller\x00', 0x2, 0x83, &(0x7f0000000480)=""/131, 0x41000, 0x1, '\x00', 0x0, 0x22, r4, 0x8, &(0x7f0000000580)={0x7, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x3, 0x2, 0x3, 0xfffffff9}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[r5, r6, r2]}, 0x80) (async) socket$packet(0x11, 0x2, 0x300) (async) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0xa1, 0xfffffffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000180)=0x5f10, 0x4) (async) select(0x40, &(0x7f0000000000)={0x8000, 0x3f, 0x8000000000000001, 0x8000, 0x7, 0xa9, 0x7, 0x4}, &(0x7f0000000040)={0x2, 0xfffffffffffffff8, 0x81, 0x3, 0x100, 0x1ff, 0x22d2, 0x3}, &(0x7f0000000100)={0x81, 0xffff, 0x7, 0x8000, 0x1, 0xffffffff, 0x4, 0x2000400}, &(0x7f0000000140)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:03:59 executing program 2: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000)=r0, 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x2, 0x1}, 0x48) 01:03:59 executing program 0: bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0xa1, 0xfffffffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) (async) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) 01:03:59 executing program 2: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000)=r0, 0x12) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x2, 0x1}, 0x48) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000180)=0x5f10, 0x4) select(0x40, &(0x7f0000000000)={0x8000, 0x3f, 0x8000000000000001, 0x8000, 0x7, 0xa9, 0x7, 0x4}, &(0x7f0000000040)={0x2, 0xfffffffffffffff8, 0x81, 0x3, 0x100, 0x1ff, 0x22d2, 0x3}, &(0x7f0000000100)={0x81, 0xffff, 0x7, 0x8000, 0x1, 0xffffffff, 0x4, 0x2000400}, &(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000180)=0x5f10, 0x4) (async) select(0x40, &(0x7f0000000000)={0x8000, 0x3f, 0x8000000000000001, 0x8000, 0x7, 0xa9, 0x7, 0x4}, &(0x7f0000000040)={0x2, 0xfffffffffffffff8, 0x81, 0x3, 0x100, 0x1ff, 0x22d2, 0x3}, &(0x7f0000000100)={0x81, 0xffff, 0x7, 0x8000, 0x1, 0xffffffff, 0x4, 0x2000400}, &(0x7f0000000140)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) 01:03:59 executing program 1: ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000000)={'pim6reg0\x00'}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400400, 0x0) syz_extract_tcp_res(&(0x7f0000000140)={0x41424344}, 0x100, 0x7f) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x3, 0x1, 0x100, 0x200, 0x5}, @ipv4=@tcp={{0x1e, 0x4, 0x1, 0x2, 0xb9, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x27, 0xc6, [@multicast1, @local, @remote, @empty, @rand_addr=0x64010102, @empty, @rand_addr=0x64010101, @local, @broadcast]}, @rr={0x7, 0x1f, 0x39, [@rand_addr=0x64010100, @broadcast, @multicast1, @local, @private=0xa010102, @local, @loopback]}, @lsrr={0x83, 0x3, 0x53}, @rr={0x7, 0xb, 0xfb, [@local, @initdev={0xac, 0x1e, 0x3, 0x0}]}, @rr={0x7, 0xb, 0x8e, [@private=0xa010101, @empty]}, @timestamp_prespec={0x44, 0x4, 0xa4, 0x3, 0x8}]}}, {{0x4e23, 0x4e22, r1, 0x41424344, 0x1, 0x0, 0xb, 0x10, 0x8, 0x0, 0x3, {[@generic={0x13, 0xb, "27728020e820dec12a"}, @exp_smc={0xfe, 0x6}, @eol, @mss={0x2, 0x4, 0x30}, @nop]}}, {"ec86505aeac79316b26e3e25779aeba4b4abd9326a"}}}}, 0xc3) (async) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x3, 0x1, 0x100, 0x200, 0x5}, @ipv4=@tcp={{0x1e, 0x4, 0x1, 0x2, 0xb9, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x27, 0xc6, [@multicast1, @local, @remote, @empty, @rand_addr=0x64010102, @empty, @rand_addr=0x64010101, @local, @broadcast]}, @rr={0x7, 0x1f, 0x39, [@rand_addr=0x64010100, @broadcast, @multicast1, @local, @private=0xa010102, @local, @loopback]}, @lsrr={0x83, 0x3, 0x53}, @rr={0x7, 0xb, 0xfb, [@local, @initdev={0xac, 0x1e, 0x3, 0x0}]}, @rr={0x7, 0xb, 0x8e, [@private=0xa010101, @empty]}, @timestamp_prespec={0x44, 0x4, 0xa4, 0x3, 0x8}]}}, {{0x4e23, 0x4e22, r1, 0x41424344, 0x1, 0x0, 0xb, 0x10, 0x8, 0x0, 0x3, {[@generic={0x13, 0xb, "27728020e820dec12a"}, @exp_smc={0xfe, 0x6}, @eol, @mss={0x2, 0x4, 0x30}, @nop]}}, {"ec86505aeac79316b26e3e25779aeba4b4abd9326a"}}}}, 0xc3) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0x2, &(0x7f0000000280)="1eb354018b85e16fc9485abe5555b46a5a3d8e7eddc81981a8ac60df318de2521f4fc54c63f42a7549f4c7e4ebc263fb83fc4e6450076f31af6214e03cf471d5e127b655846f16c2fae977d873e5a4e88f08c8cef466a973025cb1a2cb734bc29b95a18fc25a3eb0c388cc202792fa53437762a4917ca758285282560b6ad414d3ff2fb194ef575845d0afbaf8b28fd8c57bc8bcdba8e7345fcc400fe8f2b0e6ed242ab431225c806ccf5a0fa61d28d1f54d79f4fcbe1d49baa22fdc69b2f1dc4d2b1ca271d1ca6fcd20f76a", 0xcc) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000040)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x2, 0x7, 0xfffffff9, 0x80, r2, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0xc}, 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x2, 0x7, 0xfffffff9, 0x80, r2, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0xc}, 0x48) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000016c0), 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) read$midi(r7, &(0x7f00000006c0)=""/4096, 0x1000) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x7, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x5}, @map_val={0x18, 0x2, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8000}]}, &(0x7f0000000440)='syzkaller\x00', 0x2, 0x83, &(0x7f0000000480)=""/131, 0x41000, 0x1, '\x00', 0x0, 0x22, r4, 0x8, &(0x7f0000000580)={0x7, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x3, 0x2, 0x3, 0xfffffff9}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[r5, r6, r2]}, 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x7, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x5}, @map_val={0x18, 0x2, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8000}]}, &(0x7f0000000440)='syzkaller\x00', 0x2, 0x83, &(0x7f0000000480)=""/131, 0x41000, 0x1, '\x00', 0x0, 0x22, r4, 0x8, &(0x7f0000000580)={0x7, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x3, 0x2, 0x3, 0xfffffff9}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[r5, r6, r2]}, 0x80) socket$packet(0x11, 0x2, 0x300) (async) socket$packet(0x11, 0x2, 0x300) 01:03:59 executing program 0: bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 2: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000)=r0, 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x2, 0x1}, 0x48) getpgrp(0x0) (async) syz_open_procfs$namespace(r0, 0x0) (async) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000)=r0, 0x12) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x2, 0x1}, 0x48) (async) 01:03:59 executing program 0: bpf$MAP_CREATE(0x800000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0xa1, 0xfffffffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0xa1, 0xfffffffd}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x17, 0x0, 0x4, 0x5, 0x132, 0xffffffffffffffff, 0x9ee, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x4}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000001340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001380)=0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000340)="8d5e536331ffd3f7f98d2ff83caef19454d8d230e4da56a403e65e1b22a8c24cd891b938d244aa3ae3b71fe3b8cdb41ef99389c1c7f0ced6ddb504f32052703f6b7fca005a5bef8c7826cc3bb1dd5495000b838167f688a7deab81fb23c4fd15da616c0c9703439134e1c3cc5574e638f7ccfcf600fd6306213bc8da84360eb387e2c068b121cbf1da1008624270bce5894807c753ef2b30012de909b5951aba3d50d878a835348dfee85d427d93625a8aaf801e444dc0143b7e9b9f0f84e297505c95816d484859ceac5a1c59e15e1e8f4767b7c92b115e6273e4c22bb9246d971d36b26d5ebc98570ae8b6da3085e600a1769c0c3d81fd17ca004d3910483decc81ece6b6d4c11cee005dee5c596c34c6e1d274273763218efb229b29ef2fe96303df2723322ae1d4834d570ee0157e24029963e5dd1d806af7c527913cc491a8dbf1d2539268da45301e869a2bbc58958ec98b4dfe7b4092b20a7a7c31828351b51370ce8847a38fc803b81c03277703b8792de8b629792b4ff1a78cce421fe154f8470176311a46a34b6fad320cb6680c99d0b45f0e34cbdebf9b8fd7fc3e8e09e8c605a7288f91f4b2d97b90a6daa7a55fe497b3e10c53e4bae565f5e1f44939b599894edc6c343f4ef4d74599f40612c323a2ced6c363d526db4580c20c57d8b1b66f780aab4b3771594d28f0c5dd0887063804811e1d1e3ee90bad077fa29a442ac927cd13453f72089b347c88365cd70bfbe4afe489fa757a97a628cca95cf2cc28254fd4a344389ccb2a7f328e0ba42a3a1ba5117b5f2790fa4dd5e22cf8132be49ff56bbed7f61808c73f8f4208072b82ed857f9e43f55ea45074823ddbc1e9887d6e04139245d5598576d00084c3612638c88619717a3e4440d0b092a7359d789c5454fb297b8e82debddb488d617743eed40c7a95e55086a138c4a308123f9fbd2690a18f99cd60c937fcf6b610583e90151347a1b6ef194cfe4cf1686ed028c0d72f2880aa1233d9755ec41899c57fb9b0e028c1d79265b27e18100c9dd54061ec77c3ea094de703e9569cc44de0a922782d89ebd2cabae8ccc5c354830a6980e46f93f136182f2145a267b47e88f6ca7b750d0f206a56b4a982418e73bb8081819aba2bc00380799f2d3314d9957d4e1b6712ef76f43f1203f105f9228a05f39125c006bccaa958add00986b8e7040461620bb3bb872c8ca5fc013eeecdf053fa737fec2251a800854b74004fe920fbaeed0f463d6fb4896ed9e3efabe693511aad0966d8891e59bef4b32c1b1b6a861cbf4cb0511cbb476066b73a5fb509bcc9194c892c8f8c42f9de437c93502e1b0dc952bc0a05fee34c89b20a36eee08633a4db5b69d2f240c402056a9657864249f26f2a2836d085f966b3bc5fab3ba0d40793742184d47268d614a9ed52345ea6b85683758925d3426760759a4397d1a20a223cb54e6b51c3746b23392ace4a9d38545ee6ac0e01259edc2d4df7d7c326afb44c0407afe0a8bf9504a2267a5744e56fe10705845285e6f5f4cb390d87f956ae8448b41d2fd7d0f98d0f6a9e9701be43feffc877a0d8506a4da1821ec117b6917dbc46bba904ec58e84aeab2a048846de556ba07d0cd3e9876cc780e60c0523137d2f89a23bbfcd58809d5f24862960c30f7d2c6e43bdbecd6580fab5ff1cb9742d869e3eac6b26ece55e2a29f2c576d41d7c0dff0c527aa15561bdd9c1f115ba881539b65c35d0e757b6d17a90c5d164589ae13c2f156a93b080ef3da97352beaa8bb058e5131e41533a39a0fad4e9d78c4b8360d371bee36d97d1f6aef4837e040e6426dd0391d70ddc8e3ace4f9bbd92bde9b59aeb4ecd9f351fb9569b5c8fe712a75836fe9b775e2bdb188b34f719bde69ba2e08b8bc32e9f28866df18cf792eee196da912ab33e5746b75a57332715ef39ce9f59b358c9768eb7306a5af7a072ef9cd533004e8d6984c8a4614b5c1e802fb652b566acc93cb7c343af2a03df8e73396fe0043620c49b629d7d331a82c120a9e14c1e608121fc9937e229cc90b912b74c44562a5bd6c041cb1fd8f42da04e699d6d7e14d8c5646ad02ac438f938fc1654c3937f9fe87077c892e67890845ed0a4fa73cba6c0ebe225615b3fedea7f7d2c7a482c45662951099e3f58cf763f275e5187c43da4d505328e9d7c9f850fb2fdb8a88718707881d34420431f63fd99ee79243545fbe4f2751b04515ac1e1f6f5ba42f733189a43597d8eff13541a07eea13a617111e6e958046b39310a2dc23042d6299952e413f1f359c44f254c15bd5098845877d460d8fd7aff7cfba45505e50be6ea755b388ab5b04961615201f6c3f6d52e0be6b7339fa60b9c997f3a414b06b1cf31e22c119aae3a7338d39b97df3f50eab09c1af7086577a5c4931e27f1e5ef572a0a6db41b2219c81734203c53e830427cc2d2bc3537b4b8985adfb763fb02c383f068f217091aa499b609e93d4aff4620cf7d7ceba663a8192799907253f46806e5720c85246abc1959c33beb47aeac401c286ec3126dde6eb5ec93843d6d2268cdc8cba862bbf8ad841c057859fee9d5493a73e8fea959591a59cfbf607beb177674b747805dec3cfe100b604ef278225643b7ac3b398ac4ad001a0de38e9babb1e0bd42dcf885b46b0033ee2543c16a48930775715ed2b44b2a184e28a660e6b2a3af73ba0dbc65b13f4153b3ab1c092fb2d4e645975b09b98900913a5400092371ec2ab963f2383b5fc5cc0f3450f8b7501d9e92402954cfae2dc2927da83068f6712b2f7b67df923277da49af65e6e23bd80f12c28bb7b309533da27699c745673408915534e84fad951e0fc53f7a4733181d1ae8a818d226e9ed746bc3e1826cfab0062925c9c309e6afd3d415659f1c543651b424cfd1a6079116a3846d82e74846b83f0d2dd7535a1199163387d29df28fe05cf3f5c3d8e098f7f9e7594d12cc59618f2db729be53438b073cd6fa9cd612866d476cb92b8b548d9358a17360e2f7040bafcaec0b51a2d1203271b0e36f5bbf7c7d946769b9dc763db43aec1cd828b991c1cf4e3aa33d836ea245d927beb4c515ce9e5ba7f9834be6c3b74d882f62e658eb7610a72a3af2ac66e6f37c765864ea6e20fa6ba19bf6a887350ba8437762e266766a8cffc546ebf57c9140f3ec2aac770b34981883c13325c01e6df088587424deb9aacc4a12d0817f7e7907da142eefb42290f99bcfdff622a659cec6578e217cb36a05283e5f1b60fc7a756028abedb8e7ebfacb9e2aff20d35437764f1acc58ef0dfaf0c15920473f3e1d7ffa71d8680d8fb656135c9a23efc5b4fba985f6aafeac162b983e1ab6d6cafd72bd09a95451b931a637f40d21480621fa7d4387a12ff516d30339d474cae223f564e37964b77f908f0ff489ff397c8cd216b82902b16de112db5f13fe746004d6d112eadc281dfa04b86e8518ba906f3f11b152cdaf67084875c4091afb04356a9b701c99762bb50ec88d5717c7b1bf5350e99fda202e5ac7dfb813d0c8131eb5d53596b2a083db276ca6d2a71f41b4aef9e711294b75ebcb2fde3d5473f254351fb47edd67b93b079e13daa5f16aa4c03e06662a14e85d08d020d7ad72c4f8610781e3f02be02c97a6e68f83566ea6a5db8f8a7feb5fc6437b0310e25bab634a39dbd28062434b9c675b2065ae7347afd52f592715a2adc61b53d6e15708e2cfe4529dc9d0e79a8b965c209d23d17a039be2d26c5d3768047b4d59ad3d9d3d73afa212584837862d7688a6565c1228db35721051b811902aa5437b5c9c2b0c6d2f0aadeddb9106d80cc2b9601041b96666feca139a7b61850cf4457fb590a2f5ac591d0cf83abc95dcce667d7addfb39764b3a08a5c8cd862efafe08fb370c7ecfce7e0743da0ad10494f200eca03bd7469704e4ed44c05f960eecabcfdef67ac4c8866cd044f937b2f3958adda2543a8e0b2a8f8592f32eb404facd2168c308abad266096b68454b15755e256b63c5a436ef74d7d2aa673839c6321c44a5ad151529bbf1704e28777a0c42e4f4c33bcbe5db98b2a2f8d5d6de8db9fdeb64e5bddc4e47cb80e3e7da511757d3a26ce3a5d05cf5133d510d8eab1bc1c179832a3af899bba585803072f7b6e2d0274138c8e7bfb02664228488696cfe5957a92234c0ddb1ee06e67a4873f666b215127b6f225b4ac9af2bc9e172679902a0db377700f531bcdcc22987a1a168e86d68b203934fb4d010f0dbfcfb043305f9dd2601cefb0f1873557dd7bb8fa3884870a2236f9d12f7424ede53117926660f1770ce930732c02e84879ce1b27a63b3e1d072c169535d4d98c6efcbc0d908f120df0aaaaa4a1ba3aa0bcbc0c1cc17ee1bb13f14a87478ff17d640cc5281ef5746b118fd92097d05852131a5543826379f854b9627be63403d01266b5f53721a38253703d3a204465362c70478ecc0a83768c6144eff86515160e9e7cbfe8413287d6bb40f6fa32606db7bf7a35138abe3e0d323a0987191e9b7e0a3f5dcad866be4d6860fb5d45b1df8fa3a6fb7e59dc296852a635f0c08e3483f85e20bd7304200b088fee8494347d52fb37c49c61a5114f5a437cb15336d09de6d4c7532bc34a3ac24c8d4385883c83477507a043887907d32d4068031860fc20f614976391f4392ce4e7acc07afdf9a8ea78a2a81a57de0bb4430ea8646e546e139bdc36de33ca614a228e70906f683d6239876e8b4c833be5b3496988c1cfb6bb1418f98a5f8be26f51ca2199c282f8ffc514bf314cb1a994be0edb91b7e8210601126159f3bd1c3fcf4c2b2d3b8205fb40d2da75de115e9bccc0b33793eb316b15b034cd8b213987a585afe96ac866f45e169e7d8dca44b28d7324d9d3f053229cfa5ee58f8f60cef9208bfca5131fcf6ead160c237daa21eb258dd30f4c787f46da35a737072d3723edfeff0bd9956ddb5be3423e7d11d7e12259a40d6704b853dc359348c0d8f5fdd409563dff185401cac83f50d9b6bd4ef485add0c31a175b9c1ad6abc615ae4b21d66bbde73b876235e88b47e75ee090819e7c191420217ba2b05c91c7ed5fcf11dbcafde86e84a122b3c1fe6dfe5c97239d7d4f3e198193992541eb6873ebd63b7fc0663c87b1f399a003ad9685b39ec6ee0e7ff3998a662505363d35e11dc0c1f6240a850449ac3c517e611fd3b275a326b89c373f128ccfe4e76688bc033c87fa53f450f74d2d9391f0e17d6cc0cf34772c4e768d8e12548b098f1da3654a5ecb77ecee4697a5ff73573948f2dcb42e245b0e0cc914078f50995f94bbe5422f8bc3008094064b505dab34994b1c2f8803150ea95654561c8e6a19fabe07d11383c65ccde23acbde9a73a17bfbe17d16f3a5d5483f761ed930878cb839b11b94a6653d746a1696b578433efe6d4b9e0caf0beeb5455c45d63a099650774d6524b61ccf144be4bedd48c1abeb0a6a102247ab68e3bc36d7cde5fefcc1b98c9f1dacda0197b42021d6219e49be96b453d953e0bd87339b48572b953cda7a6c605f40ec0827de112d0e3f5d1449ea252c6925647878999f25e31b8448c269f540e5339521da9a7899fa5a316aa16d6f4da510bb22aa0b0c66261ef17bc3edbe8af0cd39af467552a3d185d7ba39b1627326ef835f0ef447aa065866145687c129df5c60de130809e6e2052faabe2f88a5f5671faf31eba9b6801ee9cd6d21f0a2df726dde749eb56af49a1c355eac4b7af6ec56b7aff07e3429c329030249f402081299b9f518ae2335e5530536da25d7a868b6b2b5", 0x1000, 0x8040, &(0x7f0000000240)={0x11, 0xf8, r1, 0x1, 0x4d, 0x6, @local}, 0x14) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000000180)={0x0, 0xe1, '\b\x00*', 0x9, 0x9}) sendto$packet(0xffffffffffffffff, &(0x7f0000000080)="a5b32431b3", 0x5, 0x40, &(0x7f0000000140)={0x11, 0x18, r0}, 0x14) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000280)={'syztnl1\x00', r0, 0x10, 0x40, 0x9, 0x7, {{0x5, 0x4, 0x0, 0x17, 0x14, 0x64, 0x0, 0xfc, 0x29, 0x0, @local, @local}}}}) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f00000002c0)=0x6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14) sendto$packet(0xffffffffffffffff, &(0x7f0000000140)="944099200a8932f372c553b5e013032b53491792aeaa9ce18671228bccbd3caf63f55dda5aeb1f2f80e88428d2b932194a9bacad3a732560769c540060519acfebd7eb49084b155d5b0f0d5ba9d860697ffbce76c27d6b20eaa7652ecfa542a4985d982082997d0d8f501ca1ed393643f6ff8b3e522aa124f93d83945e57b9381746d27bef2b7b2fb9516b72c336b7fdcfaa4e", 0x93, 0x48805, &(0x7f0000000280)={0x11, 0x15, r4, 0x1, 0x6, 0x6, @remote}, 0x14) 01:03:59 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000100)={r0, 0x5, 0x1}) 01:03:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x8, 0x40, 0x67, 0x1, {{0x1b, 0x4, 0x0, 0x9, 0x6c, 0x67, 0x0, 0x3f, 0x4, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ssrr={0x89, 0x1b, 0xeb, [@loopback, @remote, @rand_addr=0x64010102, @local, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x2c, 0xec, 0x0, 0xf, [0x7f, 0x10001, 0xffffff74, 0x3, 0x9, 0x1, 0x6, 0x8, 0x6, 0x8]}, @timestamp_addr={0x44, 0xc, 0xc, 0x1, 0x6, [{@multicast1, 0x15}]}, @ra={0x94, 0x4, 0x1}, @end]}}}}}) 01:03:59 executing program 0: bpf$MAP_CREATE(0x900000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x8, 0x40, 0x67, 0x1, {{0x1b, 0x4, 0x0, 0x9, 0x6c, 0x67, 0x0, 0x3f, 0x4, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ssrr={0x89, 0x1b, 0xeb, [@loopback, @remote, @rand_addr=0x64010102, @local, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x2c, 0xec, 0x0, 0xf, [0x7f, 0x10001, 0xffffff74, 0x3, 0x9, 0x1, 0x6, 0x8, 0x6, 0x8]}, @timestamp_addr={0x44, 0xc, 0xc, 0x1, 0x6, [{@multicast1, 0x15}]}, @ra={0x94, 0x4, 0x1}, @end]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x8, 0x40, 0x67, 0x1, {{0x1b, 0x4, 0x0, 0x9, 0x6c, 0x67, 0x0, 0x3f, 0x4, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ssrr={0x89, 0x1b, 0xeb, [@loopback, @remote, @rand_addr=0x64010102, @local, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x2c, 0xec, 0x0, 0xf, [0x7f, 0x10001, 0xffffff74, 0x3, 0x9, 0x1, 0x6, 0x8, 0x6, 0x8]}, @timestamp_addr={0x44, 0xc, 0xc, 0x1, 0x6, [{@multicast1, 0x15}]}, @ra={0x94, 0x4, 0x1}, @end]}}}}}) (async) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x17, 0x0, 0x4, 0x5, 0x132, 0xffffffffffffffff, 0x9ee, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x4}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000001340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001380)=0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000340)="8d5e536331ffd3f7f98d2ff83caef19454d8d230e4da56a403e65e1b22a8c24cd891b938d244aa3ae3b71fe3b8cdb41ef99389c1c7f0ced6ddb504f32052703f6b7fca005a5bef8c7826cc3bb1dd5495000b838167f688a7deab81fb23c4fd15da616c0c9703439134e1c3cc5574e638f7ccfcf600fd6306213bc8da84360eb387e2c068b121cbf1da1008624270bce5894807c753ef2b30012de909b5951aba3d50d878a835348dfee85d427d93625a8aaf801e444dc0143b7e9b9f0f84e297505c95816d484859ceac5a1c59e15e1e8f4767b7c92b115e6273e4c22bb9246d971d36b26d5ebc98570ae8b6da3085e600a1769c0c3d81fd17ca004d3910483decc81ece6b6d4c11cee005dee5c596c34c6e1d274273763218efb229b29ef2fe96303df2723322ae1d4834d570ee0157e24029963e5dd1d806af7c527913cc491a8dbf1d2539268da45301e869a2bbc58958ec98b4dfe7b4092b20a7a7c31828351b51370ce8847a38fc803b81c03277703b8792de8b629792b4ff1a78cce421fe154f8470176311a46a34b6fad320cb6680c99d0b45f0e34cbdebf9b8fd7fc3e8e09e8c605a7288f91f4b2d97b90a6daa7a55fe497b3e10c53e4bae565f5e1f44939b599894edc6c343f4ef4d74599f40612c323a2ced6c363d526db4580c20c57d8b1b66f780aab4b3771594d28f0c5dd0887063804811e1d1e3ee90bad077fa29a442ac927cd13453f72089b347c88365cd70bfbe4afe489fa757a97a628cca95cf2cc28254fd4a344389ccb2a7f328e0ba42a3a1ba5117b5f2790fa4dd5e22cf8132be49ff56bbed7f61808c73f8f4208072b82ed857f9e43f55ea45074823ddbc1e9887d6e04139245d5598576d00084c3612638c88619717a3e4440d0b092a7359d789c5454fb297b8e82debddb488d617743eed40c7a95e55086a138c4a308123f9fbd2690a18f99cd60c937fcf6b610583e90151347a1b6ef194cfe4cf1686ed028c0d72f2880aa1233d9755ec41899c57fb9b0e028c1d79265b27e18100c9dd54061ec77c3ea094de703e9569cc44de0a922782d89ebd2cabae8ccc5c354830a6980e46f93f136182f2145a267b47e88f6ca7b750d0f206a56b4a982418e73bb8081819aba2bc00380799f2d3314d9957d4e1b6712ef76f43f1203f105f9228a05f39125c006bccaa958add00986b8e7040461620bb3bb872c8ca5fc013eeecdf053fa737fec2251a800854b74004fe920fbaeed0f463d6fb4896ed9e3efabe693511aad0966d8891e59bef4b32c1b1b6a861cbf4cb0511cbb476066b73a5fb509bcc9194c892c8f8c42f9de437c93502e1b0dc952bc0a05fee34c89b20a36eee08633a4db5b69d2f240c402056a9657864249f26f2a2836d085f966b3bc5fab3ba0d40793742184d47268d614a9ed52345ea6b85683758925d3426760759a4397d1a20a223cb54e6b51c3746b23392ace4a9d38545ee6ac0e01259edc2d4df7d7c326afb44c0407afe0a8bf9504a2267a5744e56fe10705845285e6f5f4cb390d87f956ae8448b41d2fd7d0f98d0f6a9e9701be43feffc877a0d8506a4da1821ec117b6917dbc46bba904ec58e84aeab2a048846de556ba07d0cd3e9876cc780e60c0523137d2f89a23bbfcd58809d5f24862960c30f7d2c6e43bdbecd6580fab5ff1cb9742d869e3eac6b26ece55e2a29f2c576d41d7c0dff0c527aa15561bdd9c1f115ba881539b65c35d0e757b6d17a90c5d164589ae13c2f156a93b080ef3da97352beaa8bb058e5131e41533a39a0fad4e9d78c4b8360d371bee36d97d1f6aef4837e040e6426dd0391d70ddc8e3ace4f9bbd92bde9b59aeb4ecd9f351fb9569b5c8fe712a75836fe9b775e2bdb188b34f719bde69ba2e08b8bc32e9f28866df18cf792eee196da912ab33e5746b75a57332715ef39ce9f59b358c9768eb7306a5af7a072ef9cd533004e8d6984c8a4614b5c1e802fb652b566acc93cb7c343af2a03df8e73396fe0043620c49b629d7d331a82c120a9e14c1e608121fc9937e229cc90b912b74c44562a5bd6c041cb1fd8f42da04e699d6d7e14d8c5646ad02ac438f938fc1654c3937f9fe87077c892e67890845ed0a4fa73cba6c0ebe225615b3fedea7f7d2c7a482c45662951099e3f58cf763f275e5187c43da4d505328e9d7c9f850fb2fdb8a88718707881d34420431f63fd99ee79243545fbe4f2751b04515ac1e1f6f5ba42f733189a43597d8eff13541a07eea13a617111e6e958046b39310a2dc23042d6299952e413f1f359c44f254c15bd5098845877d460d8fd7aff7cfba45505e50be6ea755b388ab5b04961615201f6c3f6d52e0be6b7339fa60b9c997f3a414b06b1cf31e22c119aae3a7338d39b97df3f50eab09c1af7086577a5c4931e27f1e5ef572a0a6db41b2219c81734203c53e830427cc2d2bc3537b4b8985adfb763fb02c383f068f217091aa499b609e93d4aff4620cf7d7ceba663a8192799907253f46806e5720c85246abc1959c33beb47aeac401c286ec3126dde6eb5ec93843d6d2268cdc8cba862bbf8ad841c057859fee9d5493a73e8fea959591a59cfbf607beb177674b747805dec3cfe100b604ef278225643b7ac3b398ac4ad001a0de38e9babb1e0bd42dcf885b46b0033ee2543c16a48930775715ed2b44b2a184e28a660e6b2a3af73ba0dbc65b13f4153b3ab1c092fb2d4e645975b09b98900913a5400092371ec2ab963f2383b5fc5cc0f3450f8b7501d9e92402954cfae2dc2927da83068f6712b2f7b67df923277da49af65e6e23bd80f12c28bb7b309533da27699c745673408915534e84fad951e0fc53f7a4733181d1ae8a818d226e9ed746bc3e1826cfab0062925c9c309e6afd3d415659f1c543651b424cfd1a6079116a3846d82e74846b83f0d2dd7535a1199163387d29df28fe05cf3f5c3d8e098f7f9e7594d12cc59618f2db729be53438b073cd6fa9cd612866d476cb92b8b548d9358a17360e2f7040bafcaec0b51a2d1203271b0e36f5bbf7c7d946769b9dc763db43aec1cd828b991c1cf4e3aa33d836ea245d927beb4c515ce9e5ba7f9834be6c3b74d882f62e658eb7610a72a3af2ac66e6f37c765864ea6e20fa6ba19bf6a887350ba8437762e266766a8cffc546ebf57c9140f3ec2aac770b34981883c13325c01e6df088587424deb9aacc4a12d0817f7e7907da142eefb42290f99bcfdff622a659cec6578e217cb36a05283e5f1b60fc7a756028abedb8e7ebfacb9e2aff20d35437764f1acc58ef0dfaf0c15920473f3e1d7ffa71d8680d8fb656135c9a23efc5b4fba985f6aafeac162b983e1ab6d6cafd72bd09a95451b931a637f40d21480621fa7d4387a12ff516d30339d474cae223f564e37964b77f908f0ff489ff397c8cd216b82902b16de112db5f13fe746004d6d112eadc281dfa04b86e8518ba906f3f11b152cdaf67084875c4091afb04356a9b701c99762bb50ec88d5717c7b1bf5350e99fda202e5ac7dfb813d0c8131eb5d53596b2a083db276ca6d2a71f41b4aef9e711294b75ebcb2fde3d5473f254351fb47edd67b93b079e13daa5f16aa4c03e06662a14e85d08d020d7ad72c4f8610781e3f02be02c97a6e68f83566ea6a5db8f8a7feb5fc6437b0310e25bab634a39dbd28062434b9c675b2065ae7347afd52f592715a2adc61b53d6e15708e2cfe4529dc9d0e79a8b965c209d23d17a039be2d26c5d3768047b4d59ad3d9d3d73afa212584837862d7688a6565c1228db35721051b811902aa5437b5c9c2b0c6d2f0aadeddb9106d80cc2b9601041b96666feca139a7b61850cf4457fb590a2f5ac591d0cf83abc95dcce667d7addfb39764b3a08a5c8cd862efafe08fb370c7ecfce7e0743da0ad10494f200eca03bd7469704e4ed44c05f960eecabcfdef67ac4c8866cd044f937b2f3958adda2543a8e0b2a8f8592f32eb404facd2168c308abad266096b68454b15755e256b63c5a436ef74d7d2aa673839c6321c44a5ad151529bbf1704e28777a0c42e4f4c33bcbe5db98b2a2f8d5d6de8db9fdeb64e5bddc4e47cb80e3e7da511757d3a26ce3a5d05cf5133d510d8eab1bc1c179832a3af899bba585803072f7b6e2d0274138c8e7bfb02664228488696cfe5957a92234c0ddb1ee06e67a4873f666b215127b6f225b4ac9af2bc9e172679902a0db377700f531bcdcc22987a1a168e86d68b203934fb4d010f0dbfcfb043305f9dd2601cefb0f1873557dd7bb8fa3884870a2236f9d12f7424ede53117926660f1770ce930732c02e84879ce1b27a63b3e1d072c169535d4d98c6efcbc0d908f120df0aaaaa4a1ba3aa0bcbc0c1cc17ee1bb13f14a87478ff17d640cc5281ef5746b118fd92097d05852131a5543826379f854b9627be63403d01266b5f53721a38253703d3a204465362c70478ecc0a83768c6144eff86515160e9e7cbfe8413287d6bb40f6fa32606db7bf7a35138abe3e0d323a0987191e9b7e0a3f5dcad866be4d6860fb5d45b1df8fa3a6fb7e59dc296852a635f0c08e3483f85e20bd7304200b088fee8494347d52fb37c49c61a5114f5a437cb15336d09de6d4c7532bc34a3ac24c8d4385883c83477507a043887907d32d4068031860fc20f614976391f4392ce4e7acc07afdf9a8ea78a2a81a57de0bb4430ea8646e546e139bdc36de33ca614a228e70906f683d6239876e8b4c833be5b3496988c1cfb6bb1418f98a5f8be26f51ca2199c282f8ffc514bf314cb1a994be0edb91b7e8210601126159f3bd1c3fcf4c2b2d3b8205fb40d2da75de115e9bccc0b33793eb316b15b034cd8b213987a585afe96ac866f45e169e7d8dca44b28d7324d9d3f053229cfa5ee58f8f60cef9208bfca5131fcf6ead160c237daa21eb258dd30f4c787f46da35a737072d3723edfeff0bd9956ddb5be3423e7d11d7e12259a40d6704b853dc359348c0d8f5fdd409563dff185401cac83f50d9b6bd4ef485add0c31a175b9c1ad6abc615ae4b21d66bbde73b876235e88b47e75ee090819e7c191420217ba2b05c91c7ed5fcf11dbcafde86e84a122b3c1fe6dfe5c97239d7d4f3e198193992541eb6873ebd63b7fc0663c87b1f399a003ad9685b39ec6ee0e7ff3998a662505363d35e11dc0c1f6240a850449ac3c517e611fd3b275a326b89c373f128ccfe4e76688bc033c87fa53f450f74d2d9391f0e17d6cc0cf34772c4e768d8e12548b098f1da3654a5ecb77ecee4697a5ff73573948f2dcb42e245b0e0cc914078f50995f94bbe5422f8bc3008094064b505dab34994b1c2f8803150ea95654561c8e6a19fabe07d11383c65ccde23acbde9a73a17bfbe17d16f3a5d5483f761ed930878cb839b11b94a6653d746a1696b578433efe6d4b9e0caf0beeb5455c45d63a099650774d6524b61ccf144be4bedd48c1abeb0a6a102247ab68e3bc36d7cde5fefcc1b98c9f1dacda0197b42021d6219e49be96b453d953e0bd87339b48572b953cda7a6c605f40ec0827de112d0e3f5d1449ea252c6925647878999f25e31b8448c269f540e5339521da9a7899fa5a316aa16d6f4da510bb22aa0b0c66261ef17bc3edbe8af0cd39af467552a3d185d7ba39b1627326ef835f0ef447aa065866145687c129df5c60de130809e6e2052faabe2f88a5f5671faf31eba9b6801ee9cd6d21f0a2df726dde749eb56af49a1c355eac4b7af6ec56b7aff07e3429c329030249f402081299b9f518ae2335e5530536da25d7a868b6b2b5", 0x1000, 0x8040, &(0x7f0000000240)={0x11, 0xf8, r1, 0x1, 0x4d, 0x6, @local}, 0x14) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000000180)={0x0, 0xe1, '\b\x00*', 0x9, 0x9}) sendto$packet(0xffffffffffffffff, &(0x7f0000000080)="a5b32431b3", 0x5, 0x40, &(0x7f0000000140)={0x11, 0x18, r0}, 0x14) socket$inet_udplite(0x2, 0x2, 0x88) (async) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000280)={'syztnl1\x00', r0, 0x10, 0x40, 0x9, 0x7, {{0x5, 0x4, 0x0, 0x17, 0x14, 0x64, 0x0, 0xfc, 0x29, 0x0, @local, @local}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000280)={'syztnl1\x00', r0, 0x10, 0x40, 0x9, 0x7, {{0x5, 0x4, 0x0, 0x17, 0x14, 0x64, 0x0, 0xfc, 0x29, 0x0, @local, @local}}}}) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x800, 0x5, 0x0, 0x0}) socket$packet(0x11, 0x3, 0x300) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) 01:03:59 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000100)={r0, 0x5, 0x1}) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f00000002c0)=0x6) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14) sendto$packet(0xffffffffffffffff, &(0x7f0000000140)="944099200a8932f372c553b5e013032b53491792aeaa9ce18671228bccbd3caf63f55dda5aeb1f2f80e88428d2b932194a9bacad3a732560769c540060519acfebd7eb49084b155d5b0f0d5ba9d860697ffbce76c27d6b20eaa7652ecfa542a4985d982082997d0d8f501ca1ed393643f6ff8b3e522aa124f93d83945e57b9381746d27bef2b7b2fb9516b72c336b7fdcfaa4e", 0x93, 0x48805, &(0x7f0000000280)={0x11, 0x15, r4, 0x1, 0x6, 0x6, @remote}, 0x14) (async) sendto$packet(0xffffffffffffffff, &(0x7f0000000140)="944099200a8932f372c553b5e013032b53491792aeaa9ce18671228bccbd3caf63f55dda5aeb1f2f80e88428d2b932194a9bacad3a732560769c540060519acfebd7eb49084b155d5b0f0d5ba9d860697ffbce76c27d6b20eaa7652ecfa542a4985d982082997d0d8f501ca1ed393643f6ff8b3e522aa124f93d83945e57b9381746d27bef2b7b2fb9516b72c336b7fdcfaa4e", 0x93, 0x48805, &(0x7f0000000280)={0x11, 0x15, r4, 0x1, 0x6, 0x6, @remote}, 0x14) 01:03:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x8, 0x40, 0x67, 0x1, {{0x1b, 0x4, 0x0, 0x9, 0x6c, 0x67, 0x0, 0x3f, 0x4, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ssrr={0x89, 0x1b, 0xeb, [@loopback, @remote, @rand_addr=0x64010102, @local, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x2c, 0xec, 0x0, 0xf, [0x7f, 0x10001, 0xffffff74, 0x3, 0x9, 0x1, 0x6, 0x8, 0x6, 0x8]}, @timestamp_addr={0x44, 0xc, 0xc, 0x1, 0x6, [{@multicast1, 0x15}]}, @ra={0x94, 0x4, 0x1}, @end]}}}}}) 01:03:59 executing program 0: bpf$MAP_CREATE(0xa00000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x800, 0x5, 0x0, 0x0}) socket$packet(0x11, 0x3, 0x300) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x800, 0x5}) (async) socket$packet(0x11, 0x3, 0x300) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r1}) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) (async) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x17, 0x0, 0x4, 0x5, 0x132, 0xffffffffffffffff, 0x9ee, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x4}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000001340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001380)=0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000340)="8d5e536331ffd3f7f98d2ff83caef19454d8d230e4da56a403e65e1b22a8c24cd891b938d244aa3ae3b71fe3b8cdb41ef99389c1c7f0ced6ddb504f32052703f6b7fca005a5bef8c7826cc3bb1dd5495000b838167f688a7deab81fb23c4fd15da616c0c9703439134e1c3cc5574e638f7ccfcf600fd6306213bc8da84360eb387e2c068b121cbf1da1008624270bce5894807c753ef2b30012de909b5951aba3d50d878a835348dfee85d427d93625a8aaf801e444dc0143b7e9b9f0f84e297505c95816d484859ceac5a1c59e15e1e8f4767b7c92b115e6273e4c22bb9246d971d36b26d5ebc98570ae8b6da3085e600a1769c0c3d81fd17ca004d3910483decc81ece6b6d4c11cee005dee5c596c34c6e1d274273763218efb229b29ef2fe96303df2723322ae1d4834d570ee0157e24029963e5dd1d806af7c527913cc491a8dbf1d2539268da45301e869a2bbc58958ec98b4dfe7b4092b20a7a7c31828351b51370ce8847a38fc803b81c03277703b8792de8b629792b4ff1a78cce421fe154f8470176311a46a34b6fad320cb6680c99d0b45f0e34cbdebf9b8fd7fc3e8e09e8c605a7288f91f4b2d97b90a6daa7a55fe497b3e10c53e4bae565f5e1f44939b599894edc6c343f4ef4d74599f40612c323a2ced6c363d526db4580c20c57d8b1b66f780aab4b3771594d28f0c5dd0887063804811e1d1e3ee90bad077fa29a442ac927cd13453f72089b347c88365cd70bfbe4afe489fa757a97a628cca95cf2cc28254fd4a344389ccb2a7f328e0ba42a3a1ba5117b5f2790fa4dd5e22cf8132be49ff56bbed7f61808c73f8f4208072b82ed857f9e43f55ea45074823ddbc1e9887d6e04139245d5598576d00084c3612638c88619717a3e4440d0b092a7359d789c5454fb297b8e82debddb488d617743eed40c7a95e55086a138c4a308123f9fbd2690a18f99cd60c937fcf6b610583e90151347a1b6ef194cfe4cf1686ed028c0d72f2880aa1233d9755ec41899c57fb9b0e028c1d79265b27e18100c9dd54061ec77c3ea094de703e9569cc44de0a922782d89ebd2cabae8ccc5c354830a6980e46f93f136182f2145a267b47e88f6ca7b750d0f206a56b4a982418e73bb8081819aba2bc00380799f2d3314d9957d4e1b6712ef76f43f1203f105f9228a05f39125c006bccaa958add00986b8e7040461620bb3bb872c8ca5fc013eeecdf053fa737fec2251a800854b74004fe920fbaeed0f463d6fb4896ed9e3efabe693511aad0966d8891e59bef4b32c1b1b6a861cbf4cb0511cbb476066b73a5fb509bcc9194c892c8f8c42f9de437c93502e1b0dc952bc0a05fee34c89b20a36eee08633a4db5b69d2f240c402056a9657864249f26f2a2836d085f966b3bc5fab3ba0d40793742184d47268d614a9ed52345ea6b85683758925d3426760759a4397d1a20a223cb54e6b51c3746b23392ace4a9d38545ee6ac0e01259edc2d4df7d7c326afb44c0407afe0a8bf9504a2267a5744e56fe10705845285e6f5f4cb390d87f956ae8448b41d2fd7d0f98d0f6a9e9701be43feffc877a0d8506a4da1821ec117b6917dbc46bba904ec58e84aeab2a048846de556ba07d0cd3e9876cc780e60c0523137d2f89a23bbfcd58809d5f24862960c30f7d2c6e43bdbecd6580fab5ff1cb9742d869e3eac6b26ece55e2a29f2c576d41d7c0dff0c527aa15561bdd9c1f115ba881539b65c35d0e757b6d17a90c5d164589ae13c2f156a93b080ef3da97352beaa8bb058e5131e41533a39a0fad4e9d78c4b8360d371bee36d97d1f6aef4837e040e6426dd0391d70ddc8e3ace4f9bbd92bde9b59aeb4ecd9f351fb9569b5c8fe712a75836fe9b775e2bdb188b34f719bde69ba2e08b8bc32e9f28866df18cf792eee196da912ab33e5746b75a57332715ef39ce9f59b358c9768eb7306a5af7a072ef9cd533004e8d6984c8a4614b5c1e802fb652b566acc93cb7c343af2a03df8e73396fe0043620c49b629d7d331a82c120a9e14c1e608121fc9937e229cc90b912b74c44562a5bd6c041cb1fd8f42da04e699d6d7e14d8c5646ad02ac438f938fc1654c3937f9fe87077c892e67890845ed0a4fa73cba6c0ebe225615b3fedea7f7d2c7a482c45662951099e3f58cf763f275e5187c43da4d505328e9d7c9f850fb2fdb8a88718707881d34420431f63fd99ee79243545fbe4f2751b04515ac1e1f6f5ba42f733189a43597d8eff13541a07eea13a617111e6e958046b39310a2dc23042d6299952e413f1f359c44f254c15bd5098845877d460d8fd7aff7cfba45505e50be6ea755b388ab5b04961615201f6c3f6d52e0be6b7339fa60b9c997f3a414b06b1cf31e22c119aae3a7338d39b97df3f50eab09c1af7086577a5c4931e27f1e5ef572a0a6db41b2219c81734203c53e830427cc2d2bc3537b4b8985adfb763fb02c383f068f217091aa499b609e93d4aff4620cf7d7ceba663a8192799907253f46806e5720c85246abc1959c33beb47aeac401c286ec3126dde6eb5ec93843d6d2268cdc8cba862bbf8ad841c057859fee9d5493a73e8fea959591a59cfbf607beb177674b747805dec3cfe100b604ef278225643b7ac3b398ac4ad001a0de38e9babb1e0bd42dcf885b46b0033ee2543c16a48930775715ed2b44b2a184e28a660e6b2a3af73ba0dbc65b13f4153b3ab1c092fb2d4e645975b09b98900913a5400092371ec2ab963f2383b5fc5cc0f3450f8b7501d9e92402954cfae2dc2927da83068f6712b2f7b67df923277da49af65e6e23bd80f12c28bb7b309533da27699c745673408915534e84fad951e0fc53f7a4733181d1ae8a818d226e9ed746bc3e1826cfab0062925c9c309e6afd3d415659f1c543651b424cfd1a6079116a3846d82e74846b83f0d2dd7535a1199163387d29df28fe05cf3f5c3d8e098f7f9e7594d12cc59618f2db729be53438b073cd6fa9cd612866d476cb92b8b548d9358a17360e2f7040bafcaec0b51a2d1203271b0e36f5bbf7c7d946769b9dc763db43aec1cd828b991c1cf4e3aa33d836ea245d927beb4c515ce9e5ba7f9834be6c3b74d882f62e658eb7610a72a3af2ac66e6f37c765864ea6e20fa6ba19bf6a887350ba8437762e266766a8cffc546ebf57c9140f3ec2aac770b34981883c13325c01e6df088587424deb9aacc4a12d0817f7e7907da142eefb42290f99bcfdff622a659cec6578e217cb36a05283e5f1b60fc7a756028abedb8e7ebfacb9e2aff20d35437764f1acc58ef0dfaf0c15920473f3e1d7ffa71d8680d8fb656135c9a23efc5b4fba985f6aafeac162b983e1ab6d6cafd72bd09a95451b931a637f40d21480621fa7d4387a12ff516d30339d474cae223f564e37964b77f908f0ff489ff397c8cd216b82902b16de112db5f13fe746004d6d112eadc281dfa04b86e8518ba906f3f11b152cdaf67084875c4091afb04356a9b701c99762bb50ec88d5717c7b1bf5350e99fda202e5ac7dfb813d0c8131eb5d53596b2a083db276ca6d2a71f41b4aef9e711294b75ebcb2fde3d5473f254351fb47edd67b93b079e13daa5f16aa4c03e06662a14e85d08d020d7ad72c4f8610781e3f02be02c97a6e68f83566ea6a5db8f8a7feb5fc6437b0310e25bab634a39dbd28062434b9c675b2065ae7347afd52f592715a2adc61b53d6e15708e2cfe4529dc9d0e79a8b965c209d23d17a039be2d26c5d3768047b4d59ad3d9d3d73afa212584837862d7688a6565c1228db35721051b811902aa5437b5c9c2b0c6d2f0aadeddb9106d80cc2b9601041b96666feca139a7b61850cf4457fb590a2f5ac591d0cf83abc95dcce667d7addfb39764b3a08a5c8cd862efafe08fb370c7ecfce7e0743da0ad10494f200eca03bd7469704e4ed44c05f960eecabcfdef67ac4c8866cd044f937b2f3958adda2543a8e0b2a8f8592f32eb404facd2168c308abad266096b68454b15755e256b63c5a436ef74d7d2aa673839c6321c44a5ad151529bbf1704e28777a0c42e4f4c33bcbe5db98b2a2f8d5d6de8db9fdeb64e5bddc4e47cb80e3e7da511757d3a26ce3a5d05cf5133d510d8eab1bc1c179832a3af899bba585803072f7b6e2d0274138c8e7bfb02664228488696cfe5957a92234c0ddb1ee06e67a4873f666b215127b6f225b4ac9af2bc9e172679902a0db377700f531bcdcc22987a1a168e86d68b203934fb4d010f0dbfcfb043305f9dd2601cefb0f1873557dd7bb8fa3884870a2236f9d12f7424ede53117926660f1770ce930732c02e84879ce1b27a63b3e1d072c169535d4d98c6efcbc0d908f120df0aaaaa4a1ba3aa0bcbc0c1cc17ee1bb13f14a87478ff17d640cc5281ef5746b118fd92097d05852131a5543826379f854b9627be63403d01266b5f53721a38253703d3a204465362c70478ecc0a83768c6144eff86515160e9e7cbfe8413287d6bb40f6fa32606db7bf7a35138abe3e0d323a0987191e9b7e0a3f5dcad866be4d6860fb5d45b1df8fa3a6fb7e59dc296852a635f0c08e3483f85e20bd7304200b088fee8494347d52fb37c49c61a5114f5a437cb15336d09de6d4c7532bc34a3ac24c8d4385883c83477507a043887907d32d4068031860fc20f614976391f4392ce4e7acc07afdf9a8ea78a2a81a57de0bb4430ea8646e546e139bdc36de33ca614a228e70906f683d6239876e8b4c833be5b3496988c1cfb6bb1418f98a5f8be26f51ca2199c282f8ffc514bf314cb1a994be0edb91b7e8210601126159f3bd1c3fcf4c2b2d3b8205fb40d2da75de115e9bccc0b33793eb316b15b034cd8b213987a585afe96ac866f45e169e7d8dca44b28d7324d9d3f053229cfa5ee58f8f60cef9208bfca5131fcf6ead160c237daa21eb258dd30f4c787f46da35a737072d3723edfeff0bd9956ddb5be3423e7d11d7e12259a40d6704b853dc359348c0d8f5fdd409563dff185401cac83f50d9b6bd4ef485add0c31a175b9c1ad6abc615ae4b21d66bbde73b876235e88b47e75ee090819e7c191420217ba2b05c91c7ed5fcf11dbcafde86e84a122b3c1fe6dfe5c97239d7d4f3e198193992541eb6873ebd63b7fc0663c87b1f399a003ad9685b39ec6ee0e7ff3998a662505363d35e11dc0c1f6240a850449ac3c517e611fd3b275a326b89c373f128ccfe4e76688bc033c87fa53f450f74d2d9391f0e17d6cc0cf34772c4e768d8e12548b098f1da3654a5ecb77ecee4697a5ff73573948f2dcb42e245b0e0cc914078f50995f94bbe5422f8bc3008094064b505dab34994b1c2f8803150ea95654561c8e6a19fabe07d11383c65ccde23acbde9a73a17bfbe17d16f3a5d5483f761ed930878cb839b11b94a6653d746a1696b578433efe6d4b9e0caf0beeb5455c45d63a099650774d6524b61ccf144be4bedd48c1abeb0a6a102247ab68e3bc36d7cde5fefcc1b98c9f1dacda0197b42021d6219e49be96b453d953e0bd87339b48572b953cda7a6c605f40ec0827de112d0e3f5d1449ea252c6925647878999f25e31b8448c269f540e5339521da9a7899fa5a316aa16d6f4da510bb22aa0b0c66261ef17bc3edbe8af0cd39af467552a3d185d7ba39b1627326ef835f0ef447aa065866145687c129df5c60de130809e6e2052faabe2f88a5f5671faf31eba9b6801ee9cd6d21f0a2df726dde749eb56af49a1c355eac4b7af6ec56b7aff07e3429c329030249f402081299b9f518ae2335e5530536da25d7a868b6b2b5", 0x1000, 0x8040, &(0x7f0000000240)={0x11, 0xf8, r1, 0x1, 0x4d, 0x6, @local}, 0x14) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000000180)={0x0, 0xe1, '\b\x00*', 0x9, 0x9}) sendto$packet(0xffffffffffffffff, &(0x7f0000000080)="a5b32431b3", 0x5, 0x40, &(0x7f0000000140)={0x11, 0x18, r0}, 0x14) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000280)={'syztnl1\x00', r0, 0x10, 0x40, 0x9, 0x7, {{0x5, 0x4, 0x0, 0x17, 0x14, 0x64, 0x0, 0xfc, 0x29, 0x0, @local, @local}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x17, 0x0, 0x4, 0x5, 0x132, 0xffffffffffffffff, 0x9ee, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x4}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000001340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001380)=0x14) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) (async) sendto$packet(0xffffffffffffffff, &(0x7f0000000340)="8d5e536331ffd3f7f98d2ff83caef19454d8d230e4da56a403e65e1b22a8c24cd891b938d244aa3ae3b71fe3b8cdb41ef99389c1c7f0ced6ddb504f32052703f6b7fca005a5bef8c7826cc3bb1dd5495000b838167f688a7deab81fb23c4fd15da616c0c9703439134e1c3cc5574e638f7ccfcf600fd6306213bc8da84360eb387e2c068b121cbf1da1008624270bce5894807c753ef2b30012de909b5951aba3d50d878a835348dfee85d427d93625a8aaf801e444dc0143b7e9b9f0f84e297505c95816d484859ceac5a1c59e15e1e8f4767b7c92b115e6273e4c22bb9246d971d36b26d5ebc98570ae8b6da3085e600a1769c0c3d81fd17ca004d3910483decc81ece6b6d4c11cee005dee5c596c34c6e1d274273763218efb229b29ef2fe96303df2723322ae1d4834d570ee0157e24029963e5dd1d806af7c527913cc491a8dbf1d2539268da45301e869a2bbc58958ec98b4dfe7b4092b20a7a7c31828351b51370ce8847a38fc803b81c03277703b8792de8b629792b4ff1a78cce421fe154f8470176311a46a34b6fad320cb6680c99d0b45f0e34cbdebf9b8fd7fc3e8e09e8c605a7288f91f4b2d97b90a6daa7a55fe497b3e10c53e4bae565f5e1f44939b599894edc6c343f4ef4d74599f40612c323a2ced6c363d526db4580c20c57d8b1b66f780aab4b3771594d28f0c5dd0887063804811e1d1e3ee90bad077fa29a442ac927cd13453f72089b347c88365cd70bfbe4afe489fa757a97a628cca95cf2cc28254fd4a344389ccb2a7f328e0ba42a3a1ba5117b5f2790fa4dd5e22cf8132be49ff56bbed7f61808c73f8f4208072b82ed857f9e43f55ea45074823ddbc1e9887d6e04139245d5598576d00084c3612638c88619717a3e4440d0b092a7359d789c5454fb297b8e82debddb488d617743eed40c7a95e55086a138c4a308123f9fbd2690a18f99cd60c937fcf6b610583e90151347a1b6ef194cfe4cf1686ed028c0d72f2880aa1233d9755ec41899c57fb9b0e028c1d79265b27e18100c9dd54061ec77c3ea094de703e9569cc44de0a922782d89ebd2cabae8ccc5c354830a6980e46f93f136182f2145a267b47e88f6ca7b750d0f206a56b4a982418e73bb8081819aba2bc00380799f2d3314d9957d4e1b6712ef76f43f1203f105f9228a05f39125c006bccaa958add00986b8e7040461620bb3bb872c8ca5fc013eeecdf053fa737fec2251a800854b74004fe920fbaeed0f463d6fb4896ed9e3efabe693511aad0966d8891e59bef4b32c1b1b6a861cbf4cb0511cbb476066b73a5fb509bcc9194c892c8f8c42f9de437c93502e1b0dc952bc0a05fee34c89b20a36eee08633a4db5b69d2f240c402056a9657864249f26f2a2836d085f966b3bc5fab3ba0d40793742184d47268d614a9ed52345ea6b85683758925d3426760759a4397d1a20a223cb54e6b51c3746b23392ace4a9d38545ee6ac0e01259edc2d4df7d7c326afb44c0407afe0a8bf9504a2267a5744e56fe10705845285e6f5f4cb390d87f956ae8448b41d2fd7d0f98d0f6a9e9701be43feffc877a0d8506a4da1821ec117b6917dbc46bba904ec58e84aeab2a048846de556ba07d0cd3e9876cc780e60c0523137d2f89a23bbfcd58809d5f24862960c30f7d2c6e43bdbecd6580fab5ff1cb9742d869e3eac6b26ece55e2a29f2c576d41d7c0dff0c527aa15561bdd9c1f115ba881539b65c35d0e757b6d17a90c5d164589ae13c2f156a93b080ef3da97352beaa8bb058e5131e41533a39a0fad4e9d78c4b8360d371bee36d97d1f6aef4837e040e6426dd0391d70ddc8e3ace4f9bbd92bde9b59aeb4ecd9f351fb9569b5c8fe712a75836fe9b775e2bdb188b34f719bde69ba2e08b8bc32e9f28866df18cf792eee196da912ab33e5746b75a57332715ef39ce9f59b358c9768eb7306a5af7a072ef9cd533004e8d6984c8a4614b5c1e802fb652b566acc93cb7c343af2a03df8e73396fe0043620c49b629d7d331a82c120a9e14c1e608121fc9937e229cc90b912b74c44562a5bd6c041cb1fd8f42da04e699d6d7e14d8c5646ad02ac438f938fc1654c3937f9fe87077c892e67890845ed0a4fa73cba6c0ebe225615b3fedea7f7d2c7a482c45662951099e3f58cf763f275e5187c43da4d505328e9d7c9f850fb2fdb8a88718707881d34420431f63fd99ee79243545fbe4f2751b04515ac1e1f6f5ba42f733189a43597d8eff13541a07eea13a617111e6e958046b39310a2dc23042d6299952e413f1f359c44f254c15bd5098845877d460d8fd7aff7cfba45505e50be6ea755b388ab5b04961615201f6c3f6d52e0be6b7339fa60b9c997f3a414b06b1cf31e22c119aae3a7338d39b97df3f50eab09c1af7086577a5c4931e27f1e5ef572a0a6db41b2219c81734203c53e830427cc2d2bc3537b4b8985adfb763fb02c383f068f217091aa499b609e93d4aff4620cf7d7ceba663a8192799907253f46806e5720c85246abc1959c33beb47aeac401c286ec3126dde6eb5ec93843d6d2268cdc8cba862bbf8ad841c057859fee9d5493a73e8fea959591a59cfbf607beb177674b747805dec3cfe100b604ef278225643b7ac3b398ac4ad001a0de38e9babb1e0bd42dcf885b46b0033ee2543c16a48930775715ed2b44b2a184e28a660e6b2a3af73ba0dbc65b13f4153b3ab1c092fb2d4e645975b09b98900913a5400092371ec2ab963f2383b5fc5cc0f3450f8b7501d9e92402954cfae2dc2927da83068f6712b2f7b67df923277da49af65e6e23bd80f12c28bb7b309533da27699c745673408915534e84fad951e0fc53f7a4733181d1ae8a818d226e9ed746bc3e1826cfab0062925c9c309e6afd3d415659f1c543651b424cfd1a6079116a3846d82e74846b83f0d2dd7535a1199163387d29df28fe05cf3f5c3d8e098f7f9e7594d12cc59618f2db729be53438b073cd6fa9cd612866d476cb92b8b548d9358a17360e2f7040bafcaec0b51a2d1203271b0e36f5bbf7c7d946769b9dc763db43aec1cd828b991c1cf4e3aa33d836ea245d927beb4c515ce9e5ba7f9834be6c3b74d882f62e658eb7610a72a3af2ac66e6f37c765864ea6e20fa6ba19bf6a887350ba8437762e266766a8cffc546ebf57c9140f3ec2aac770b34981883c13325c01e6df088587424deb9aacc4a12d0817f7e7907da142eefb42290f99bcfdff622a659cec6578e217cb36a05283e5f1b60fc7a756028abedb8e7ebfacb9e2aff20d35437764f1acc58ef0dfaf0c15920473f3e1d7ffa71d8680d8fb656135c9a23efc5b4fba985f6aafeac162b983e1ab6d6cafd72bd09a95451b931a637f40d21480621fa7d4387a12ff516d30339d474cae223f564e37964b77f908f0ff489ff397c8cd216b82902b16de112db5f13fe746004d6d112eadc281dfa04b86e8518ba906f3f11b152cdaf67084875c4091afb04356a9b701c99762bb50ec88d5717c7b1bf5350e99fda202e5ac7dfb813d0c8131eb5d53596b2a083db276ca6d2a71f41b4aef9e711294b75ebcb2fde3d5473f254351fb47edd67b93b079e13daa5f16aa4c03e06662a14e85d08d020d7ad72c4f8610781e3f02be02c97a6e68f83566ea6a5db8f8a7feb5fc6437b0310e25bab634a39dbd28062434b9c675b2065ae7347afd52f592715a2adc61b53d6e15708e2cfe4529dc9d0e79a8b965c209d23d17a039be2d26c5d3768047b4d59ad3d9d3d73afa212584837862d7688a6565c1228db35721051b811902aa5437b5c9c2b0c6d2f0aadeddb9106d80cc2b9601041b96666feca139a7b61850cf4457fb590a2f5ac591d0cf83abc95dcce667d7addfb39764b3a08a5c8cd862efafe08fb370c7ecfce7e0743da0ad10494f200eca03bd7469704e4ed44c05f960eecabcfdef67ac4c8866cd044f937b2f3958adda2543a8e0b2a8f8592f32eb404facd2168c308abad266096b68454b15755e256b63c5a436ef74d7d2aa673839c6321c44a5ad151529bbf1704e28777a0c42e4f4c33bcbe5db98b2a2f8d5d6de8db9fdeb64e5bddc4e47cb80e3e7da511757d3a26ce3a5d05cf5133d510d8eab1bc1c179832a3af899bba585803072f7b6e2d0274138c8e7bfb02664228488696cfe5957a92234c0ddb1ee06e67a4873f666b215127b6f225b4ac9af2bc9e172679902a0db377700f531bcdcc22987a1a168e86d68b203934fb4d010f0dbfcfb043305f9dd2601cefb0f1873557dd7bb8fa3884870a2236f9d12f7424ede53117926660f1770ce930732c02e84879ce1b27a63b3e1d072c169535d4d98c6efcbc0d908f120df0aaaaa4a1ba3aa0bcbc0c1cc17ee1bb13f14a87478ff17d640cc5281ef5746b118fd92097d05852131a5543826379f854b9627be63403d01266b5f53721a38253703d3a204465362c70478ecc0a83768c6144eff86515160e9e7cbfe8413287d6bb40f6fa32606db7bf7a35138abe3e0d323a0987191e9b7e0a3f5dcad866be4d6860fb5d45b1df8fa3a6fb7e59dc296852a635f0c08e3483f85e20bd7304200b088fee8494347d52fb37c49c61a5114f5a437cb15336d09de6d4c7532bc34a3ac24c8d4385883c83477507a043887907d32d4068031860fc20f614976391f4392ce4e7acc07afdf9a8ea78a2a81a57de0bb4430ea8646e546e139bdc36de33ca614a228e70906f683d6239876e8b4c833be5b3496988c1cfb6bb1418f98a5f8be26f51ca2199c282f8ffc514bf314cb1a994be0edb91b7e8210601126159f3bd1c3fcf4c2b2d3b8205fb40d2da75de115e9bccc0b33793eb316b15b034cd8b213987a585afe96ac866f45e169e7d8dca44b28d7324d9d3f053229cfa5ee58f8f60cef9208bfca5131fcf6ead160c237daa21eb258dd30f4c787f46da35a737072d3723edfeff0bd9956ddb5be3423e7d11d7e12259a40d6704b853dc359348c0d8f5fdd409563dff185401cac83f50d9b6bd4ef485add0c31a175b9c1ad6abc615ae4b21d66bbde73b876235e88b47e75ee090819e7c191420217ba2b05c91c7ed5fcf11dbcafde86e84a122b3c1fe6dfe5c97239d7d4f3e198193992541eb6873ebd63b7fc0663c87b1f399a003ad9685b39ec6ee0e7ff3998a662505363d35e11dc0c1f6240a850449ac3c517e611fd3b275a326b89c373f128ccfe4e76688bc033c87fa53f450f74d2d9391f0e17d6cc0cf34772c4e768d8e12548b098f1da3654a5ecb77ecee4697a5ff73573948f2dcb42e245b0e0cc914078f50995f94bbe5422f8bc3008094064b505dab34994b1c2f8803150ea95654561c8e6a19fabe07d11383c65ccde23acbde9a73a17bfbe17d16f3a5d5483f761ed930878cb839b11b94a6653d746a1696b578433efe6d4b9e0caf0beeb5455c45d63a099650774d6524b61ccf144be4bedd48c1abeb0a6a102247ab68e3bc36d7cde5fefcc1b98c9f1dacda0197b42021d6219e49be96b453d953e0bd87339b48572b953cda7a6c605f40ec0827de112d0e3f5d1449ea252c6925647878999f25e31b8448c269f540e5339521da9a7899fa5a316aa16d6f4da510bb22aa0b0c66261ef17bc3edbe8af0cd39af467552a3d185d7ba39b1627326ef835f0ef447aa065866145687c129df5c60de130809e6e2052faabe2f88a5f5671faf31eba9b6801ee9cd6d21f0a2df726dde749eb56af49a1c355eac4b7af6ec56b7aff07e3429c329030249f402081299b9f518ae2335e5530536da25d7a868b6b2b5", 0x1000, 0x8040, &(0x7f0000000240)={0x11, 0xf8, r1, 0x1, 0x4d, 0x6, @local}, 0x14) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000000180)={0x0, 0xe1, '\b\x00*', 0x9, 0x9}) (async) sendto$packet(0xffffffffffffffff, &(0x7f0000000080)="a5b32431b3", 0x5, 0x40, &(0x7f0000000140)={0x11, 0x18, r0}, 0x14) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000280)={'syztnl1\x00', r0, 0x10, 0x40, 0x9, 0x7, {{0x5, 0x4, 0x0, 0x17, 0x14, 0x64, 0x0, 0xfc, 0x29, 0x0, @local, @local}}}}) (async) 01:03:59 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000100)={r0, 0x5, 0x1}) 01:03:59 executing program 0: bpf$MAP_CREATE(0xb00000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f00000002c0)=0x6) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14) sendto$packet(0xffffffffffffffff, &(0x7f0000000140)="944099200a8932f372c553b5e013032b53491792aeaa9ce18671228bccbd3caf63f55dda5aeb1f2f80e88428d2b932194a9bacad3a732560769c540060519acfebd7eb49084b155d5b0f0d5ba9d860697ffbce76c27d6b20eaa7652ecfa542a4985d982082997d0d8f501ca1ed393643f6ff8b3e522aa124f93d83945e57b9381746d27bef2b7b2fb9516b72c336b7fdcfaa4e", 0x93, 0x48805, &(0x7f0000000280)={0x11, 0x15, r4, 0x1, 0x6, 0x6, @remote}, 0x14) 01:03:59 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x9, [0x1, 0xee7], 0x19}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f0000000080), 0x80) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@flushsa={0x54, 0x1c, 0x0, 0x70bd2c, 0x25dfdbfb, {0x32}, [@user_kmaddress={0x2c, 0x13, {@in6=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x2}}, @coaddr={0x14, 0xe, @in=@multicast2}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000004}, 0x1) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4040) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_RESET_LINK_STATS(r6, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4004004}, 0x20004000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x5, 0x7, 0xdea, 0x722, r2, 0x3ff, '\x00', r4, 0xffffffffffffffff, 0x2, 0x1, 0x2}, 0x48) 01:03:59 executing program 0: bpf$MAP_CREATE(0xc00000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:03:59 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x9, [0x1, 0xee7], 0x19}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x9, [0x1, 0xee7], 0x19}, 0x10) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getpgrp(0xffffffffffffffff) 01:03:59 executing program 3: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x800, 0x5, 0x0, 0x0}) socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) 01:03:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getpgrp(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) getpgrp(0xffffffffffffffff) (async) 01:03:59 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}}, 0x4000010) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x48815) 01:03:59 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f0000000080), 0x80) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@flushsa={0x54, 0x1c, 0x0, 0x70bd2c, 0x25dfdbfb, {0x32}, [@user_kmaddress={0x2c, 0x13, {@in6=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x2}}, @coaddr={0x14, 0xe, @in=@multicast2}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000004}, 0x1) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4040) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_RESET_LINK_STATS(r6, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4004004}, 0x20004000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x5, 0x7, 0xdea, 0x722, r2, 0x3ff, '\x00', r4, 0xffffffffffffffff, 0x2, 0x1, 0x2}, 0x48) 01:04:00 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000340)=""/221, &(0x7f0000000240)=0xdd) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) pipe2$watch_queue(&(0x7f0000000080), 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) recvfrom$packet(r3, &(0x7f00000001c0)=""/12, 0xf, 0x43, 0x0, 0xb4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r3, 0xc0245720, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$PPPIOCSMRU1(r4, 0x40047452, &(0x7f0000000200)=0x10001) 01:04:00 executing program 0: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x9, [0x1, 0xee7], 0x19}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) 01:04:00 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}}, 0x4000010) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async, rerun: 32) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x48815) (rerun: 32) 01:04:00 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000340)=""/221, &(0x7f0000000240)=0xdd) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) pipe2$watch_queue(&(0x7f0000000080), 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) recvfrom$packet(r3, &(0x7f00000001c0)=""/12, 0xf, 0x43, 0x0, 0xb4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r3, 0xc0245720, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$PPPIOCSMRU1(r4, 0x40047452, &(0x7f0000000200)=0x10001) socket$inet_udplite(0x2, 0x2, 0x88) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) getsockopt$inet_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000340)=""/221, &(0x7f0000000240)=0xdd) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) recvfrom$packet(r3, &(0x7f00000001c0)=""/12, 0xf, 0x43, 0x0, 0xb4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r3, 0xc0245720, &(0x7f0000000180)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$PPPIOCSMRU1(r4, 0x40047452, &(0x7f0000000200)=0x10001) (async) 01:04:00 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getpgrp(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) getpgrp(0xffffffffffffffff) (async) 01:04:00 executing program 0: bpf$MAP_CREATE(0xe00000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@flushsa={0x54, 0x1c, 0x0, 0x70bd2c, 0x25dfdbfb, {0x32}, [@user_kmaddress={0x2c, 0x13, {@in6=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x2}}, @coaddr={0x14, 0xe, @in=@multicast2}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000004}, 0x1) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@flushsa={0x54, 0x1c, 0x0, 0x70bd2c, 0x25dfdbfb, {0x32}, [@user_kmaddress={0x2c, 0x13, {@in6=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x2}}, @coaddr={0x14, 0xe, @in=@multicast2}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000004}, 0x1) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4040) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_RESET_LINK_STATS(r6, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4004004}, 0x20004000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x5, 0x7, 0xdea, 0x722, r2, 0x3ff, '\x00', r4, 0xffffffffffffffff, 0x2, 0x1, 0x2}, 0x48) 01:04:00 executing program 2: r0 = syz_open_dev$sndmidi(&(0x7f0000000000), 0xf4e2, 0x200) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000001c0)={0x0, 0x1, 0xff, 0x0, 0x11}) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14, 0x0) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000180)) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:00 executing program 0: bpf$MAP_CREATE(0xf00000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 1: accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x80000) 01:04:00 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}}, 0x4000010) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x48815) 01:04:00 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000340)=""/221, &(0x7f0000000240)=0xdd) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) pipe2$watch_queue(&(0x7f0000000080), 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) recvfrom$packet(r3, &(0x7f00000001c0)=""/12, 0xf, 0x43, 0x0, 0xb4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r3, 0xc0245720, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$PPPIOCSMRU1(r4, 0x40047452, &(0x7f0000000200)=0x10001) socket$inet_udplite(0x2, 0x2, 0x88) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) getsockopt$inet_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000340)=""/221, &(0x7f0000000240)=0xdd) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) recvfrom$packet(r3, &(0x7f00000001c0)=""/12, 0xf, 0x43, 0x0, 0xb4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r3, 0xc0245720, &(0x7f0000000180)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$PPPIOCSMRU1(r4, 0x40047452, &(0x7f0000000200)=0x10001) (async) 01:04:00 executing program 2: r0 = syz_open_dev$sndmidi(&(0x7f0000000000), 0xf4e2, 0x200) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000001c0)={0x0, 0x1, 0xff, 0x0, 0x11}) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000001c0)={0x0, 0x1, 0xff, 0x0, 0x11}) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14, 0x0) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000180)) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:00 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x7800, 0x20, 0xfa, 0x8000, {{0x44, 0x4, 0x0, 0x3d, 0x110, 0x68, 0x0, 0x20, 0x29, 0x0, @broadcast, @broadcast, {[@timestamp_addr={0x44, 0x54, 0x32, 0x1, 0x1, [{@loopback, 0x20}, {@dev={0xac, 0x14, 0x14, 0x27}, 0x3933dc5c}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}, {@loopback, 0x91d}, {@remote, 0x1000}, {@rand_addr=0x64010101, 0x7}, {@multicast1, 0xff}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x7}, {@multicast2}, {@local, 0x1}]}, @timestamp_prespec={0x44, 0x3c, 0x18, 0x3, 0x8, [{@local, 0x3}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x3f}, {@remote, 0x3}, {@local, 0x7ff}, {@empty, 0x80000000}, {@broadcast, 0xb0e}, {@remote, 0x80000000}]}, @lsrr={0x83, 0x13, 0xc, [@loopback, @dev={0xac, 0x14, 0x14, 0x12}, @multicast1, @rand_addr=0x64010100]}, @rr={0x7, 0x17, 0xa8, [@dev={0xac, 0x14, 0x14, 0x3d}, @multicast1, @dev={0xac, 0x14, 0x14, 0x32}, @multicast1, @dev={0xac, 0x14, 0x14, 0x3f}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x2c, 0xfa, 0x1, 0x3, [{@broadcast, 0xffffffe7}, {@multicast1, 0xfffffff8}, {@remote, 0x1}, {@private=0xa010100, 0x8}, {@multicast2, 0x81}]}, @generic={0x88, 0x12, "1ae49b854957195f6216012f4ae22c14"}]}}}}}) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x29, 0x5, 0x40, 0x9, 0x0, @dev={0xfe, 0x80, '\x00', 0x23}, @remote, 0x8ec1, 0x8067, 0x1, 0x7f0d}}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000140)={r1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 01:04:00 executing program 0: bpf$MAP_CREATE(0x1000000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 1: accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x80000) 01:04:00 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x8) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000180)={0x6, 0x4, 0x6, 0x0, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x10001, 0x536, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:00 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @ipv4=@igmp={{0x18, 0x4, 0x2, 0x4, 0xd3, 0x66, 0x0, 0x40, 0x2, 0x0, @rand_addr=0x64010100, @rand_addr=0x64010101, {[@rr={0x7, 0xf, 0x72, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast1, @loopback]}, @end, @cipso={0x86, 0x27, 0x0, [{0x5, 0xd, "274f84ebe019f410000000"}, {0x7, 0x5, "ff3d23"}, {0x2, 0x5, "c6fafd"}, {0x6, 0xa, "5274e808eb1f4d79"}]}, @noop, @generic={0x89, 0x12, "688ee6285d910cfcb63b7d71b0996323"}]}}, {0x12, 0x6, 0x0, @multicast1, "f0adcede36c1ced68a35b33ba3a80c70b123192614d8af962a9f707e5e2430b9795a28b8eb46432a981ac2adc7d9486a21c37938861ab9a1c944e6f37c1c07fb8d080f2e1b7fe53655fcf226eb3c70915b4d643df54839705708e23449414e747c6ce837061469d1bd6e25"}}}, 0xd3) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8000800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:00 executing program 0: bpf$MAP_CREATE(0x1100000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x8) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async, rerun: 64) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (rerun: 64) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000180)={0x6, 0x4, 0x6, 0x0, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x10001, 0x536, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:00 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x7800, 0x20, 0xfa, 0x8000, {{0x44, 0x4, 0x0, 0x3d, 0x110, 0x68, 0x0, 0x20, 0x29, 0x0, @broadcast, @broadcast, {[@timestamp_addr={0x44, 0x54, 0x32, 0x1, 0x1, [{@loopback, 0x20}, {@dev={0xac, 0x14, 0x14, 0x27}, 0x3933dc5c}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}, {@loopback, 0x91d}, {@remote, 0x1000}, {@rand_addr=0x64010101, 0x7}, {@multicast1, 0xff}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x7}, {@multicast2}, {@local, 0x1}]}, @timestamp_prespec={0x44, 0x3c, 0x18, 0x3, 0x8, [{@local, 0x3}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x3f}, {@remote, 0x3}, {@local, 0x7ff}, {@empty, 0x80000000}, {@broadcast, 0xb0e}, {@remote, 0x80000000}]}, @lsrr={0x83, 0x13, 0xc, [@loopback, @dev={0xac, 0x14, 0x14, 0x12}, @multicast1, @rand_addr=0x64010100]}, @rr={0x7, 0x17, 0xa8, [@dev={0xac, 0x14, 0x14, 0x3d}, @multicast1, @dev={0xac, 0x14, 0x14, 0x32}, @multicast1, @dev={0xac, 0x14, 0x14, 0x3f}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x2c, 0xfa, 0x1, 0x3, [{@broadcast, 0xffffffe7}, {@multicast1, 0xfffffff8}, {@remote, 0x1}, {@private=0xa010100, 0x8}, {@multicast2, 0x81}]}, @generic={0x88, 0x12, "1ae49b854957195f6216012f4ae22c14"}]}}}}}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x29, 0x5, 0x40, 0x9, 0x0, @dev={0xfe, 0x80, '\x00', 0x23}, @remote, 0x8ec1, 0x8067, 0x1, 0x7f0d}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x29, 0x5, 0x40, 0x9, 0x0, @dev={0xfe, 0x80, '\x00', 0x23}, @remote, 0x8ec1, 0x8067, 0x1, 0x7f0d}}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000140)={r1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 01:04:00 executing program 2: r0 = syz_open_dev$sndmidi(&(0x7f0000000000), 0xf4e2, 0x200) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000001c0)={0x0, 0x1, 0xff, 0x0, 0x11}) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14, 0x0) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000180)) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) syz_open_dev$sndmidi(&(0x7f0000000000), 0xf4e2, 0x200) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000001c0)={0x0, 0x1, 0xff, 0x0, 0x11}) (async) accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14, 0x0) (async) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000180)) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000040)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) 01:04:00 executing program 0: bpf$MAP_CREATE(0x1200000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 0: bpf$MAP_CREATE(0x1300000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @ipv4=@igmp={{0x18, 0x4, 0x2, 0x4, 0xd3, 0x66, 0x0, 0x40, 0x2, 0x0, @rand_addr=0x64010100, @rand_addr=0x64010101, {[@rr={0x7, 0xf, 0x72, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast1, @loopback]}, @end, @cipso={0x86, 0x27, 0x0, [{0x5, 0xd, "274f84ebe019f410000000"}, {0x7, 0x5, "ff3d23"}, {0x2, 0x5, "c6fafd"}, {0x6, 0xa, "5274e808eb1f4d79"}]}, @noop, @generic={0x89, 0x12, "688ee6285d910cfcb63b7d71b0996323"}]}}, {0x12, 0x6, 0x0, @multicast1, "f0adcede36c1ced68a35b33ba3a80c70b123192614d8af962a9f707e5e2430b9795a28b8eb46432a981ac2adc7d9486a21c37938861ab9a1c944e6f37c1c07fb8d080f2e1b7fe53655fcf226eb3c70915b4d643df54839705708e23449414e747c6ce837061469d1bd6e25"}}}, 0xd3) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8000800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:00 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x8) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async, rerun: 32) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000180)={0x6, 0x4, 0x6, 0x0, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x10001, 0x536, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:00 executing program 1: accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x60, 0x80000) 01:04:00 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x7800, 0x20, 0xfa, 0x8000, {{0x44, 0x4, 0x0, 0x3d, 0x110, 0x68, 0x0, 0x20, 0x29, 0x0, @broadcast, @broadcast, {[@timestamp_addr={0x44, 0x54, 0x32, 0x1, 0x1, [{@loopback, 0x20}, {@dev={0xac, 0x14, 0x14, 0x27}, 0x3933dc5c}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}, {@loopback, 0x91d}, {@remote, 0x1000}, {@rand_addr=0x64010101, 0x7}, {@multicast1, 0xff}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x7}, {@multicast2}, {@local, 0x1}]}, @timestamp_prespec={0x44, 0x3c, 0x18, 0x3, 0x8, [{@local, 0x3}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x3f}, {@remote, 0x3}, {@local, 0x7ff}, {@empty, 0x80000000}, {@broadcast, 0xb0e}, {@remote, 0x80000000}]}, @lsrr={0x83, 0x13, 0xc, [@loopback, @dev={0xac, 0x14, 0x14, 0x12}, @multicast1, @rand_addr=0x64010100]}, @rr={0x7, 0x17, 0xa8, [@dev={0xac, 0x14, 0x14, 0x3d}, @multicast1, @dev={0xac, 0x14, 0x14, 0x32}, @multicast1, @dev={0xac, 0x14, 0x14, 0x3f}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x2c, 0xfa, 0x1, 0x3, [{@broadcast, 0xffffffe7}, {@multicast1, 0xfffffff8}, {@remote, 0x1}, {@private=0xa010100, 0x8}, {@multicast2, 0x81}]}, @generic={0x88, 0x12, "1ae49b854957195f6216012f4ae22c14"}]}}}}}) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x29, 0x5, 0x40, 0x9, 0x0, @dev={0xfe, 0x80, '\x00', 0x23}, @remote, 0x8ec1, 0x8067, 0x1, 0x7f0d}}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000140)={r1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 01:04:00 executing program 0: bpf$MAP_CREATE(0x1400000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc, 0x4}, 0x48) 01:04:00 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @ipv4=@igmp={{0x18, 0x4, 0x2, 0x4, 0xd3, 0x66, 0x0, 0x40, 0x2, 0x0, @rand_addr=0x64010100, @rand_addr=0x64010101, {[@rr={0x7, 0xf, 0x72, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast1, @loopback]}, @end, @cipso={0x86, 0x27, 0x0, [{0x5, 0xd, "274f84ebe019f410000000"}, {0x7, 0x5, "ff3d23"}, {0x2, 0x5, "c6fafd"}, {0x6, 0xa, "5274e808eb1f4d79"}]}, @noop, @generic={0x89, 0x12, "688ee6285d910cfcb63b7d71b0996323"}]}}, {0x12, 0x6, 0x0, @multicast1, "f0adcede36c1ced68a35b33ba3a80c70b123192614d8af962a9f707e5e2430b9795a28b8eb46432a981ac2adc7d9486a21c37938861ab9a1c944e6f37c1c07fb8d080f2e1b7fe53655fcf226eb3c70915b4d643df54839705708e23449414e747c6ce837061469d1bd6e25"}}}, 0xd3) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8000800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:00 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xffff, 0x0, 0x9, 0xa04, 0xffffffffffffffff, 0x26aa, '\x00', 0x0, r0, 0x3, 0x1, 0x2, 0x7}, 0x48) 01:04:00 executing program 0: bpf$MAP_CREATE(0x1800000000000000, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:00 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x1624, 0x7, 0x400, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000200)}}, 0x18) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x3, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)={&(0x7f0000000180)='./file0\x00', 0x0, 0x18}, 0x10) 01:04:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc, 0x4}, 0x48) 01:04:00 executing program 3: syz_extract_tcp_res$synack(&(0x7f0000000140), 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1cfbaaf2, 0x0, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:00 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x1624, 0x7, 0x400, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000200)}}, 0x18) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x3, 0x7}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x3, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)={&(0x7f0000000180)='./file0\x00', 0x0, 0x18}, 0x10) 01:04:01 executing program 3: syz_extract_tcp_res$synack(&(0x7f0000000140), 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1cfbaaf2, 0x0, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xffff, 0x0, 0x9, 0xa04, 0xffffffffffffffff, 0x26aa, '\x00', 0x0, r0, 0x3, 0x1, 0x2, 0x7}, 0x48) 01:04:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc, 0x4}, 0x48) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x14, 0x4, 0x0, 0x5}, 0x48) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x1, 0x6, @remote}, 0x10) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000080)={{0x1, 0x3, 0x7, 0x2, 0x1ff}}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x7fff, 0xd4, 0x2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x1624, 0x7, 0x400, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000200)}}, 0x18) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x3, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)={&(0x7f0000000180)='./file0\x00', 0x0, 0x18}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x900) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x1624, 0x7, 0x400}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000200)}}, 0x18) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x3, 0x7}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)={r1}) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)={&(0x7f0000000180)='./file0\x00', 0x0, 0x18}, 0x10) (async) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x1, 0x6, @remote}, 0x10) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000080)={{0x1, 0x3, 0x7, 0x2, 0x1ff}}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x7fff, 0xd4, 0x2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x1, 0x6, @remote}, 0x10) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000080)={{0x1, 0x3, 0x7, 0x2, 0x1ff}}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x7fff, 0xd4, 0x2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='tasks\x00', 0x2, 0x0) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:01 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xffff, 0x0, 0x9, 0xa04, 0xffffffffffffffff, 0x26aa, '\x00', 0x0, r0, 0x3, 0x1, 0x2, 0x7}, 0x48) 01:04:01 executing program 3: syz_extract_tcp_res$synack(&(0x7f0000000140), 0x1, 0x0) (async, rerun: 64) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1cfbaaf2, 0x0, 0x9}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x1, 0x6, @remote}, 0x10) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000080)={{0x1, 0x3, 0x7, 0x2, 0x1ff}}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x7fff, 0xd4, 0x2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x2, 0x5}, 0x48) 01:04:01 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) 01:04:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='tasks\x00', 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='tasks\x00', 0x2, 0x0) (async) 01:04:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x3, 0x5}, 0x48) 01:04:01 executing program 1: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) sched_rr_get_interval(r0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:01 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, r0}, 0x48) (async) 01:04:01 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x11, &(0x7f0000000080)=0x101, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) getsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)=""/172, &(0x7f0000000200)=0xac) 01:04:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='tasks\x00', 0x2, 0x0) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x4, 0x5}, 0x48) 01:04:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:01 executing program 1: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) sched_rr_get_interval(r0, &(0x7f0000000000)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:01 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x11, &(0x7f0000000080)=0x101, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) getsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)=""/172, &(0x7f0000000200)=0xac) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x11, &(0x7f0000000080)=0x101, 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) getsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)=""/172, &(0x7f0000000200)=0xac) (async) 01:04:01 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x29, 0x7f, 0x2, 0x0, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x8, 0x0, 0x3}}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000140)=r0) 01:04:01 executing program 2: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'ip6gre0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x4, 0x5, 0x2, 0x1, 0x1, @remote, @rand_addr=' \x01\x00', 0x1, 0x7, 0x3, 0x7}}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x90800000, 0x7d, 0x1000, r0, 0x83, '\x00', r1, r2, 0x1, 0x4, 0x1, 0x9}, 0x48) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x5, 0x5}, 0x48) 01:04:01 executing program 1: getpgrp(0x0) (async) r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) sched_rr_get_interval(r0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:01 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x29, 0x7f, 0x2, 0x0, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x8, 0x0, 0x3}}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000140)=r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x29, 0x7f, 0x2, 0x0, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x8, 0x0, 0x3}}) (async) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000140)=r0) (async) 01:04:01 executing program 2: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'ip6gre0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x4, 0x5, 0x2, 0x1, 0x1, @remote, @rand_addr=' \x01\x00', 0x1, 0x7, 0x3, 0x7}}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x90800000, 0x7d, 0x1000, r0, 0x83, '\x00', r1, r2, 0x1, 0x4, 0x1, 0x9}, 0x48) 01:04:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:01 executing program 1: socketpair(0x1e, 0x4, 0x4, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r2, 0x0, 0x1, 0x3f, 0x1f, 0xc0, @mcast1, @mcast1, 0x1, 0x40, 0x0, 0xff}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:01 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x11, &(0x7f0000000080)=0x101, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) getsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)=""/172, &(0x7f0000000200)=0xac) (async) getsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)=""/172, &(0x7f0000000200)=0xac) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x6, 0x5}, 0x48) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x2, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x10) 01:04:01 executing program 1: socketpair(0x1e, 0x4, 0x4, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r2, 0x0, 0x1, 0x3f, 0x1f, 0xc0, @mcast1, @mcast1, 0x1, 0x40, 0x0, 0xff}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:01 executing program 2: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'ip6gre0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x4, 0x5, 0x2, 0x1, 0x1, @remote, @rand_addr=' \x01\x00', 0x1, 0x7, 0x3, 0x7}}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x90800000, 0x7d, 0x1000, r0, 0x83, '\x00', r1, r2, 0x1, 0x4, 0x1, 0x9}, 0x48) 01:04:01 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x29, 0x7f, 0x2, 0x0, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x8, 0x0, 0x3}}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000140)=r0) 01:04:01 executing program 1: socketpair(0x1e, 0x4, 0x4, &(0x7f0000000000)={0xffffffffffffffff}) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r2, 0x0, 0x1, 0x3f, 0x1f, 0xc0, @mcast1, @mcast1, 0x1, 0x40, 0x0, 0xff}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:01 executing program 3: sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x400c400) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = syz_open_pts(0xffffffffffffffff, 0x101100) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000080)={0x5, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x2, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x10) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x7, 0x5}, 0x48) 01:04:01 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1d, 0xc, 0x8001, 0x1000, 0xa0, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x2}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c006400000604aa044522f02f9120850f98d21e6e90780a010100ffffffff4410180000000009000000030000001f94140000442505037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1c, 0x7, 0x1, 0x6060000, 0x6, r2, 0x6, '\x00', r4, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x8, 0x8000, 0xf46, 0x34, r0, 0x80000001, '\x00', r1, 0xffffffffffffffff, 0x5, 0x2, 0x3, 0xb}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:01 executing program 2: socketpair(0x22, 0x80000, 0x7, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000180)=""/255, 0xff}, {&(0x7f0000000280)=""/248, 0xf8}, {&(0x7f0000000380)=""/145, 0x91}], 0x3, &(0x7f0000000440)=""/209, 0xd1}, 0x40012020) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:01 executing program 3: sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x400c400) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = syz_open_pts(0xffffffffffffffff, 0x101100) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000080)={0x5, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x2, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x10) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) 01:04:01 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x700, 0x7, 0x1, 0x80, {{0xb, 0x4, 0x1, 0x1a, 0x2c, 0x64, 0x0, 0xac, 0x29, 0x0, @multicast1, @private=0xa010101, {[@rr={0x7, 0x17, 0xc5, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101, @rand_addr=0x64010101, @private=0xa010101, @empty]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000200)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', r0, 0x80, 0x700, 0x1f, 0x80, {{0x26, 0x4, 0x0, 0x25, 0x98, 0x68, 0x0, 0x40, 0x2f, 0x0, @broadcast, @multicast1, {[@lsrr={0x83, 0x13, 0x66, [@rand_addr=0x64010101, @multicast1, @private=0xa010101, @private=0xa010100]}, @end, @generic={0x88, 0x3, "eb"}, @end, @cipso={0x86, 0x2b, 0x3, [{0x7, 0xd, "dca79668b8b1f206b8328c"}, {0x5, 0x12, "14715cccdc634659ac8c1dccf75f54d6"}, {0x6, 0x2}, {0x2, 0x4, "e359"}]}, @noop, @generic={0x83, 0xc, "f72ec5219994a14b4cd2"}, @timestamp_prespec={0x44, 0x34, 0x5c, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0xa}, 0x100}, {@loopback, 0x975}, {@broadcast}, {@local, 0x4}, {@remote, 0x338}, {@multicast1, 0x800}]}]}}}}}) 01:04:01 executing program 2: socketpair(0x22, 0x80000, 0x7, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000180)=""/255, 0xff}, {&(0x7f0000000280)=""/248, 0xf8}, {&(0x7f0000000380)=""/145, 0x91}], 0x3, &(0x7f0000000440)=""/209, 0xd1}, 0x40012020) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socketpair(0x22, 0x80000, 0x7, &(0x7f0000000000)) (async) recvmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000180)=""/255, 0xff}, {&(0x7f0000000280)=""/248, 0xf8}, {&(0x7f0000000380)=""/145, 0x91}], 0x3, &(0x7f0000000440)=""/209, 0xd1}, 0x40012020) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) 01:04:01 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1d, 0xc, 0x8001, 0x1000, 0xa0, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x2}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c006400000604aa044522f02f9120850f98d21e6e90780a010100ffffffff4410180000000009000000030000001f94140000442505037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1c, 0x7, 0x1, 0x6060000, 0x6, r2, 0x6, '\x00', r4, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x8, 0x8000, 0xf46, 0x34, r0, 0x80000001, '\x00', r1, 0xffffffffffffffff, 0x5, 0x2, 0x3, 0xb}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x9, 0x5}, 0x48) 01:04:01 executing program 3: sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x400c400) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = syz_open_pts(0xffffffffffffffff, 0x101100) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000080)={0x5, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:01 executing program 2: socketpair(0x22, 0x80000, 0x7, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000180)=""/255, 0xff}, {&(0x7f0000000280)=""/248, 0xf8}, {&(0x7f0000000380)=""/145, 0x91}], 0x3, &(0x7f0000000440)=""/209, 0xd1}, 0x40012020) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000180)) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000200)={0x3e, 0x7ff, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x6ae, 0x60000000, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:01 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x700, 0x7, 0x1, 0x80, {{0xb, 0x4, 0x1, 0x1a, 0x2c, 0x64, 0x0, 0xac, 0x29, 0x0, @multicast1, @private=0xa010101, {[@rr={0x7, 0x17, 0xc5, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101, @rand_addr=0x64010101, @private=0xa010101, @empty]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000200)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', r0, 0x80, 0x700, 0x1f, 0x80, {{0x26, 0x4, 0x0, 0x25, 0x98, 0x68, 0x0, 0x40, 0x2f, 0x0, @broadcast, @multicast1, {[@lsrr={0x83, 0x13, 0x66, [@rand_addr=0x64010101, @multicast1, @private=0xa010101, @private=0xa010100]}, @end, @generic={0x88, 0x3, "eb"}, @end, @cipso={0x86, 0x2b, 0x3, [{0x7, 0xd, "dca79668b8b1f206b8328c"}, {0x5, 0x12, "14715cccdc634659ac8c1dccf75f54d6"}, {0x6, 0x2}, {0x2, 0x4, "e359"}]}, @noop, @generic={0x83, 0xc, "f72ec5219994a14b4cd2"}, @timestamp_prespec={0x44, 0x34, 0x5c, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0xa}, 0x100}, {@loopback, 0x975}, {@broadcast}, {@local, 0x4}, {@remote, 0x338}, {@multicast1, 0x800}]}]}}}}}) 01:04:01 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xa, 0x5}, 0x48) 01:04:02 executing program 2: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0xff, 0x2, 0x1}, 0x48) 01:04:02 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1d, 0xc, 0x8001, 0x1000, 0xa0, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x2}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c006400000604aa044522f02f9120850f98d21e6e90780a010100ffffffff4410180000000009000000030000001f94140000442505037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1c, 0x7, 0x1, 0x6060000, 0x6, r2, 0x6, '\x00', r4, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x8, 0x8000, 0xf46, 0x34, r0, 0x80000001, '\x00', r1, 0xffffffffffffffff, 0x5, 0x2, 0x3, 0xb}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:02 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x700, 0x7, 0x1, 0x80, {{0xb, 0x4, 0x1, 0x1a, 0x2c, 0x64, 0x0, 0xac, 0x29, 0x0, @multicast1, @private=0xa010101, {[@rr={0x7, 0x17, 0xc5, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101, @rand_addr=0x64010101, @private=0xa010101, @empty]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000200)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', r0, 0x80, 0x700, 0x1f, 0x80, {{0x26, 0x4, 0x0, 0x25, 0x98, 0x68, 0x0, 0x40, 0x2f, 0x0, @broadcast, @multicast1, {[@lsrr={0x83, 0x13, 0x66, [@rand_addr=0x64010101, @multicast1, @private=0xa010101, @private=0xa010100]}, @end, @generic={0x88, 0x3, "eb"}, @end, @cipso={0x86, 0x2b, 0x3, [{0x7, 0xd, "dca79668b8b1f206b8328c"}, {0x5, 0x12, "14715cccdc634659ac8c1dccf75f54d6"}, {0x6, 0x2}, {0x2, 0x4, "e359"}]}, @noop, @generic={0x83, 0xc, "f72ec5219994a14b4cd2"}, @timestamp_prespec={0x44, 0x34, 0x5c, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0xa}, 0x100}, {@loopback, 0x975}, {@broadcast}, {@local, 0x4}, {@remote, 0x338}, {@multicast1, 0x800}]}]}}}}}) 01:04:02 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000340)={0x7, 0x8000}) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) syz_open_dev$dri(&(0x7f0000000200), 0x6, 0x135880) syz_open_dev$dri(&(0x7f0000000240), 0x9, 0x84400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0xb, 0x4, 0x1, 0x0, 0x0}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x4, 0x1, 0x8, 0x8}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$sndmidi(&(0x7f0000000080), 0x101, 0x200002) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$TUNGETVNETLE(r3, 0x800454dd, &(0x7f00000002c0)) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000380)=0x2, 0x4) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000280)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000180)) (async) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000200)={0x3e, 0x7ff, 0x1}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x6ae, 0x60000000, 0x3, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xb, 0x5}, 0x48) 01:04:02 executing program 2: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0xff, 0x2, 0x1}, 0x48) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) (async) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0xff, 0x2, 0x1}, 0x48) (async) 01:04:02 executing program 4: syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bind$802154_raw(r0, &(0x7f0000000180)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0302}}}, 0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000040)) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x3f, 0x4c, 0x8000, 0x2, @loopback, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x20, 0x80000001, 0xfff}}) 01:04:02 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000180)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x19, 0x800, 0x7bbe, 0x3f, 0x410, r1, 0x0, '\x00', 0x0, r2, 0x1, 0x1}, 0x48) 01:04:02 executing program 4: syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bind$802154_raw(r0, &(0x7f0000000180)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0302}}}, 0x14) (async) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000040)) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x3f, 0x4c, 0x8000, 0x2, @loopback, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x20, 0x80000001, 0xfff}}) 01:04:02 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000180)) (async) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000180)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x19, 0x800, 0x7bbe, 0x3f, 0x410, r1, 0x0, '\x00', 0x0, r2, 0x1, 0x1}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x19, 0x800, 0x7bbe, 0x3f, 0x410, r1, 0x0, '\x00', 0x0, r2, 0x1, 0x1}, 0x48) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xc, 0x5}, 0x48) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000180)) (async) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000200)={0x3e, 0x7ff, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x6ae, 0x60000000, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:02 executing program 4: syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bind$802154_raw(r0, &(0x7f0000000180)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0302}}}, 0x14) (async) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000040)) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x3f, 0x4c, 0x8000, 0x2, @loopback, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x20, 0x80000001, 0xfff}}) 01:04:02 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000340)={0x7, 0x8000}) socket$rxrpc(0x21, 0x2, 0x2) (async) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) syz_open_dev$dri(&(0x7f0000000200), 0x6, 0x135880) syz_open_dev$dri(&(0x7f0000000240), 0x9, 0x84400) (async) syz_open_dev$dri(&(0x7f0000000240), 0x9, 0x84400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0xb, 0x4, 0x1, 0x0, 0x0}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x4, 0x1, 0x8, 0x8}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$sndmidi(&(0x7f0000000080), 0x101, 0x200002) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$TUNGETVNETLE(r3, 0x800454dd, &(0x7f00000002c0)) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000380)=0x2, 0x4) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000380)=0x2, 0x4) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000280)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xd, 0x5}, 0x48) 01:04:02 executing program 2: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0xff, 0x2, 0x1}, 0x48) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) (async) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0xff, 0x2, 0x1}, 0x48) (async) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0xa9d600000000000, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x0, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x0, 0x651773a1, 0x2, r3, 0xff, '\x00', 0x0, r2, 0x5, 0x3, 0x2, 0x8}, 0x48) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0xfffbf7ff, 0xfff, 0x1a80004}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000180)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x19, 0x800, 0x7bbe, 0x3f, 0x410, r1, 0x0, '\x00', 0x0, r2, 0x1, 0x1}, 0x48) 01:04:02 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x2, 0x0, 0x1, 0x48, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x7800, 0x7, 0x3, 0x3}}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x9, 0x8000, 0x100, r0, 0x0, '\x00', r1, r3, 0x4, 0x3, 0x2, 0x9}, 0xfff1) 01:04:02 executing program 3: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000340)={0x7, 0x8000}) (async) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000340)={0x7, 0x8000}) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) syz_open_dev$dri(&(0x7f0000000200), 0x6, 0x135880) (async) syz_open_dev$dri(&(0x7f0000000200), 0x6, 0x135880) syz_open_dev$dri(&(0x7f0000000240), 0x9, 0x84400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0xb, 0x4, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0xb, 0x4, 0x1, 0x0, 0x0}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x4, 0x1, 0x8, 0x8}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$sndmidi(&(0x7f0000000080), 0x101, 0x200002) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$TUNGETVNETLE(r3, 0x800454dd, &(0x7f00000002c0)) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000380)=0x2, 0x4) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000380)=0x2, 0x4) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000280)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xe, 0x5}, 0x48) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0xa9d600000000000, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x0, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x0, 0x651773a1, 0x2, r3, 0xff, '\x00', 0x0, r2, 0x5, 0x3, 0x2, 0x8}, 0x48) (async, rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0xfffbf7ff, 0xfff, 0x1a80004}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x2, 0x0, 0x1, 0x48, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x7800, 0x7, 0x3, 0x3}}) (async, rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x9, 0x8000, 0x100, r0, 0x0, '\x00', r1, r3, 0x4, 0x3, 0x2, 0x9}, 0xfff1) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xf, 0x5}, 0x48) 01:04:02 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x40000000}, 0x48) 01:04:02 executing program 2: socketpair(0x33, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r1, &(0x7f0000000040)=""/53, 0x35, 0x0, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @private=0xa010100}}, 0x24) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000440)={'gretap0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x469a2aa6be23362a, 0x8000, 0x4320, 0x894, {{0x37, 0x4, 0x0, 0x7, 0xdc, 0x68, 0x0, 0x8, 0x29, 0x0, @private=0xa010100, @rand_addr=0x64010102, {[@end, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x11, 0x3, [{0x5, 0xb, "79dcd95098f43a05c8"}]}, @generic={0x88, 0x9, "122781aceb1987"}, @timestamp={0x44, 0x28, 0x1e, 0x0, 0x1, [0x4, 0x2, 0x10000, 0x100, 0x409, 0x101, 0x9, 0x8, 0x1]}, @lsrr={0x83, 0x1b, 0x40, [@rand_addr=0x64010101, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2e}, @remote, @multicast1]}, @ssrr={0x89, 0xb, 0xcf, [@local, @remote]}, @generic={0x94, 0xd, "a5be392667dce661b9b08b"}, @timestamp={0x44, 0x10, 0xd9, 0x0, 0x2, [0x8, 0x4, 0x74e57744]}, @timestamp_addr={0x44, 0x3c, 0xbf, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@loopback, 0x9}, {@local, 0x191}, {@empty, 0x6}, {@multicast2, 0x1000}, {@empty, 0x5400}]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4d26, 0x4, 0x4, 0x40, 0xffffffffffffffff, 0x1, '\x00', r2, 0xffffffffffffffff, 0x5, 0x4, 0x1, 0xfffffffffffffffe}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) connect$rxrpc(r0, &(0x7f0000000240)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e22, @remote}}, 0x24) r4 = syz_open_dev$amidi(&(0x7f00000001c0), 0x1e8, 0x400) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r5, 0x80045700, &(0x7f0000000300)) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f00000002c0)=0x1) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={r3, 0x0, r4, 0x1, 0x80000}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r5, 0x54a3) 01:04:02 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x10, 0x5}, 0x48) 01:04:02 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x40000000}, 0x48) 01:04:02 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x2, 0x0, 0x1, 0x48, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x7800, 0x7, 0x3, 0x3}}) (async, rerun: 32) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x9, 0x8000, 0x100, r0, 0x0, '\x00', r1, r3, 0x4, 0x3, 0x2, 0x9}, 0xfff1) (rerun: 32) 01:04:02 executing program 2: socketpair(0x33, 0x2, 0x0, &(0x7f0000000000)) (async) socketpair(0x33, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r1, &(0x7f0000000040)=""/53, 0x35, 0x0, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @private=0xa010100}}, 0x24) (async) recvfrom$rxrpc(r1, &(0x7f0000000040)=""/53, 0x35, 0x0, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @private=0xa010100}}, 0x24) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000440)={'gretap0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x469a2aa6be23362a, 0x8000, 0x4320, 0x894, {{0x37, 0x4, 0x0, 0x7, 0xdc, 0x68, 0x0, 0x8, 0x29, 0x0, @private=0xa010100, @rand_addr=0x64010102, {[@end, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x11, 0x3, [{0x5, 0xb, "79dcd95098f43a05c8"}]}, @generic={0x88, 0x9, "122781aceb1987"}, @timestamp={0x44, 0x28, 0x1e, 0x0, 0x1, [0x4, 0x2, 0x10000, 0x100, 0x409, 0x101, 0x9, 0x8, 0x1]}, @lsrr={0x83, 0x1b, 0x40, [@rand_addr=0x64010101, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2e}, @remote, @multicast1]}, @ssrr={0x89, 0xb, 0xcf, [@local, @remote]}, @generic={0x94, 0xd, "a5be392667dce661b9b08b"}, @timestamp={0x44, 0x10, 0xd9, 0x0, 0x2, [0x8, 0x4, 0x74e57744]}, @timestamp_addr={0x44, 0x3c, 0xbf, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@loopback, 0x9}, {@local, 0x191}, {@empty, 0x6}, {@multicast2, 0x1000}, {@empty, 0x5400}]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4d26, 0x4, 0x4, 0x40, 0xffffffffffffffff, 0x1, '\x00', r2, 0xffffffffffffffff, 0x5, 0x4, 0x1, 0xfffffffffffffffe}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4d26, 0x4, 0x4, 0x40, 0xffffffffffffffff, 0x1, '\x00', r2, 0xffffffffffffffff, 0x5, 0x4, 0x1, 0xfffffffffffffffe}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) connect$rxrpc(r0, &(0x7f0000000240)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e22, @remote}}, 0x24) r4 = syz_open_dev$amidi(&(0x7f00000001c0), 0x1e8, 0x400) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r5, 0x80045700, &(0x7f0000000300)) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f00000002c0)=0x1) (async) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f00000002c0)=0x1) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={r3, 0x0, r4, 0x1, 0x80000}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r5, 0x54a3) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x11, 0x5}, 0x48) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0xa9d600000000000, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x0, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x6, 0x0, 0x651773a1, 0x2, r3, 0xff, '\x00', 0x0, r2, 0x5, 0x3, 0x2, 0x8}, 0x48) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0xfffbf7ff, 0xfff, 0x1a80004}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x40000000}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x40000000}, 0x48) (async) 01:04:02 executing program 2: socketpair(0x33, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r1, &(0x7f0000000040)=""/53, 0x35, 0x0, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @private=0xa010100}}, 0x24) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000440)={'gretap0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x469a2aa6be23362a, 0x8000, 0x4320, 0x894, {{0x37, 0x4, 0x0, 0x7, 0xdc, 0x68, 0x0, 0x8, 0x29, 0x0, @private=0xa010100, @rand_addr=0x64010102, {[@end, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x11, 0x3, [{0x5, 0xb, "79dcd95098f43a05c8"}]}, @generic={0x88, 0x9, "122781aceb1987"}, @timestamp={0x44, 0x28, 0x1e, 0x0, 0x1, [0x4, 0x2, 0x10000, 0x100, 0x409, 0x101, 0x9, 0x8, 0x1]}, @lsrr={0x83, 0x1b, 0x40, [@rand_addr=0x64010101, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2e}, @remote, @multicast1]}, @ssrr={0x89, 0xb, 0xcf, [@local, @remote]}, @generic={0x94, 0xd, "a5be392667dce661b9b08b"}, @timestamp={0x44, 0x10, 0xd9, 0x0, 0x2, [0x8, 0x4, 0x74e57744]}, @timestamp_addr={0x44, 0x3c, 0xbf, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@loopback, 0x9}, {@local, 0x191}, {@empty, 0x6}, {@multicast2, 0x1000}, {@empty, 0x5400}]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4d26, 0x4, 0x4, 0x40, 0xffffffffffffffff, 0x1, '\x00', r2, 0xffffffffffffffff, 0x5, 0x4, 0x1, 0xfffffffffffffffe}, 0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) (async, rerun: 32) connect$rxrpc(r0, &(0x7f0000000240)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e22, @remote}}, 0x24) (async, rerun: 32) r4 = syz_open_dev$amidi(&(0x7f00000001c0), 0x1e8, 0x400) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r5, 0x80045700, &(0x7f0000000300)) (async) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f00000002c0)=0x1) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={r3, 0x0, r4, 0x1, 0x80000}) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r5, 0x54a3) 01:04:02 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) sched_rr_get_interval(r0, &(0x7f0000000000)) 01:04:02 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x12, 0x5}, 0x48) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000180)=@req={0x0, 0x8, 0x0, 0x1}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x106, 0x2}}, 0x20) 01:04:02 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1b, 0x7, 0x0, 0x5538, 0x100, r0, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x9, 0xd, &(0x7f0000000000)=@raw=[@map_fd={0x18, 0xb, 0x1, 0x0, r1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, @cb_func={0x18, 0x6, 0x4, 0x0, 0xfffffffffffffff9}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x2}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x6}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x101}, @jmp={0x5, 0x1, 0x4, 0x6, 0x5, 0x100, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x74, &(0x7f0000000140)=""/116, 0x41000, 0x12, '\x00', 0x0, 0x23, r2, 0x8, &(0x7f0000000200)={0x1, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x0, 0x80000001, 0x6}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000300)=[r4]}, 0x80) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x400, 0x0) ioctl$TUNSETTXFILTER(r5, 0x400454d1, &(0x7f0000000400)={0x1, 0x8, [@random="b392e07ce3a2", @multicast, @broadcast, @empty, @multicast, @broadcast, @random="e8e38ba1b5eb", @random="6eef135342ff"]}) 01:04:02 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) (async) syz_open_procfs$namespace(r0, 0x0) sched_rr_get_interval(r0, &(0x7f0000000000)) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000180)=@req={0x0, 0x8, 0x0, 0x1}, 0x10) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x106, 0x2}}, 0x20) 01:04:02 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$PPPIOCGIDLE32(r0, 0x8008743f, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:02 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x2, 0x7fff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:02 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1b, 0x7, 0x0, 0x5538, 0x100, r0, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x9, 0xd, &(0x7f0000000000)=@raw=[@map_fd={0x18, 0xb, 0x1, 0x0, r1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, @cb_func={0x18, 0x6, 0x4, 0x0, 0xfffffffffffffff9}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x2}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x6}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x101}, @jmp={0x5, 0x1, 0x4, 0x6, 0x5, 0x100, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x74, &(0x7f0000000140)=""/116, 0x41000, 0x12, '\x00', 0x0, 0x23, r2, 0x8, &(0x7f0000000200)={0x1, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x0, 0x80000001, 0x6}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000300)=[r4]}, 0x80) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x400, 0x0) ioctl$TUNSETTXFILTER(r5, 0x400454d1, &(0x7f0000000400)={0x1, 0x8, [@random="b392e07ce3a2", @multicast, @broadcast, @empty, @multicast, @broadcast, @random="e8e38ba1b5eb", @random="6eef135342ff"]}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) pipe2$watch_queue(&(0x7f00000001c0), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1b, 0x7, 0x0, 0x5538, 0x100, r0, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x9, 0xd, &(0x7f0000000000)=@raw=[@map_fd={0x18, 0xb, 0x1, 0x0, r1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, @cb_func={0x18, 0x6, 0x4, 0x0, 0xfffffffffffffff9}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x2}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x6}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x101}, @jmp={0x5, 0x1, 0x4, 0x6, 0x5, 0x100, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x74, &(0x7f0000000140)=""/116, 0x41000, 0x12, '\x00', 0x0, 0x23, r2, 0x8, &(0x7f0000000200)={0x1, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x0, 0x80000001, 0x6}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000300)=[r4]}, 0x80) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x400, 0x0) (async) ioctl$TUNSETTXFILTER(r5, 0x400454d1, &(0x7f0000000400)={0x1, 0x8, [@random="b392e07ce3a2", @multicast, @broadcast, @empty, @multicast, @broadcast, @random="e8e38ba1b5eb", @random="6eef135342ff"]}) (async) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x13, 0x5}, 0x48) 01:04:02 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$PPPIOCGIDLE32(r0, 0x8008743f, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:02 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) sched_rr_get_interval(r0, &(0x7f0000000000)) 01:04:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000180)=@req={0x0, 0x8, 0x0, 0x1}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x106, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x106, 0x2}}, 0x20) 01:04:02 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x14, 0x5}, 0x48) 01:04:03 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async, rerun: 32) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 32) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1b, 0x7, 0x0, 0x5538, 0x100, r0, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x9, 0xd, &(0x7f0000000000)=@raw=[@map_fd={0x18, 0xb, 0x1, 0x0, r1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, @cb_func={0x18, 0x6, 0x4, 0x0, 0xfffffffffffffff9}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x2}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x6}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x101}, @jmp={0x5, 0x1, 0x4, 0x6, 0x5, 0x100, 0x1}], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x74, &(0x7f0000000140)=""/116, 0x41000, 0x12, '\x00', 0x0, 0x23, r2, 0x8, &(0x7f0000000200)={0x1, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x0, 0x80000001, 0x6}, 0x10, 0xffffffffffffffff, r3, 0x0, &(0x7f0000000300)=[r4]}, 0x80) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x400, 0x0) ioctl$TUNSETTXFILTER(r5, 0x400454d1, &(0x7f0000000400)={0x1, 0x8, [@random="b392e07ce3a2", @multicast, @broadcast, @empty, @multicast, @broadcast, @random="e8e38ba1b5eb", @random="6eef135342ff"]}) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x2, 0x7fff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x2, 0x7fff}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:03 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/151, 0x97}], 0x1, &(0x7f0000000040)}, 0x100) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_PW_TYPE={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000041}, 0x20004800) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x18, 0x5}, 0x48) 01:04:03 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$PPPIOCGIDLE32(r0, 0x8008743f, &(0x7f0000000000)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x2, 0x7fff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x2, 0x7fff}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:03 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async, rerun: 64) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/151, 0x97}], 0x1, &(0x7f0000000040)}, 0x100) (rerun: 64) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x300, 0x5}, 0x48) 01:04:03 executing program 3: getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x24, @short}, 0x14, &(0x7f00000001c0)={&(0x7f0000000140)="c0c3c41688c867dac34af7e316d28987afc4cb1cab3f9fe17541dc532ea63442f548224833afb00dff6205ec4c6cb1d623c1450d4918ca370522543cd93f85b703361f31e7fef0eb4f7b3cf130705ef60be85a051d", 0x55}, 0x1, 0x0, 0x0, 0x4001080}, 0x8000) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r4, 0x1, 0x6, @random="5f4d55a75b6a"}, 0x10) 01:04:03 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f0000000000)) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) (async, rerun: 32) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_PW_TYPE={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000041}, 0x20004800) (rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x17, 0x0, 0x0, 0x5}, 0x48) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f0000000000)) 01:04:03 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/151, 0x97}], 0x1, &(0x7f0000000040)}, 0x100) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/151, 0x97}], 0x1, &(0x7f0000000040)}, 0x100) (async) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x500, 0x5}, 0x48) 01:04:03 executing program 3: getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x24, @short}, 0x14, &(0x7f00000001c0)={&(0x7f0000000140)="c0c3c41688c867dac34af7e316d28987afc4cb1cab3f9fe17541dc532ea63442f548224833afb00dff6205ec4c6cb1d623c1450d4918ca370522543cd93f85b703361f31e7fef0eb4f7b3cf130705ef60be85a051d", 0x55}, 0x1, 0x0, 0x0, 0x4001080}, 0x8000) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r4, 0x1, 0x6, @random="5f4d55a75b6a"}, 0x10) 01:04:03 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f0000000000)) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_PW_TYPE={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000041}, 0x20004800) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x17, 0x0, 0x0, 0x5}, 0x48) (async, rerun: 32) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f0000000000)) (rerun: 32) 01:04:03 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x1000000, 0xd365, 0x9, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@initdev, @in=@local}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000040)=0xe8) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000100)={r0}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x600, 0x5}, 0x48) 01:04:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x17, 0x0, 0x0, 0x5}, 0x48) (async) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f0000000000)) 01:04:03 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x1000000, 0xd365, 0x9, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@initdev, @in=@local}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000040)=0xe8) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000100)={r0}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:03 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f0000000000)) 01:04:03 executing program 3: getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x24, @short}, 0x14, &(0x7f00000001c0)={&(0x7f0000000140)="c0c3c41688c867dac34af7e316d28987afc4cb1cab3f9fe17541dc532ea63442f548224833afb00dff6205ec4c6cb1d623c1450d4918ca370522543cd93f85b703361f31e7fef0eb4f7b3cf130705ef60be85a051d", 0x55}, 0x1, 0x0, 0x0, 0x4001080}, 0x8000) (async) sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x24, @short}, 0x14, &(0x7f00000001c0)={&(0x7f0000000140)="c0c3c41688c867dac34af7e316d28987afc4cb1cab3f9fe17541dc532ea63442f548224833afb00dff6205ec4c6cb1d623c1450d4918ca370522543cd93f85b703361f31e7fef0eb4f7b3cf130705ef60be85a051d", 0x55}, 0x1, 0x0, 0x0, 0x4001080}, 0x8000) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r4, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r4, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r4, 0x1, 0x6, @random="5f4d55a75b6a"}, 0x10) (async) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r4, 0x1, 0x6, @random="5f4d55a75b6a"}, 0x10) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x700, 0x5}, 0x48) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x101, 0x401}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept4$nfc_llcp(r2, 0x0, &(0x7f0000000140), 0x80000) 01:04:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x5, 0x408, 0x4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x9a27, 0x9e, 0x0, 0x8, 0x1, 0x331, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x31a, 0x2, 0x1, 0x411, r0, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5, 0x5}, 0x48) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x101, 0x401}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept4$nfc_llcp(r2, 0x0, &(0x7f0000000140), 0x80000) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x101, 0x401}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) accept4$nfc_llcp(r2, 0x0, &(0x7f0000000140), 0x80000) (async) 01:04:03 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x1000000, 0xd365, 0x9, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@initdev, @in=@local}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000040)=0xe8) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000100)={r0}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x900, 0x5}, 0x48) 01:04:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) 01:04:03 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x9a27, 0x9e, 0x0, 0x8, 0x1, 0x331, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x31a, 0x2, 0x1, 0x411, r0, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5, 0x5}, 0x48) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xa00, 0x5}, 0x48) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x5, 0x408, 0x4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 32) 01:04:03 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) getsockopt$inet_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000000)=""/2, &(0x7f0000000040)=0x2) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1, 0x101, 0x401}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) accept4$nfc_llcp(r2, 0x0, &(0x7f0000000140), 0x80000) 01:04:03 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x9a27, 0x9e, 0x0, 0x8, 0x1, 0x331, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x31a, 0x2, 0x1, 0x411, r0, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5, 0x5}, 0x48) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x5, 0x408, 0x4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x3) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xb00, 0x5}, 0x48) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000001c0)={r4}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)=r2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) getsockopt$inet_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000000)=""/2, &(0x7f0000000040)=0x2) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$PPPIOCGIDLE32(0xffffffffffffffff, 0x8008743f, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x40080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000200)={0x0, 0x3, r5, 0x10, 0x80000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000001c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000001c0)={r4}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)=r2) (async) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)=r2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 2: pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000380)=""/80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r1 = socket$inet6(0xa, 0x4, 0xfb) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x4, 0x6, 0x40, 0x5c3f, 0x1a, @dev={0xfe, 0x80, '\x00', 0x3b}, @private0, 0x8, 0x700, 0x4, 0x5}}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000004c0)={&(0x7f0000000480)='./file0\x00', 0x0, 0x18}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl2\x00', 0x0, 0x29, 0xff, 0xa1, 0x4, 0x0, @loopback, @dev={0xfe, 0x80, '\x00', 0x31}, 0x20, 0x10, 0x5, 0x102}}) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000180)=ANY=[@ANYBLOB="01000600ffffffffffff0d710ff3e0a5d2093eccb06496afb087d0788e1344bd3a3751c90070ff48aa2b3a300f43e421cf49d2e8b93197239b1e8222204aab72912de5e0276b23c75fdd67a5d963a9aaa47034c835b1bf5b3d4a6d71c7528b2e3891c31f0fc2bcdd21ded151f1710043f0ba7cbcd0c25066100399e9f8a94d87f481de47cbf9a56e35de50d1d49f40833975ed65b79427ad76cf3f8efcaebf2d79d433fa52af0788edd5cde4b35a68a90dd393ae23ec7a22ea1e9edf42e8eacb0af6d78033544048af4af6f38850972667713469dac6fc4054c9392ee7450f5cdd0d974544d09bc920a6a7db700ab24d1c13814c6759c1d004146ce939a947699616355842c36eb2583efcbadee426a14519f84e8c092050"]) socket$l2tp(0x2, 0x2, 0x73) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000440)=0x5) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x80044943, &(0x7f0000000400)) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) 01:04:03 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$PPPIOCGIDLE32(0xffffffffffffffff, 0x8008743f, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x40080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000200)={0x0, 0x3, r5, 0x10, 0x80000}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$PPPIOCGIDLE32(0xffffffffffffffff, 0x8008743f, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x40080) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000200)={0x0, 0x3, r5, 0x10, 0x80000}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) (async) 01:04:03 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xc00, 0x5}, 0x48) 01:04:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000001c0)={r4}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000080)=r2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:03 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3ff, 0x101, 0x2, 0x20, 0x1, 0x8, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x6}, 0x48) 01:04:03 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) getsockopt$inet_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000000)=""/2, &(0x7f0000000040)=0x2) 01:04:04 executing program 2: pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000380)=""/80) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r1 = socket$inet6(0xa, 0x4, 0xfb) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x4, 0x6, 0x40, 0x5c3f, 0x1a, @dev={0xfe, 0x80, '\x00', 0x3b}, @private0, 0x8, 0x700, 0x4, 0x5}}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000004c0)={&(0x7f0000000480)='./file0\x00', 0x0, 0x18}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl2\x00', 0x0, 0x29, 0xff, 0xa1, 0x4, 0x0, @loopback, @dev={0xfe, 0x80, '\x00', 0x31}, 0x20, 0x10, 0x5, 0x102}}) (async) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000180)=ANY=[@ANYBLOB="01000600ffffffffffff0d710ff3e0a5d2093eccb06496afb087d0788e1344bd3a3751c90070ff48aa2b3a300f43e421cf49d2e8b93197239b1e8222204aab72912de5e0276b23c75fdd67a5d963a9aaa47034c835b1bf5b3d4a6d71c7528b2e3891c31f0fc2bcdd21ded151f1710043f0ba7cbcd0c25066100399e9f8a94d87f481de47cbf9a56e35de50d1d49f40833975ed65b79427ad76cf3f8efcaebf2d79d433fa52af0788edd5cde4b35a68a90dd393ae23ec7a22ea1e9edf42e8eacb0af6d78033544048af4af6f38850972667713469dac6fc4054c9392ee7450f5cdd0d974544d09bc920a6a7db700ab24d1c13814c6759c1d004146ce939a947699616355842c36eb2583efcbadee426a14519f84e8c092050"]) socket$l2tp(0x2, 0x2, 0x73) (async) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000440)=0x5) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r3 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x80044943, &(0x7f0000000400)) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) 01:04:04 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3ff, 0x101, 0x2, 0x20, 0x1, 0x8, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x6}, 0x48) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xcc0, 0x800, 0x8005, 0x0, 0x0}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x3c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc040) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x7fff, 0x3, 0x80}) r5 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000740)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000780), 0x12) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x1, 0x59, 0x7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000080)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TUNGETDEVNETNS(r7, 0x54e3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r4, 0x40045730, &(0x7f0000000700)=0xffff8000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r8, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r8, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x401}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x40c1}, 0x16) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000340)={r2}) write$RDMA_USER_CM_CMD_JOIN_MCAST(r3, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {&(0x7f0000000200), 0x3, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @loopback}}}, 0xa0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r9, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r11, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r9, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, r11, 0x20, 0x70bd2d, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", ""]}, 0x28}}, 0x4) 01:04:04 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2, 0x5, 0x7f, 0x7, 0x2b, 0x0, 0x70bd29, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@private=0xa010100, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x36, 0x4, 0x4}, @sadb_lifetime={0x4, 0x1, 0x2, 0x8, 0x21e, 0x3}, @sadb_x_policy={0x8, 0x12, 0x2, 0x5, 0x0, 0x6e6bb6, 0x1, {0x6, 0x3c, 0x0, 0xcb, 0x0, 0x67f, 0x0, @in=@private=0xa010102, @in=@multicast2}}, @sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x0, 0x8, {0x6, 0x2b, 0x5, 0x4, 0x0, 0x1, 0x0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2}}, @sadb_sa={0x2, 0x1, 0x4d3, 0x0, 0x0, 0x67, 0x1, 0x20000000}, @sadb_ident={0x2, 0xb, 0x9, 0x0, 0x7dce0bcf}, @sadb_address={0x5, 0x5, 0x33, 0x20, 0x0, @in6={0xa, 0x4e21, 0x8, @remote, 0x9}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x3e}}]}, 0x158}}, 0x40c0) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$PPPIOCGIDLE32(0xffffffffffffffff, 0x8008743f, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x40080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000200)={0x0, 0x3, r5, 0x10, 0x80000}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xd00, 0x5}, 0x48) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x3, 0x505000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0xb9b7, 0x8, 0x1f}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xe00, 0x5}, 0x48) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xcc0, 0x800, 0x8005, 0x0, 0x0}) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x3c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc040) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x7fff, 0x3, 0x80}) (async) r5 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000740)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000780), 0x12) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x1, 0x59, 0x7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000080)={r2}) (async) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TUNGETDEVNETNS(r7, 0x54e3, 0x0) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r4, 0x40045730, &(0x7f0000000700)=0xffff8000) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r8, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r8, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x401}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x40c1}, 0x16) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000340)={r2}) write$RDMA_USER_CM_CMD_JOIN_MCAST(r3, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {&(0x7f0000000200), 0x3, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @loopback}}}, 0xa0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r9, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r11, 0x1}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r9, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, r11, 0x20, 0x70bd2d, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", ""]}, 0x28}}, 0x4) 01:04:04 executing program 2: pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000380)=""/80) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (rerun: 32) r1 = socket$inet6(0xa, 0x4, 0xfb) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x4, 0x6, 0x40, 0x5c3f, 0x1a, @dev={0xfe, 0x80, '\x00', 0x3b}, @private0, 0x8, 0x700, 0x4, 0x5}}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000004c0)={&(0x7f0000000480)='./file0\x00', 0x0, 0x18}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl2\x00', 0x0, 0x29, 0xff, 0xa1, 0x4, 0x0, @loopback, @dev={0xfe, 0x80, '\x00', 0x31}, 0x20, 0x10, 0x5, 0x102}}) (async, rerun: 64) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000180)=ANY=[@ANYBLOB="01000600ffffffffffff0d710ff3e0a5d2093eccb06496afb087d0788e1344bd3a3751c90070ff48aa2b3a300f43e421cf49d2e8b93197239b1e8222204aab72912de5e0276b23c75fdd67a5d963a9aaa47034c835b1bf5b3d4a6d71c7528b2e3891c31f0fc2bcdd21ded151f1710043f0ba7cbcd0c25066100399e9f8a94d87f481de47cbf9a56e35de50d1d49f40833975ed65b79427ad76cf3f8efcaebf2d79d433fa52af0788edd5cde4b35a68a90dd393ae23ec7a22ea1e9edf42e8eacb0af6d78033544048af4af6f38850972667713469dac6fc4054c9392ee7450f5cdd0d974544d09bc920a6a7db700ab24d1c13814c6759c1d004146ce939a947699616355842c36eb2583efcbadee426a14519f84e8c092050"]) (async, rerun: 64) socket$l2tp(0x2, 0x2, 0x73) (async) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000440)=0x5) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 32) r3 = socket$isdn_base(0x22, 0x3, 0x0) (rerun: 32) ioctl$IMGETCOUNT(r3, 0x80044943, &(0x7f0000000400)) (async) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) 01:04:04 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3ff, 0x101, 0x2, 0x20, 0x1, 0x8, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x6}, 0x48) 01:04:04 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2, 0x5, 0x7f, 0x7, 0x2b, 0x0, 0x70bd29, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@private=0xa010100, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x36, 0x4, 0x4}, @sadb_lifetime={0x4, 0x1, 0x2, 0x8, 0x21e, 0x3}, @sadb_x_policy={0x8, 0x12, 0x2, 0x5, 0x0, 0x6e6bb6, 0x1, {0x6, 0x3c, 0x0, 0xcb, 0x0, 0x67f, 0x0, @in=@private=0xa010102, @in=@multicast2}}, @sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x0, 0x8, {0x6, 0x2b, 0x5, 0x4, 0x0, 0x1, 0x0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2}}, @sadb_sa={0x2, 0x1, 0x4d3, 0x0, 0x0, 0x67, 0x1, 0x20000000}, @sadb_ident={0x2, 0xb, 0x9, 0x0, 0x7dce0bcf}, @sadb_address={0x5, 0x5, 0x33, 0x20, 0x0, @in6={0xa, 0x4e21, 0x8, @remote, 0x9}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x3e}}]}, 0x158}}, 0x40c0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2, 0x5, 0x7f, 0x7, 0x2b, 0x0, 0x70bd29, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@private=0xa010100, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x36, 0x4, 0x4}, @sadb_lifetime={0x4, 0x1, 0x2, 0x8, 0x21e, 0x3}, @sadb_x_policy={0x8, 0x12, 0x2, 0x5, 0x0, 0x6e6bb6, 0x1, {0x6, 0x3c, 0x0, 0xcb, 0x0, 0x67f, 0x0, @in=@private=0xa010102, @in=@multicast2}}, @sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x0, 0x8, {0x6, 0x2b, 0x5, 0x4, 0x0, 0x1, 0x0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2}}, @sadb_sa={0x2, 0x1, 0x4d3, 0x0, 0x0, 0x67, 0x1, 0x20000000}, @sadb_ident={0x2, 0xb, 0x9, 0x0, 0x7dce0bcf}, @sadb_address={0x5, 0x5, 0x33, 0x20, 0x0, @in6={0xa, 0x4e21, 0x8, @remote, 0x9}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x3e}}]}, 0x158}}, 0x40c0) (async) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000080), 0x3, 0x505000) (async) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x3, 0x505000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0xb9b7, 0x8, 0x1f}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xf00, 0x5}, 0x48) 01:04:04 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xaff, 0x2, 0x4, 0x218, 0x1, 0x100, '\x00', r1, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0xa}, 0x48) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xcc0, 0x800, 0x8005, 0x0, 0x0}) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x3c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc040) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000180)={0x7fff, 0x3, 0x80}) r5 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000740)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000780), 0x12) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x1, 0x59, 0x7}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000080)={r2}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TUNGETDEVNETNS(r7, 0x54e3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r4, 0x40045730, &(0x7f0000000700)=0xffff8000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r8, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r8, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, r6, 0x8, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x401}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x40c1}, 0x16) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000340)={r2}) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(r3, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {&(0x7f0000000200), 0x3, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @loopback}}}, 0xa0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r9, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r11, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r9, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, r11, 0x20, 0x70bd2d, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", ""]}, 0x28}}, 0x4) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x3, 0x505000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0xb9b7, 0x8, 0x1f}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x3, 0x505000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0xb9b7, 0x8, 0x1f}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x1100, 0x5}, 0x48) 01:04:04 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2, 0x5, 0x7f, 0x7, 0x2b, 0x0, 0x70bd29, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@private=0xa010100, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x36, 0x4, 0x4}, @sadb_lifetime={0x4, 0x1, 0x2, 0x8, 0x21e, 0x3}, @sadb_x_policy={0x8, 0x12, 0x2, 0x5, 0x0, 0x6e6bb6, 0x1, {0x6, 0x3c, 0x0, 0xcb, 0x0, 0x67f, 0x0, @in=@private=0xa010102, @in=@multicast2}}, @sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x0, 0x8, {0x6, 0x2b, 0x5, 0x4, 0x0, 0x1, 0x0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2}}, @sadb_sa={0x2, 0x1, 0x4d3, 0x0, 0x0, 0x67, 0x1, 0x20000000}, @sadb_ident={0x2, 0xb, 0x9, 0x0, 0x7dce0bcf}, @sadb_address={0x5, 0x5, 0x33, 0x20, 0x0, @in6={0xa, 0x4e21, 0x8, @remote, 0x9}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x3e}}]}, 0x158}}, 0x40c0) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2, 0x5, 0x7f, 0x7, 0x2b, 0x0, 0x70bd29, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@private=0xa010100, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x36, 0x4, 0x4}, @sadb_lifetime={0x4, 0x1, 0x2, 0x8, 0x21e, 0x3}, @sadb_x_policy={0x8, 0x12, 0x2, 0x5, 0x0, 0x6e6bb6, 0x1, {0x6, 0x3c, 0x0, 0xcb, 0x0, 0x67f, 0x0, @in=@private=0xa010102, @in=@multicast2}}, @sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x0, 0x8, {0x6, 0x2b, 0x5, 0x4, 0x0, 0x1, 0x0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2}}, @sadb_sa={0x2, 0x1, 0x4d3, 0x0, 0x0, 0x67, 0x1, 0x20000000}, @sadb_ident={0x2, 0xb, 0x9, 0x0, 0x7dce0bcf}, @sadb_address={0x5, 0x5, 0x33, 0x20, 0x0, @in6={0xa, 0x4e21, 0x8, @remote, 0x9}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x3e}}]}, 0x158}}, 0x40c0) 01:04:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xb, 0x7fffffff, 0x2, 0x0, 0xffffffffffffffff, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x2, 0xb}, 0x48) 01:04:04 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xaff, 0x2, 0x4, 0x218, 0x1, 0x100, '\x00', r1, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0xa}, 0x48) 01:04:04 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f00000003c0)=0x7) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b06067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000380)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @multicast1}}, 0x24) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @remote, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000200)={'ip_vti0\x00', r1, 0x7, 0x0, 0x1, 0x3, {{0x3f, 0x4, 0x3, 0x28, 0xfc, 0x64, 0x0, 0x1, 0x2f, 0x0, @remote, @multicast1, {[@ra={0x94, 0x4}, @cipso={0x86, 0x61, 0x0, [{0x6, 0x11, "c01656d446323e942e44cf79d0b6af"}, {0x6, 0x8, "2767ea591c02"}, {0x6, 0x2}, {0x5, 0x12, "a9447843e31bbcd6232de1600e5275e2"}, {0x2, 0xe, "fbf58c5b4745cdad521bf228"}, {0x5, 0x2}, {0x6, 0x4, 'dv'}, {0x6, 0xb, "06d442903ffa41603e"}, {0x2, 0xf, "cffba514f13634f30e6ad62158"}]}, @rr={0x7, 0x7, 0xfc, [@dev={0xac, 0x14, 0x14, 0xb}]}, @noop, @timestamp_prespec={0x44, 0x3c, 0x94, 0x3, 0x6, [{@loopback, 0x10000}, {@multicast2, 0xfff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@private=0xa010101, 0x100}, {@local, 0x2}, {@multicast1, 0x6}, {@loopback, 0x10000}]}, @ra={0x94, 0x4}, @generic={0x94, 0x7, "d382e8bb9c"}, @timestamp_addr={0x44, 0x34, 0x2f, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffffc}, {@rand_addr=0x64010101, 0xff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xd4a9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x13}, 0xffffffff}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x2}]}]}}}}}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) recvfrom$packet(r2, &(0x7f0000000100)=""/217, 0xd9, 0x40010040, 0x0, 0x0) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x1200, 0x5}, 0x48) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x100, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xaff, 0x2, 0x4, 0x218, 0x1, 0x100, '\x00', r1, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0xa}, 0x48) 01:04:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xb, 0x7fffffff, 0x2, 0x0, 0xffffffffffffffff, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x2, 0xb}, 0x48) 01:04:04 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f00000003c0)=0x7) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b06067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000380)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @multicast1}}, 0x24) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @remote, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000200)={'ip_vti0\x00', r1, 0x7, 0x0, 0x1, 0x3, {{0x3f, 0x4, 0x3, 0x28, 0xfc, 0x64, 0x0, 0x1, 0x2f, 0x0, @remote, @multicast1, {[@ra={0x94, 0x4}, @cipso={0x86, 0x61, 0x0, [{0x6, 0x11, "c01656d446323e942e44cf79d0b6af"}, {0x6, 0x8, "2767ea591c02"}, {0x6, 0x2}, {0x5, 0x12, "a9447843e31bbcd6232de1600e5275e2"}, {0x2, 0xe, "fbf58c5b4745cdad521bf228"}, {0x5, 0x2}, {0x6, 0x4, 'dv'}, {0x6, 0xb, "06d442903ffa41603e"}, {0x2, 0xf, "cffba514f13634f30e6ad62158"}]}, @rr={0x7, 0x7, 0xfc, [@dev={0xac, 0x14, 0x14, 0xb}]}, @noop, @timestamp_prespec={0x44, 0x3c, 0x94, 0x3, 0x6, [{@loopback, 0x10000}, {@multicast2, 0xfff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@private=0xa010101, 0x100}, {@local, 0x2}, {@multicast1, 0x6}, {@loopback, 0x10000}]}, @ra={0x94, 0x4}, @generic={0x94, 0x7, "d382e8bb9c"}, @timestamp_addr={0x44, 0x34, 0x2f, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffffc}, {@rand_addr=0x64010101, 0xff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xd4a9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x13}, 0xffffffff}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x2}]}]}}}}}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) recvfrom$packet(r2, &(0x7f0000000100)=""/217, 0xd9, 0x40010040, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f00000003c0)=0x7) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b06067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000380)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @multicast1}}, 0x24) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @remote, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000200)={'ip_vti0\x00', r1, 0x7, 0x0, 0x1, 0x3, {{0x3f, 0x4, 0x3, 0x28, 0xfc, 0x64, 0x0, 0x1, 0x2f, 0x0, @remote, @multicast1, {[@ra={0x94, 0x4}, @cipso={0x86, 0x61, 0x0, [{0x6, 0x11, "c01656d446323e942e44cf79d0b6af"}, {0x6, 0x8, "2767ea591c02"}, {0x6, 0x2}, {0x5, 0x12, "a9447843e31bbcd6232de1600e5275e2"}, {0x2, 0xe, "fbf58c5b4745cdad521bf228"}, {0x5, 0x2}, {0x6, 0x4, 'dv'}, {0x6, 0xb, "06d442903ffa41603e"}, {0x2, 0xf, "cffba514f13634f30e6ad62158"}]}, @rr={0x7, 0x7, 0xfc, [@dev={0xac, 0x14, 0x14, 0xb}]}, @noop, @timestamp_prespec={0x44, 0x3c, 0x94, 0x3, 0x6, [{@loopback, 0x10000}, {@multicast2, 0xfff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@private=0xa010101, 0x100}, {@local, 0x2}, {@multicast1, 0x6}, {@loopback, 0x10000}]}, @ra={0x94, 0x4}, @generic={0x94, 0x7, "d382e8bb9c"}, @timestamp_addr={0x44, 0x34, 0x2f, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffffc}, {@rand_addr=0x64010101, 0xff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xd4a9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x13}, 0xffffffff}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x2}]}]}}}}}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) recvfrom$packet(r2, &(0x7f0000000100)=""/217, 0xd9, 0x40010040, 0x0, 0x0) (async) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 1: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x15, 0xffffffff, 0x0, 0x5, 0x0, r0, 0xfffffffc}, 0x48) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x1300, 0x5}, 0x48) 01:04:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xb, 0x7fffffff, 0x2, 0x0, 0xffffffffffffffff, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x2, 0xb}, 0x48) 01:04:04 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f00000003c0)=0x7) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b06067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000380)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @multicast1}}, 0x24) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @remote, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000200)={'ip_vti0\x00', r1, 0x7, 0x0, 0x1, 0x3, {{0x3f, 0x4, 0x3, 0x28, 0xfc, 0x64, 0x0, 0x1, 0x2f, 0x0, @remote, @multicast1, {[@ra={0x94, 0x4}, @cipso={0x86, 0x61, 0x0, [{0x6, 0x11, "c01656d446323e942e44cf79d0b6af"}, {0x6, 0x8, "2767ea591c02"}, {0x6, 0x2}, {0x5, 0x12, "a9447843e31bbcd6232de1600e5275e2"}, {0x2, 0xe, "fbf58c5b4745cdad521bf228"}, {0x5, 0x2}, {0x6, 0x4, 'dv'}, {0x6, 0xb, "06d442903ffa41603e"}, {0x2, 0xf, "cffba514f13634f30e6ad62158"}]}, @rr={0x7, 0x7, 0xfc, [@dev={0xac, 0x14, 0x14, 0xb}]}, @noop, @timestamp_prespec={0x44, 0x3c, 0x94, 0x3, 0x6, [{@loopback, 0x10000}, {@multicast2, 0xfff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@private=0xa010101, 0x100}, {@local, 0x2}, {@multicast1, 0x6}, {@loopback, 0x10000}]}, @ra={0x94, 0x4}, @generic={0x94, 0x7, "d382e8bb9c"}, @timestamp_addr={0x44, 0x34, 0x2f, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffffc}, {@rand_addr=0x64010101, 0xff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xd4a9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x13}, 0xffffffff}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x2}]}]}}}}}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) recvfrom$packet(r2, &(0x7f0000000100)=""/217, 0xd9, 0x40010040, 0x0, 0x0) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x100, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) (rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 1: pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x15, 0xffffffff, 0x0, 0x5, 0x0, r0, 0xfffffffc}, 0x48) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x1400, 0x5}, 0x48) 01:04:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x40000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x1800, 0x5}, 0x48) 01:04:04 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x100, 0x40) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:04 executing program 1: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x15, 0xffffffff, 0x0, 0x5, 0x0, r0, 0xfffffffc}, 0x48) 01:04:04 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x0, 0x9, 0x210, r0, 0x6, '\x00', 0x0, r1, 0x2, 0x0, 0x4, 0xa}, 0x48) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x1000000, 0x5}, 0x48) 01:04:04 executing program 3: prctl$PR_SET_IO_FLUSHER(0x39, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x4bae, 0x5, 0x7fffffff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000180)='/dev/dri/card#\x00', 0xf) 01:04:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000080)={0x0, 0x90fe, 0x3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:04 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x7ffe, 0x2, 0x6, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, r0, 0x2, 0x4, 0x5, 0x7}, 0x48) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000100)=0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14, 0x800) 01:04:04 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x0, 0x9, 0x210, r0, 0x6, '\x00', 0x0, r1, 0x2, 0x0, 0x4, 0xa}, 0x48) 01:04:04 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x2000000, 0x5}, 0x48) 01:04:04 executing program 3: prctl$PR_SET_IO_FLUSHER(0x39, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x4bae, 0x5, 0x7fffffff}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000180)='/dev/dri/card#\x00', 0xf) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000080)={0x0, 0x90fe, 0x3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'ip6tnl0\x00', r1, 0x4, 0x1, 0x3f, 0x5, 0x0, @remote, @mcast1, 0x40, 0x7, 0x20, 0x1}}) 01:04:05 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x7ffe, 0x2, 0x6, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, r0, 0x2, 0x4, 0x5, 0x7}, 0x48) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000100)=0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14, 0x800) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x7ffe, 0x2, 0x6, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, r0, 0x2, 0x4, 0x5, 0x7}, 0x48) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000100)=0x1) (async) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14, 0x800) (async) 01:04:05 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x0, 0x9, 0x210, r0, 0x6, '\x00', 0x0, r1, 0x2, 0x0, 0x4, 0xa}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x0, 0x9, 0x210, r0, 0x6, '\x00', 0x0, r1, 0x2, 0x0, 0x4, 0xa}, 0x48) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x3000000, 0x5}, 0x48) 01:04:05 executing program 3: prctl$PR_SET_IO_FLUSHER(0x39, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x4bae, 0x5, 0x7fffffff}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) r2 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000180)='/dev/dri/card#\x00', 0xf) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000080)={0x0, 0x90fe, 0x3}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 32) 01:04:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'ip6tnl0\x00', r1, 0x4, 0x1, 0x3f, 0x5, 0x0, @remote, @mcast1, 0x40, 0x7, 0x20, 0x1}}) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x4000000, 0x5}, 0x48) 01:04:05 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f00000001c0)=0x6, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r3, 0x110, 0x3) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000200)=0x1, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000140)={'bond_slave_1\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x8, 0xfffffff7, 0xfffffff8}) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="2dc481", 0x3) 01:04:05 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x7ffe, 0x2, 0x6, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, r0, 0x2, 0x4, 0x5, 0x7}, 0x48) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000100)=0x1) (async) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14, 0x800) 01:04:05 executing program 4: connect$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x28}}}, 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'ip6tnl0\x00', r1, 0x4, 0x1, 0x3f, 0x5, 0x0, @remote, @mcast1, 0x40, 0x7, 0x20, 0x1}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'ip6tnl0\x00', r1, 0x4, 0x1, 0x3f, 0x5, 0x0, @remote, @mcast1, 0x40, 0x7, 0x20, 0x1}}) (async) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) socketpair(0x3f, 0x800, 0x6, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000280)={r1}) socketpair(0xc, 0x7, 0x5, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r2, &(0x7f0000000180)=""/117, 0x75, 0x2003, &(0x7f0000000200)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e24, 0x89a354, @dev={0xfe, 0x80, '\x00', 0x28}, 0x3a001043}}, 0x24) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x4c, 0x1, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000300)={r4}) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x5000000, 0x5}, 0x48) 01:04:05 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f00000001c0)=0x6, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r3, 0x110, 0x3) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000200)=0x1, 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000140)={'bond_slave_1\x00'}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x8, 0xfffffff7, 0xfffffff8}) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="2dc481", 0x3) 01:04:05 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) 01:04:05 executing program 4: connect$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x28}}}, 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x28}}}, 0x24) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x6000000, 0x5}, 0x48) 01:04:05 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000040)='%,:-\x00', 0x5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000000)=0x5f8) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) socketpair(0x3f, 0x800, 0x6, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000080)) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000280)={r1}) (async, rerun: 64) socketpair(0xc, 0x7, 0x5, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r2, &(0x7f0000000180)=""/117, 0x75, 0x2003, &(0x7f0000000200)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e24, 0x89a354, @dev={0xfe, 0x80, '\x00', 0x28}, 0x3a001043}}, 0x24) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x4c, 0x1, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000300)={r4}) 01:04:05 executing program 4: connect$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x28}}}, 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x7000000, 0x5}, 0x48) 01:04:05 executing program 3: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f00000001c0)=0x6, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) socket$rxrpc(0x21, 0x2, 0x2) (async) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r3, 0x110, 0x3) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000200)=0x1, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000140)={'bond_slave_1\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x8, 0xfffffff7, 0xfffffff8}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x8, 0xfffffff7, 0xfffffff8}) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="2dc481", 0x3) 01:04:05 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) 01:04:05 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000040)='%,:-\x00', 0x5) (async) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000040)='%,:-\x00', 0x5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000000)=0x5f8) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async, rerun: 64) socketpair(0x3f, 0x800, 0x6, &(0x7f0000000240)) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000280)={r1}) (async) socketpair(0xc, 0x7, 0x5, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rxrpc(r2, &(0x7f0000000180)=""/117, 0x75, 0x2003, &(0x7f0000000200)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e24, 0x89a354, @dev={0xfe, 0x80, '\x00', 0x28}, 0x3a001043}}, 0x24) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x4c, 0x1, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000300)={r4}) 01:04:05 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) 01:04:05 executing program 4: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) setpriority(0x0, r0, 0x8000000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x8000000, 0x5}, 0x48) 01:04:05 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x200002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$dri(&(0x7f0000000280), 0x2, 0x325400) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x400, 0x42003) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000002c0)={0xb528, 0x2, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_open_pts(r3, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x8, 0x7, 0x7905, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 01:04:05 executing program 2: openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000040)='%,:-\x00', 0x5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000000)=0x5f8) 01:04:05 executing program 1: ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000140)={{0x1, 0x0, 0x1, 0x0, 0x18}, 0x7, 0x80000001}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r1, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_DEBUG={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20048080) 01:04:05 executing program 4: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) setpriority(0x0, r0, 0x8000000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getpgrp(0x0) (async) syz_open_procfs$namespace(r0, 0x0) (async) setpriority(0x0, r0, 0x8000000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x9000000, 0x5}, 0x48) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x3) syz_open_dev$dri(&(0x7f0000000080), 0x9, 0x20181) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180)) 01:04:05 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x200002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000280), 0x2, 0x325400) (async) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x400, 0x42003) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000002c0)={0xb528, 0x2, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_open_pts(r3, 0x40000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x8, 0x7, 0x7905, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 01:04:05 executing program 1: ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000140)={{0x1, 0x0, 0x1, 0x0, 0x18}, 0x7, 0x80000001}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r1, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_DEBUG={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20048080) 01:04:05 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000000), 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r2, 0x29, 0x9, 0x1, 0x2, 0x2d, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, 0x7, 0x700, 0x4, 0x4}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x8000, 0x8001, 0x1681, r4, 0xae, '\x00', r5, 0xffffffffffffffff, 0x0, 0x3, 0x9, 0xf}, 0x48) 01:04:05 executing program 4: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) (async) setpriority(0x0, r0, 0x8000000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x3) (async) syz_open_dev$dri(&(0x7f0000000080), 0x9, 0x20181) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180)) 01:04:05 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x200002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000280), 0x2, 0x325400) (async) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x400, 0x42003) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000002c0)={0xb528, 0x2, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_open_pts(r3, 0x40000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x8, 0x7, 0x7905, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 01:04:05 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r2, 0x29, 0x9, 0x1, 0x2, 0x2d, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, 0x7, 0x700, 0x4, 0x4}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x8000, 0x8001, 0x1681, r4, 0xae, '\x00', r5, 0xffffffffffffffff, 0x0, 0x3, 0x9, 0xf}, 0x48) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xa000000, 0x5}, 0x48) 01:04:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x3) syz_open_dev$dri(&(0x7f0000000080), 0x9, 0x20181) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180)) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x3) (async) syz_open_dev$dri(&(0x7f0000000080), 0x9, 0x20181) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180)) (async) 01:04:05 executing program 1: ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000140)={{0x1, 0x0, 0x1, 0x0, 0x18}, 0x7, 0x80000001}) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r1, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_DEBUG={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20048080) 01:04:05 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xb000000, 0x5}, 0x48) 01:04:05 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1d, 0x40, 0x400, 0xc4, 0x1c4c, r0, 0x7, '\x00', 0x0, r0, 0x4, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x400000}, 0x48) 01:04:05 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x7, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0xfffffffc, 0x624e, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x4, 0x20140) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x2, 0x3, 0x80000001}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000001c0), 0x0, 0x40) 01:04:06 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r2, 0x29, 0x9, 0x1, 0x2, 0x2d, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, 0x7, 0x700, 0x4, 0x4}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x81, 0x8000, 0x8001, 0x1681, r4, 0xae, '\x00', r5, 0xffffffffffffffff, 0x0, 0x3, 0x9, 0xf}, 0x48) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x4, 0x20140) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x2, 0x3, 0x80000001}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f00000001c0), 0x0, 0x40) 01:04:06 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r3, 0x4, 0x60, 0x2, 0x9, 0x1, @remote, @dev={0xfe, 0x80, '\x00', 0x27}, 0x40, 0x20, 0x1d6, 0x8}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x1, 0x6, 0x80, 0x10, r0, 0x3, '\x00', r2, r4, 0x2, 0x0, 0x3}, 0x48) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xc000000, 0x5}, 0x48) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) syz_open_dev$dri(&(0x7f00000000c0), 0x4, 0x20140) (async) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x4, 0x20140) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x2, 0x3, 0x80000001}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000001c0), 0x0, 0x40) 01:04:06 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1d, 0x40, 0x400, 0xc4, 0x1c4c, r0, 0x7, '\x00', 0x0, r0, 0x4, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x400000}, 0x48) 01:04:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x800004, 0x80000000, 0x102, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b57de57097818dc03c9760509881c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d8030aecaeebff38502a4d2b68bfa65f3dd8493efaf1b1376b3e95a8f8700000000ee5d794b027cc6d622c3b6f0c180f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba9119028e1f98ceb39c58a04fbbe95e599561552498414209ce4eedd27ea37d8787cd", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9330d004c0064000006049093fddafb00ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x6, @remote}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000380)={'syztnl1\x00', r3, 0x2f, 0x6, 0x6, 0x3, 0x62, @ipv4={'\x00', '\xff\xff', @multicast1}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x88, 0x1}}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)=@updpolicy={0xe8, 0x19, 0x300, 0x70bd28, 0x25dfdbfc, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@broadcast, 0x4e20, 0x401, 0x4e22, 0x8, 0x8, 0x80, 0x20, 0xb4, r4, r5}, {0xffff, 0x0, 0x2, 0xe7, 0x4, 0xffffffff, 0x6, 0x24}, {0x2, 0xe439, 0x7fffffffffffffff, 0x6}, 0x3, 0x6e6bbe, 0x0, 0x0, 0x0, 0x2}, [@mark={0xc, 0x15, {0x35075c, 0x81}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}, @offload={0xc, 0x1c, {r2, 0x2}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000) 01:04:06 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x7, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0xfffffffc, 0x624e, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) syz_open_dev$dri(&(0x7f0000000100), 0x7, 0x1) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0xfffffffc, 0x624e, 0x9}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:06 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r3, 0x4, 0x60, 0x2, 0x9, 0x1, @remote, @dev={0xfe, 0x80, '\x00', 0x27}, 0x40, 0x20, 0x1d6, 0x8}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x1, 0x6, 0x80, 0x10, r0, 0x3, '\x00', r2, r4, 0x2, 0x0, 0x3}, 0x48) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xd000000, 0x5}, 0x48) 01:04:06 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r3, 0x4, 0x60, 0x2, 0x9, 0x1, @remote, @dev={0xfe, 0x80, '\x00', 0x27}, 0x40, 0x20, 0x1d6, 0x8}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x1, 0x6, 0x80, 0x10, r0, 0x3, '\x00', r2, r4, 0x2, 0x0, 0x3}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x1, 0x6, 0x80, 0x10, r0, 0x3, '\x00', r2, r4, 0x2, 0x0, 0x3}, 0x48) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xe000000, 0x5}, 0x48) 01:04:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x800004, 0x80000000, 0x102, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b57de57097818dc03c9760509881c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d8030aecaeebff38502a4d2b68bfa65f3dd8493efaf1b1376b3e95a8f8700000000ee5d794b027cc6d622c3b6f0c180f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba9119028e1f98ceb39c58a04fbbe95e599561552498414209ce4eedd27ea37d8787cd", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9330d004c0064000006049093fddafb00ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x6, @remote}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000380)={'syztnl1\x00', r3, 0x2f, 0x6, 0x6, 0x3, 0x62, @ipv4={'\x00', '\xff\xff', @multicast1}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x88, 0x1}}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)=@updpolicy={0xe8, 0x19, 0x300, 0x70bd28, 0x25dfdbfc, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@broadcast, 0x4e20, 0x401, 0x4e22, 0x8, 0x8, 0x80, 0x20, 0xb4, r4, r5}, {0xffff, 0x0, 0x2, 0xe7, 0x4, 0xffffffff, 0x6, 0x24}, {0x2, 0xe439, 0x7fffffffffffffff, 0x6}, 0x3, 0x6e6bbe, 0x0, 0x0, 0x0, 0x2}, [@mark={0xc, 0x15, {0x35075c, 0x81}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}, @offload={0xc, 0x1c, {r2, 0x2}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x800004, 0x80000000, 0x102, 0x1}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b57de57097818dc03c9760509881c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d8030aecaeebff38502a4d2b68bfa65f3dd8493efaf1b1376b3e95a8f8700000000ee5d794b027cc6d622c3b6f0c180f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba9119028e1f98ceb39c58a04fbbe95e599561552498414209ce4eedd27ea37d8787cd", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9330d004c0064000006049093fddafb00ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x6, @remote}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000380)={'syztnl1\x00', r3, 0x2f, 0x6, 0x6, 0x3, 0x62, @ipv4={'\x00', '\xff\xff', @multicast1}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x88, 0x1}}) (async) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)=@updpolicy={0xe8, 0x19, 0x300, 0x70bd28, 0x25dfdbfc, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@broadcast, 0x4e20, 0x401, 0x4e22, 0x8, 0x8, 0x80, 0x20, 0xb4, r4, r5}, {0xffff, 0x0, 0x2, 0xe7, 0x4, 0xffffffff, 0x6, 0x24}, {0x2, 0xe439, 0x7fffffffffffffff, 0x6}, 0x3, 0x6e6bbe, 0x0, 0x0, 0x0, 0x2}, [@mark={0xc, 0x15, {0x35075c, 0x81}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}, @offload={0xc, 0x1c, {r2, 0x2}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000) (async) 01:04:06 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0xf000000, 0x5}, 0x48) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x20b, 0x97, 0x401, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000080)={r2}) 01:04:06 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1d, 0x40, 0x400, 0xc4, 0x1c4c, r0, 0x7, '\x00', 0x0, r0, 0x4, 0x0, 0x1}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x400000}, 0x48) 01:04:06 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x7, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0xfffffffc, 0x624e, 0x9}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x20b, 0x97, 0x401, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000080)={r2}) 01:04:06 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) 01:04:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x800004, 0x80000000, 0x102, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b57de57097818dc03c9760509881c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d8030aecaeebff38502a4d2b68bfa65f3dd8493efaf1b1376b3e95a8f8700000000ee5d794b027cc6d622c3b6f0c180f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba9119028e1f98ceb39c58a04fbbe95e599561552498414209ce4eedd27ea37d8787cd", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9330d004c0064000006049093fddafb00ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x6, @remote}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000380)={'syztnl1\x00', r3, 0x2f, 0x6, 0x6, 0x3, 0x62, @ipv4={'\x00', '\xff\xff', @multicast1}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x88, 0x1}}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)=@updpolicy={0xe8, 0x19, 0x300, 0x70bd28, 0x25dfdbfc, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@broadcast, 0x4e20, 0x401, 0x4e22, 0x8, 0x8, 0x80, 0x20, 0xb4, r4, r5}, {0xffff, 0x0, 0x2, 0xe7, 0x4, 0xffffffff, 0x6, 0x24}, {0x2, 0xe439, 0x7fffffffffffffff, 0x6}, 0x3, 0x6e6bbe, 0x0, 0x0, 0x0, 0x2}, [@mark={0xc, 0x15, {0x35075c, 0x81}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}, @offload={0xc, 0x1c, {r2, 0x2}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x10000000, 0x5}, 0x48) 01:04:06 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:06 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)={r2}) (async) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x20b, 0x97, 0x401, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000080)={r2}) 01:04:06 executing program 4: r0 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETVERSION(r0, 0x80044942, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000100)=0x7, 0x4) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)=0x4) 01:04:06 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:06 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x7fff, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x200}, 0x48) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x400) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000180)={{0x0, 0x2, 0x8000, 0x0, 0x1000}, 0x4ac, 0xfffffffffffffffa}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x3, 0x9, 0x6, 0x1110, r0, 0x2, '\x00', 0x0, r1, 0x2, 0x3, 0x1}, 0x48) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x11000000, 0x5}, 0x48) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x2, &(0x7f0000000140)=""/76, 0x4c) 01:04:06 executing program 4: r0 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETVERSION(r0, 0x80044942, &(0x7f0000000000)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async, rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000100)=0x7, 0x4) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)=0x4) 01:04:06 executing program 1: socketpair(0x1e, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x4c, r2, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x6a}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:06 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x7fff, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x200}, 0x48) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x400) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000180)={{0x0, 0x2, 0x8000, 0x0, 0x1000}, 0x4ac, 0xfffffffffffffffa}) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x3, 0x9, 0x6, 0x1110, r0, 0x2, '\x00', 0x0, r1, 0x2, 0x3, 0x1}, 0x48) (rerun: 64) 01:04:06 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x2, &(0x7f0000000140)=""/76, 0x4c) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x2, &(0x7f0000000140)=""/76, 0x4c) (async) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x12000000, 0x5}, 0x48) 01:04:06 executing program 1: socketpair(0x1e, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x4c, r2, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x6a}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x4) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:06 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x7fff, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x200}, 0x48) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x400) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000180)={{0x0, 0x2, 0x8000, 0x0, 0x1000}, 0x4ac, 0xfffffffffffffffa}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x3, 0x9, 0x6, 0x1110, r0, 0x2, '\x00', 0x0, r1, 0x2, 0x3, 0x1}, 0x48) 01:04:06 executing program 4: r0 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETVERSION(r0, 0x80044942, &(0x7f0000000000)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000100)=0x7, 0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)=0x4) 01:04:06 executing program 3: setsockopt$RXRPC_UPGRADEABLE_SERVICE(0xffffffffffffffff, 0x110, 0x5, &(0x7f0000000080)=[0x0, 0x3], 0x2) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000200), 0x7, 0x7c8c0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x153003, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000280)) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x9, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x640100fe}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7800, 0x20, 0x9, 0xffffffff}}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x2, &(0x7f0000000140)=""/76, 0x4c) 01:04:06 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x13000000, 0x5}, 0x48) 01:04:06 executing program 3: setsockopt$RXRPC_UPGRADEABLE_SERVICE(0xffffffffffffffff, 0x110, 0x5, &(0x7f0000000080)=[0x0, 0x3], 0x2) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000200), 0x7, 0x7c8c0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x153003, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000280)) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x9, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x640100fe}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7800, 0x20, 0x9, 0xffffffff}}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) (rerun: 32) 01:04:06 executing program 2: ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(0xffffffffffffffff, 0x40045731, &(0x7f0000000000)=0x9) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:06 executing program 1: socketpair(0x1e, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x4c, r2, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x6a}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) recvfrom$packet(r2, &(0x7f0000000140)=""/133, 0x85, 0x40010041, &(0x7f0000000080)={0x11, 0x16, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 01:04:06 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) write$ppp(0xffffffffffffffff, &(0x7f0000000100)="3da1743450b43b1d875ece93b85316ad70235ae5dc5a2323ea438154fa0727be602688e474b113d0819fb206f875c7e61ea8f277ddaa5423afd0670590f59790673b0b98bef9804016705fa4ce74ada6d1aac3e616569c0e06530b715ef45dae9aa9da23360cbc2621fe2de83bf10d056f241665dfeb05c8bd3e7041e4d4618ebdd306d9219c86f0a2cb2257293ce853f5bfe667a38f8d9a8658333e718deb65b73018f80a43a4e6a1a7c49e3a0bed5e4d95912585dd3430ce0f58c56c348375221e9b3ae225ad4515b7620757ee3befc21ff5ad6f1f88ebbcd749c73c805893d8a3abb07c5913671b9634cc8ae88ef239a2c801a6f81a4aec7f4001f93c658f40d0f9761ed81fe13056ae6cff419d80abc955065add53b107994952de161eaf86b79aaba6ba0a340bf70518358e0936cb3bb6ae02ed35952af09c9a6b0e14e42bc6d127626ba63e7a076e19f06f2e6523e05745787e9261c2fae1321b31d52c882586b033e51d8b74aee85d6dcb25a4f0592d8711ad438468578e778f9bf58316f5896cfe81f4f9908e0cbe19f9175a27b2e20a68b466c259d9a68152e57501a497f0a830c91965661ede044bebefd98e4949710b5f57f8ad2390705367cf60f22f04a9508ad443d6ac13d4622af5e3c8b4798b6dc8e3099d7e2a7b0ca7978d6ccd9c9a87533b4bbffd4c047ba76119a45a32471c3e2e3c8b525f0b9bf8e4d134b119515a6508594fb6a112f4b95e5c6b29c05fc397bc816a6b5f2c1325935a3dae4fea1a8cb61250d96e551dea2c7cd00a448a679b36356027dde94a1904cb0d694e8782b4e80b9d41145cd75702a4e8dd7cf1bba05a41f4f977fd95977e6c079815a8fab39c1abf918d9a8632df464fe20b620a560908cef502e264958a86cb783da238257dc5241a5e87ec5781142b086d671652a4a4caf8939cb4b1897e95334aa104e8f47c33b87e74f6ff8c46ac677d06fecdd720b971903df9a9998983686c7f7dc88679f7da0ccb62616c3f850895e4945552918146eef7a8c4b9b2b6ce8e9a27f4b886d4c0d554b7f5fa8d4d53343f2a15edc1a4f33cbd92670c184abc533d8bc025cfe44ff09a1688573267c5d69f2e8e95d669a87b0d46782f807a0663a28571ddd239cd73b71b4f155579325cbf0aa27873e999a0aad6767e051f7bbbc1e47b0251cc94f467d2d80c3d6dd56bf4809dfed48bdd420e983de64375e2539bcada818a97a266773e321729355c9e70864e65a3b309e36cb0a4e165fdea8eb11d158b14ffd40e38706dcc56c1812740906ebaa8b5c0b5c995013baddbfc30cfd2bd911eab3812830ce216ad5fed78c220974ab67715eb99a6cb2c146c3218b1ec1c584ccea1cefe081e4d89e2b0ef7e2dc14cefd085529c6658e482350e759465884fe31f8e0507f1bf1ee06499d9f64f8eb712607b41283a2cf79e243dfc6509447a53df82f788a881409b61932e5f9ce3b8d2f374c04402e6e94a616b6e272902d26b837c7cde383c5bf735f391d16a697a7b5163487f5eb3dd822216cde31245ed3770369d1b513790226052c3d7ff12b88ea42c9f9060b6a940ee8726c65a88f64e8b2cf037c8f699516c36421732875cecf6f6cf799dd18c54d88547b9fc3d60b57d215f0157dd21b16f4275f64d534beb3cdcbd58517538d9bf0f09aaf4787958eaca1c8c2198a6238a58eeeb6f2cfe85182336a71a8b4f1d4675967376bcb1094805af72cc85117cf777942208f5242741d184329493a51902205228a3aa8670092f0d3ff3e86c108ba2758ce70a2c19dbb32bbab87b3eb414af3adddf430bebcbdef03828c673a306a243fb33e16534c470bff131410ac304ce13ac27235cafadff4022a56f256e53f750027c7c9454b2727424a2f1ee11c5c38eb9c523ef4f3b27b8007458402ad65756f8f8ff06912aacf32f835e50dadfb38f4e9724e29cde95c6b619b7e81006c5265554ef5f60f6063937aff7771458d0d9c788105a95ba6aaeebc9b32606873444515c74b04a4e1dcc3577d5e3412d2a0359714fa51780314490315db2a6af2b048947f34d04352dd9b5ca07db1c05def3b9c6f1b796287e9a74d932b4847ae4e51cc1db6065132b716017adea0f678528b238930a24fb5009f5a060e9669a2961e3965e533c31bef9a2412e95480dbc7148497829d852ed36379ccf289ea18c715b7529fa8200b777960354dbdfd51e532f178c2d33d6936ec80f7fcbed74f44c406e74122d35009ba77a8af25b7dc88cb68bcb5fb4e2b87965e4c1d253ab9ebadd487d354fca7d4ff22c6bf76467d2bc5f3c7353e61422359cb0c4f9b16d0d122c324ff7d5119ed9c99d02014a7c75ec4f58275ae2dc72e572730aeead08eaa14430038babf902e90c9ea635491d541757964aac2080ec391d6c07f84393f002036b29de49441fc1a447db9ea12dd5f15e113e41d8302664a1ab6459485247f6264122dead8df8f8374666878c0ac19de1592290dd87722dc83e385f5a51dc7c7605837f4701b9a95b6ad939a876a4d3555b10b63d064e4b1a3be75220a0fca7e17448fe41fb889551c2ebec6f133800e81827334287b029441b15d1d2576a415b253bb36f055ac6025bb498cd0dc71cf0ebf4e51c5c423f8f90e79a7dfdf35473c0b8e53b670d7232e02275e602e57c99215368002dbab578b8a00ffe07abcdef40a1a71857d31366debb88fd8081ba3a4f8effa4d552c17e38c2715542cd7769ccec7b0d5451968863621cb47096a467672052c6d2b1025e65dfd00ca0734c0f569ddcd7cd741cbc7bbce1d7f7223f99284dc5bcdf0bd6da5c30eca466532b464e709e37df6a5d13992378b1182b0f7f369bb898183be3c1eb6c6c0ec14f12f956096ddffb53a7a49e21798d855536edc6ab9bff784549dab91d7fe8d47b2d1b49a914ec6ae0031622170458fe94b56dd32cde27c095fd6e8477706753f855c2c3798c466ef81141f206253858801c79ef3060afbf0e506762441b33f76eaab34e3e3016da55e580be262fa73a6f3b9dece99037299e450f0109c117737441f1c31cd568b7a551b9cc9480e41d5adbe47b6ed57eabc59b23e5a9a8fcf2ccc228ae61bc34a471f93c082a1eee1dce8303352ca15ec5ceb67b4936b6c7522b74ece49d6f1d4422a32fca5c4338de5dd38983aa84f0fa0210cd81756e4fe50a4f71e91f23d75bb8d473dd5e7a691953a3836ea9537baac5dcd11e87d0809cba703f82c247b19b0148826720b68a63d8a6a943032aeecc357014ac96650d7d8759a116a4f5df1f3aea91b657beadbec6da3f598b814512cf81ae7a7b5f569ff5bbf790b1da6b1fb8cd43d40b047b28f1daaee4545713b89bc14f7951617715d4f622fc6e7761686869bb419ced91d7cac406c3047c3765267020681046d0a3e150b0e6ea2a8cc0beef07fbee78d44f735c5918f65f5c19e1e96ccf9e67d74f5eb600202fdddad872c8f7d87e77b6c40ebcad1d937d1877e4008923a3a81be1714244bc1a68086c3700979ebf1cb8adcec5963f4c9d9dd8f99a5cd0d95a4be3ac4d142b2ac2dbc40e69ee890973eed0a0449e00e8c4f8291c370c364eb3bd3691bc7070e9b6a8cc414d40343b3b41174022d75fd5891a629e60ad61382c57fdb0e8fd471fdaf862e8f1ecd18d6e5d30bc2181efdc61d4eaf51446c1a2fc2500e90c28b0f8c361af70e31bd2f22d7882ae74f1924849f2a70379b8b0411ac5ca3bea31b85133526660405f71f3dfe7cd4bc2bcce976ef0a7b24323d8c085c10c05e50eafd8f0e717683c92376c684564594f24dcc511eb21bd2d747e6b55cccda53520d2a43cce552a22db73f4d6c0576bd8a53181de9ce929d92a3bf3b16e256fc20bec4daa586e5c65beaf534be28b1d0f2e2d4c5291a6b14702a15fd68f2deec088b314b5554329b367f150be77a5be91c98200a86ea160314e98310665bb92c8f2ffbc1d696923594036543dd08cba94f19c11487c7683bc9676ea038e6c8c2c0674cff3cd3d06cd2a09a5700bb4d1396ba7cb10d4fa73b6726140dd54677f2e0aa013b4bc8dbe69f1a43c0c1678a46d7ad104736d268c4201a2a273c933f3eef7b4daf9e4f4ef85e1d966cb7e9d70e42e34e33f0087d775ecf6d6005c6f26edd860c3778e2a9143fa7a976d4387e6443f99311d03b69917b70d97c3083a1f50e0d5b73131a3ef00018083e77dbda8531a7429b8f569177a9b2dd56beb944d8ed514a9e2470553e41ac728858939e975850f69850f7edf7dcdcef624efc4dccdf61858d8125096b842f01a3426038a47d87e1271cf362d96820558270dd65cbfb2f85fdb81e069570acd10e8ca747840e5867cd5944d6aac7ce4df701f42cefe500c041ab4b4771a5a5592a3b15d31226b53126ccbc7d7639e0464f053b802e5649669a7d4e264623f7cd42fadf4ab1d2ef3650bddd9c4ca9f4057f942a73514de6488ac3fae73cc763ddee38a0955ca4dcc3df45c82549ce71906bdc92f866e2c4e0fdba2e979c346796433301990a7ddb5c19861843fd7049c76bd6e2d940ff5375c93cd7399b4e9a93b0f46b7af11e3281fa9d8351ca7b0439b48b1b9a8d90c6ba87c1f55aa77eb8f0cbc383757095c6d82998af94976bcdb4cea918e1ff8255d00509d77bb71b43a373b89481300aabb2a43fad07d0a37ad45e601cb38aa1a7dbae1c7f958080977dc187f79af01f033d7fcc4abba9492fd7e7f0d3936832d3330d444f1b2285cd02fc1fb3c52fc2b9d5e96c066fb79bcb92c22d09f1db9d6800868b0f57a3f55eec2dc961249cb67653fd8483414b3fb71823aeb40bd9e1cea11ce7500330501f37d2886fd3c26b0f0ad0423c26a0a4260406d5016355b3f1dc00a3163507fa68c8912729a69f115f75ee3d6169fec248756b99aaf479b48f0697e2520ed307c41a98c36139b0fe1f9aac9b959b69b578b1d044239a5a6c6be22049dc7bafe81170e19e6229ed60ef0aba803f6ca966dc18f692b5f24306a20e410c41b3d43f15449907278d35e91567b0307378e727f4cfe3f76a999f4d561ec5be6e9d17f8abb95c3a4aa1f521f4336b04bde73f436dee3c7adcc07841599161e02188fd55cbb8208b8f7afbb9396b93f53236e80f753f41e85d70a4815847671e7561f3d6ad7ee52255ae7f537e8f1d79edd8bfd44ad16d0b2f2d1fbc4c740c1b9b28b1e800b594dae6381a22599c0a61be0adb0e9e1639d6a54fb8d32b50a62b99bddc560d503f1ca8139a1ae52898cd109c7ef830a7cddca7580ce887f9f32c63a78df68f9b604ad46cc768fadfc4758eaeb8c70d43beb346b27797469a5ea782d262cd8366fa80e9704f37303b27f87f264a11787d5d8486c90ca241dcb4e927dba1110d2f5c083bb0601e52cb8469503f341e06811b8be0688c896ede94877a0eb781cba5b44f726ba7d1df50ac490039181c22503467d4c842cbec7bf5506f5555e84439b1bfe04d664f19833a0174c8e4cb0a9a61496d8efd41993e756b70f9423ba2f8e7d6799d7b4033fc77141656157ebb0bdef1e5d050273f2cab9d1f7e6957420c6964961f4c12e9cc4056c73461e1cff8a6687e4e7aed6556e0497ce080a8018a25ed9bc51272b914bcbc8b4159a7f8cf7d491e73b0f21b7ba3a814c481cde46e613ef1340e833c757e767dbed7350eb33a1456ae5e960a17b72488befec80eefcc1e97091d869216ec9ade238688c19a3bfbe44f34410330ee4e2d8710a2ea1994873b25ea6c18301a2643169df98678b8f70cb574ff24fabde668234708389f447cb", 0x1000) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000040)) 01:04:06 executing program 3: setsockopt$RXRPC_UPGRADEABLE_SERVICE(0xffffffffffffffff, 0x110, 0x5, &(0x7f0000000080)=[0x0, 0x3], 0x2) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000200), 0x7, 0x7c8c0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x153003, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000280)) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x9, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x640100fe}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7800, 0x20, 0x9, 0xffffffff}}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x14000000, 0x5}, 0x48) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) write$ppp(0xffffffffffffffff, &(0x7f0000000100)="3da1743450b43b1d875ece93b85316ad70235ae5dc5a2323ea438154fa0727be602688e474b113d0819fb206f875c7e61ea8f277ddaa5423afd0670590f59790673b0b98bef9804016705fa4ce74ada6d1aac3e616569c0e06530b715ef45dae9aa9da23360cbc2621fe2de83bf10d056f241665dfeb05c8bd3e7041e4d4618ebdd306d9219c86f0a2cb2257293ce853f5bfe667a38f8d9a8658333e718deb65b73018f80a43a4e6a1a7c49e3a0bed5e4d95912585dd3430ce0f58c56c348375221e9b3ae225ad4515b7620757ee3befc21ff5ad6f1f88ebbcd749c73c805893d8a3abb07c5913671b9634cc8ae88ef239a2c801a6f81a4aec7f4001f93c658f40d0f9761ed81fe13056ae6cff419d80abc955065add53b107994952de161eaf86b79aaba6ba0a340bf70518358e0936cb3bb6ae02ed35952af09c9a6b0e14e42bc6d127626ba63e7a076e19f06f2e6523e05745787e9261c2fae1321b31d52c882586b033e51d8b74aee85d6dcb25a4f0592d8711ad438468578e778f9bf58316f5896cfe81f4f9908e0cbe19f9175a27b2e20a68b466c259d9a68152e57501a497f0a830c91965661ede044bebefd98e4949710b5f57f8ad2390705367cf60f22f04a9508ad443d6ac13d4622af5e3c8b4798b6dc8e3099d7e2a7b0ca7978d6ccd9c9a87533b4bbffd4c047ba76119a45a32471c3e2e3c8b525f0b9bf8e4d134b119515a6508594fb6a112f4b95e5c6b29c05fc397bc816a6b5f2c1325935a3dae4fea1a8cb61250d96e551dea2c7cd00a448a679b36356027dde94a1904cb0d694e8782b4e80b9d41145cd75702a4e8dd7cf1bba05a41f4f977fd95977e6c079815a8fab39c1abf918d9a8632df464fe20b620a560908cef502e264958a86cb783da238257dc5241a5e87ec5781142b086d671652a4a4caf8939cb4b1897e95334aa104e8f47c33b87e74f6ff8c46ac677d06fecdd720b971903df9a9998983686c7f7dc88679f7da0ccb62616c3f850895e4945552918146eef7a8c4b9b2b6ce8e9a27f4b886d4c0d554b7f5fa8d4d53343f2a15edc1a4f33cbd92670c184abc533d8bc025cfe44ff09a1688573267c5d69f2e8e95d669a87b0d46782f807a0663a28571ddd239cd73b71b4f155579325cbf0aa27873e999a0aad6767e051f7bbbc1e47b0251cc94f467d2d80c3d6dd56bf4809dfed48bdd420e983de64375e2539bcada818a97a266773e321729355c9e70864e65a3b309e36cb0a4e165fdea8eb11d158b14ffd40e38706dcc56c1812740906ebaa8b5c0b5c995013baddbfc30cfd2bd911eab3812830ce216ad5fed78c220974ab67715eb99a6cb2c146c3218b1ec1c584ccea1cefe081e4d89e2b0ef7e2dc14cefd085529c6658e482350e759465884fe31f8e0507f1bf1ee06499d9f64f8eb712607b41283a2cf79e243dfc6509447a53df82f788a881409b61932e5f9ce3b8d2f374c04402e6e94a616b6e272902d26b837c7cde383c5bf735f391d16a697a7b5163487f5eb3dd822216cde31245ed3770369d1b513790226052c3d7ff12b88ea42c9f9060b6a940ee8726c65a88f64e8b2cf037c8f699516c36421732875cecf6f6cf799dd18c54d88547b9fc3d60b57d215f0157dd21b16f4275f64d534beb3cdcbd58517538d9bf0f09aaf4787958eaca1c8c2198a6238a58eeeb6f2cfe85182336a71a8b4f1d4675967376bcb1094805af72cc85117cf777942208f5242741d184329493a51902205228a3aa8670092f0d3ff3e86c108ba2758ce70a2c19dbb32bbab87b3eb414af3adddf430bebcbdef03828c673a306a243fb33e16534c470bff131410ac304ce13ac27235cafadff4022a56f256e53f750027c7c9454b2727424a2f1ee11c5c38eb9c523ef4f3b27b8007458402ad65756f8f8ff06912aacf32f835e50dadfb38f4e9724e29cde95c6b619b7e81006c5265554ef5f60f6063937aff7771458d0d9c788105a95ba6aaeebc9b32606873444515c74b04a4e1dcc3577d5e3412d2a0359714fa51780314490315db2a6af2b048947f34d04352dd9b5ca07db1c05def3b9c6f1b796287e9a74d932b4847ae4e51cc1db6065132b716017adea0f678528b238930a24fb5009f5a060e9669a2961e3965e533c31bef9a2412e95480dbc7148497829d852ed36379ccf289ea18c715b7529fa8200b777960354dbdfd51e532f178c2d33d6936ec80f7fcbed74f44c406e74122d35009ba77a8af25b7dc88cb68bcb5fb4e2b87965e4c1d253ab9ebadd487d354fca7d4ff22c6bf76467d2bc5f3c7353e61422359cb0c4f9b16d0d122c324ff7d5119ed9c99d02014a7c75ec4f58275ae2dc72e572730aeead08eaa14430038babf902e90c9ea635491d541757964aac2080ec391d6c07f84393f002036b29de49441fc1a447db9ea12dd5f15e113e41d8302664a1ab6459485247f6264122dead8df8f8374666878c0ac19de1592290dd87722dc83e385f5a51dc7c7605837f4701b9a95b6ad939a876a4d3555b10b63d064e4b1a3be75220a0fca7e17448fe41fb889551c2ebec6f133800e81827334287b029441b15d1d2576a415b253bb36f055ac6025bb498cd0dc71cf0ebf4e51c5c423f8f90e79a7dfdf35473c0b8e53b670d7232e02275e602e57c99215368002dbab578b8a00ffe07abcdef40a1a71857d31366debb88fd8081ba3a4f8effa4d552c17e38c2715542cd7769ccec7b0d5451968863621cb47096a467672052c6d2b1025e65dfd00ca0734c0f569ddcd7cd741cbc7bbce1d7f7223f99284dc5bcdf0bd6da5c30eca466532b464e709e37df6a5d13992378b1182b0f7f369bb898183be3c1eb6c6c0ec14f12f956096ddffb53a7a49e21798d855536edc6ab9bff784549dab91d7fe8d47b2d1b49a914ec6ae0031622170458fe94b56dd32cde27c095fd6e8477706753f855c2c3798c466ef81141f206253858801c79ef3060afbf0e506762441b33f76eaab34e3e3016da55e580be262fa73a6f3b9dece99037299e450f0109c117737441f1c31cd568b7a551b9cc9480e41d5adbe47b6ed57eabc59b23e5a9a8fcf2ccc228ae61bc34a471f93c082a1eee1dce8303352ca15ec5ceb67b4936b6c7522b74ece49d6f1d4422a32fca5c4338de5dd38983aa84f0fa0210cd81756e4fe50a4f71e91f23d75bb8d473dd5e7a691953a3836ea9537baac5dcd11e87d0809cba703f82c247b19b0148826720b68a63d8a6a943032aeecc357014ac96650d7d8759a116a4f5df1f3aea91b657beadbec6da3f598b814512cf81ae7a7b5f569ff5bbf790b1da6b1fb8cd43d40b047b28f1daaee4545713b89bc14f7951617715d4f622fc6e7761686869bb419ced91d7cac406c3047c3765267020681046d0a3e150b0e6ea2a8cc0beef07fbee78d44f735c5918f65f5c19e1e96ccf9e67d74f5eb600202fdddad872c8f7d87e77b6c40ebcad1d937d1877e4008923a3a81be1714244bc1a68086c3700979ebf1cb8adcec5963f4c9d9dd8f99a5cd0d95a4be3ac4d142b2ac2dbc40e69ee890973eed0a0449e00e8c4f8291c370c364eb3bd3691bc7070e9b6a8cc414d40343b3b41174022d75fd5891a629e60ad61382c57fdb0e8fd471fdaf862e8f1ecd18d6e5d30bc2181efdc61d4eaf51446c1a2fc2500e90c28b0f8c361af70e31bd2f22d7882ae74f1924849f2a70379b8b0411ac5ca3bea31b85133526660405f71f3dfe7cd4bc2bcce976ef0a7b24323d8c085c10c05e50eafd8f0e717683c92376c684564594f24dcc511eb21bd2d747e6b55cccda53520d2a43cce552a22db73f4d6c0576bd8a53181de9ce929d92a3bf3b16e256fc20bec4daa586e5c65beaf534be28b1d0f2e2d4c5291a6b14702a15fd68f2deec088b314b5554329b367f150be77a5be91c98200a86ea160314e98310665bb92c8f2ffbc1d696923594036543dd08cba94f19c11487c7683bc9676ea038e6c8c2c0674cff3cd3d06cd2a09a5700bb4d1396ba7cb10d4fa73b6726140dd54677f2e0aa013b4bc8dbe69f1a43c0c1678a46d7ad104736d268c4201a2a273c933f3eef7b4daf9e4f4ef85e1d966cb7e9d70e42e34e33f0087d775ecf6d6005c6f26edd860c3778e2a9143fa7a976d4387e6443f99311d03b69917b70d97c3083a1f50e0d5b73131a3ef00018083e77dbda8531a7429b8f569177a9b2dd56beb944d8ed514a9e2470553e41ac728858939e975850f69850f7edf7dcdcef624efc4dccdf61858d8125096b842f01a3426038a47d87e1271cf362d96820558270dd65cbfb2f85fdb81e069570acd10e8ca747840e5867cd5944d6aac7ce4df701f42cefe500c041ab4b4771a5a5592a3b15d31226b53126ccbc7d7639e0464f053b802e5649669a7d4e264623f7cd42fadf4ab1d2ef3650bddd9c4ca9f4057f942a73514de6488ac3fae73cc763ddee38a0955ca4dcc3df45c82549ce71906bdc92f866e2c4e0fdba2e979c346796433301990a7ddb5c19861843fd7049c76bd6e2d940ff5375c93cd7399b4e9a93b0f46b7af11e3281fa9d8351ca7b0439b48b1b9a8d90c6ba87c1f55aa77eb8f0cbc383757095c6d82998af94976bcdb4cea918e1ff8255d00509d77bb71b43a373b89481300aabb2a43fad07d0a37ad45e601cb38aa1a7dbae1c7f958080977dc187f79af01f033d7fcc4abba9492fd7e7f0d3936832d3330d444f1b2285cd02fc1fb3c52fc2b9d5e96c066fb79bcb92c22d09f1db9d6800868b0f57a3f55eec2dc961249cb67653fd8483414b3fb71823aeb40bd9e1cea11ce7500330501f37d2886fd3c26b0f0ad0423c26a0a4260406d5016355b3f1dc00a3163507fa68c8912729a69f115f75ee3d6169fec248756b99aaf479b48f0697e2520ed307c41a98c36139b0fe1f9aac9b959b69b578b1d044239a5a6c6be22049dc7bafe81170e19e6229ed60ef0aba803f6ca966dc18f692b5f24306a20e410c41b3d43f15449907278d35e91567b0307378e727f4cfe3f76a999f4d561ec5be6e9d17f8abb95c3a4aa1f521f4336b04bde73f436dee3c7adcc07841599161e02188fd55cbb8208b8f7afbb9396b93f53236e80f753f41e85d70a4815847671e7561f3d6ad7ee52255ae7f537e8f1d79edd8bfd44ad16d0b2f2d1fbc4c740c1b9b28b1e800b594dae6381a22599c0a61be0adb0e9e1639d6a54fb8d32b50a62b99bddc560d503f1ca8139a1ae52898cd109c7ef830a7cddca7580ce887f9f32c63a78df68f9b604ad46cc768fadfc4758eaeb8c70d43beb346b27797469a5ea782d262cd8366fa80e9704f37303b27f87f264a11787d5d8486c90ca241dcb4e927dba1110d2f5c083bb0601e52cb8469503f341e06811b8be0688c896ede94877a0eb781cba5b44f726ba7d1df50ac490039181c22503467d4c842cbec7bf5506f5555e84439b1bfe04d664f19833a0174c8e4cb0a9a61496d8efd41993e756b70f9423ba2f8e7d6799d7b4033fc77141656157ebb0bdef1e5d050273f2cab9d1f7e6957420c6964961f4c12e9cc4056c73461e1cff8a6687e4e7aed6556e0497ce080a8018a25ed9bc51272b914bcbc8b4159a7f8cf7d491e73b0f21b7ba3a814c481cde46e613ef1340e833c757e767dbed7350eb33a1456ae5e960a17b72488befec80eefcc1e97091d869216ec9ade238688c19a3bfbe44f34410330ee4e2d8710a2ea1994873b25ea6c18301a2643169df98678b8f70cb574ff24fabde668234708389f447cb", 0x1000) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000040)) 01:04:07 executing program 1: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) accept4$nfc_llcp(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x60, 0x0) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000000)=0x8419, 0x4) 01:04:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async, rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async, rerun: 32) recvfrom$packet(r2, &(0x7f0000000140)=""/133, 0x85, 0x40010041, &(0x7f0000000080)={0x11, 0x16, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (rerun: 32) 01:04:07 executing program 2: ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(0xffffffffffffffff, 0x40045731, &(0x7f0000000000)=0x9) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:07 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x9, &(0x7f00000001c0)=[{0x5, 0x51, 0x4, 0x7}, {0x401, 0x7f, 0x1, 0x8}, {0xa, 0x0, 0x4, 0x401}, {0x800, 0x1, 0x3}, {0x9167, 0x2, 0x1, 0xffff}, {0x83, 0xd8, 0x9}, {0xc33, 0x5, 0x7, 0x8}, {0x2, 0x1, 0x3f, 0x2}, {0x1df, 0x90, 0x0, 0xfffffffa}]}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x9, 0x1f, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000240)={0x0, 0xea60}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) pipe2$watch_queue(&(0x7f0000000080), 0x80) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) write$ppp(0xffffffffffffffff, &(0x7f0000000100)="3da1743450b43b1d875ece93b85316ad70235ae5dc5a2323ea438154fa0727be602688e474b113d0819fb206f875c7e61ea8f277ddaa5423afd0670590f59790673b0b98bef9804016705fa4ce74ada6d1aac3e616569c0e06530b715ef45dae9aa9da23360cbc2621fe2de83bf10d056f241665dfeb05c8bd3e7041e4d4618ebdd306d9219c86f0a2cb2257293ce853f5bfe667a38f8d9a8658333e718deb65b73018f80a43a4e6a1a7c49e3a0bed5e4d95912585dd3430ce0f58c56c348375221e9b3ae225ad4515b7620757ee3befc21ff5ad6f1f88ebbcd749c73c805893d8a3abb07c5913671b9634cc8ae88ef239a2c801a6f81a4aec7f4001f93c658f40d0f9761ed81fe13056ae6cff419d80abc955065add53b107994952de161eaf86b79aaba6ba0a340bf70518358e0936cb3bb6ae02ed35952af09c9a6b0e14e42bc6d127626ba63e7a076e19f06f2e6523e05745787e9261c2fae1321b31d52c882586b033e51d8b74aee85d6dcb25a4f0592d8711ad438468578e778f9bf58316f5896cfe81f4f9908e0cbe19f9175a27b2e20a68b466c259d9a68152e57501a497f0a830c91965661ede044bebefd98e4949710b5f57f8ad2390705367cf60f22f04a9508ad443d6ac13d4622af5e3c8b4798b6dc8e3099d7e2a7b0ca7978d6ccd9c9a87533b4bbffd4c047ba76119a45a32471c3e2e3c8b525f0b9bf8e4d134b119515a6508594fb6a112f4b95e5c6b29c05fc397bc816a6b5f2c1325935a3dae4fea1a8cb61250d96e551dea2c7cd00a448a679b36356027dde94a1904cb0d694e8782b4e80b9d41145cd75702a4e8dd7cf1bba05a41f4f977fd95977e6c079815a8fab39c1abf918d9a8632df464fe20b620a560908cef502e264958a86cb783da238257dc5241a5e87ec5781142b086d671652a4a4caf8939cb4b1897e95334aa104e8f47c33b87e74f6ff8c46ac677d06fecdd720b971903df9a9998983686c7f7dc88679f7da0ccb62616c3f850895e4945552918146eef7a8c4b9b2b6ce8e9a27f4b886d4c0d554b7f5fa8d4d53343f2a15edc1a4f33cbd92670c184abc533d8bc025cfe44ff09a1688573267c5d69f2e8e95d669a87b0d46782f807a0663a28571ddd239cd73b71b4f155579325cbf0aa27873e999a0aad6767e051f7bbbc1e47b0251cc94f467d2d80c3d6dd56bf4809dfed48bdd420e983de64375e2539bcada818a97a266773e321729355c9e70864e65a3b309e36cb0a4e165fdea8eb11d158b14ffd40e38706dcc56c1812740906ebaa8b5c0b5c995013baddbfc30cfd2bd911eab3812830ce216ad5fed78c220974ab67715eb99a6cb2c146c3218b1ec1c584ccea1cefe081e4d89e2b0ef7e2dc14cefd085529c6658e482350e759465884fe31f8e0507f1bf1ee06499d9f64f8eb712607b41283a2cf79e243dfc6509447a53df82f788a881409b61932e5f9ce3b8d2f374c04402e6e94a616b6e272902d26b837c7cde383c5bf735f391d16a697a7b5163487f5eb3dd822216cde31245ed3770369d1b513790226052c3d7ff12b88ea42c9f9060b6a940ee8726c65a88f64e8b2cf037c8f699516c36421732875cecf6f6cf799dd18c54d88547b9fc3d60b57d215f0157dd21b16f4275f64d534beb3cdcbd58517538d9bf0f09aaf4787958eaca1c8c2198a6238a58eeeb6f2cfe85182336a71a8b4f1d4675967376bcb1094805af72cc85117cf777942208f5242741d184329493a51902205228a3aa8670092f0d3ff3e86c108ba2758ce70a2c19dbb32bbab87b3eb414af3adddf430bebcbdef03828c673a306a243fb33e16534c470bff131410ac304ce13ac27235cafadff4022a56f256e53f750027c7c9454b2727424a2f1ee11c5c38eb9c523ef4f3b27b8007458402ad65756f8f8ff06912aacf32f835e50dadfb38f4e9724e29cde95c6b619b7e81006c5265554ef5f60f6063937aff7771458d0d9c788105a95ba6aaeebc9b32606873444515c74b04a4e1dcc3577d5e3412d2a0359714fa51780314490315db2a6af2b048947f34d04352dd9b5ca07db1c05def3b9c6f1b796287e9a74d932b4847ae4e51cc1db6065132b716017adea0f678528b238930a24fb5009f5a060e9669a2961e3965e533c31bef9a2412e95480dbc7148497829d852ed36379ccf289ea18c715b7529fa8200b777960354dbdfd51e532f178c2d33d6936ec80f7fcbed74f44c406e74122d35009ba77a8af25b7dc88cb68bcb5fb4e2b87965e4c1d253ab9ebadd487d354fca7d4ff22c6bf76467d2bc5f3c7353e61422359cb0c4f9b16d0d122c324ff7d5119ed9c99d02014a7c75ec4f58275ae2dc72e572730aeead08eaa14430038babf902e90c9ea635491d541757964aac2080ec391d6c07f84393f002036b29de49441fc1a447db9ea12dd5f15e113e41d8302664a1ab6459485247f6264122dead8df8f8374666878c0ac19de1592290dd87722dc83e385f5a51dc7c7605837f4701b9a95b6ad939a876a4d3555b10b63d064e4b1a3be75220a0fca7e17448fe41fb889551c2ebec6f133800e81827334287b029441b15d1d2576a415b253bb36f055ac6025bb498cd0dc71cf0ebf4e51c5c423f8f90e79a7dfdf35473c0b8e53b670d7232e02275e602e57c99215368002dbab578b8a00ffe07abcdef40a1a71857d31366debb88fd8081ba3a4f8effa4d552c17e38c2715542cd7769ccec7b0d5451968863621cb47096a467672052c6d2b1025e65dfd00ca0734c0f569ddcd7cd741cbc7bbce1d7f7223f99284dc5bcdf0bd6da5c30eca466532b464e709e37df6a5d13992378b1182b0f7f369bb898183be3c1eb6c6c0ec14f12f956096ddffb53a7a49e21798d855536edc6ab9bff784549dab91d7fe8d47b2d1b49a914ec6ae0031622170458fe94b56dd32cde27c095fd6e8477706753f855c2c3798c466ef81141f206253858801c79ef3060afbf0e506762441b33f76eaab34e3e3016da55e580be262fa73a6f3b9dece99037299e450f0109c117737441f1c31cd568b7a551b9cc9480e41d5adbe47b6ed57eabc59b23e5a9a8fcf2ccc228ae61bc34a471f93c082a1eee1dce8303352ca15ec5ceb67b4936b6c7522b74ece49d6f1d4422a32fca5c4338de5dd38983aa84f0fa0210cd81756e4fe50a4f71e91f23d75bb8d473dd5e7a691953a3836ea9537baac5dcd11e87d0809cba703f82c247b19b0148826720b68a63d8a6a943032aeecc357014ac96650d7d8759a116a4f5df1f3aea91b657beadbec6da3f598b814512cf81ae7a7b5f569ff5bbf790b1da6b1fb8cd43d40b047b28f1daaee4545713b89bc14f7951617715d4f622fc6e7761686869bb419ced91d7cac406c3047c3765267020681046d0a3e150b0e6ea2a8cc0beef07fbee78d44f735c5918f65f5c19e1e96ccf9e67d74f5eb600202fdddad872c8f7d87e77b6c40ebcad1d937d1877e4008923a3a81be1714244bc1a68086c3700979ebf1cb8adcec5963f4c9d9dd8f99a5cd0d95a4be3ac4d142b2ac2dbc40e69ee890973eed0a0449e00e8c4f8291c370c364eb3bd3691bc7070e9b6a8cc414d40343b3b41174022d75fd5891a629e60ad61382c57fdb0e8fd471fdaf862e8f1ecd18d6e5d30bc2181efdc61d4eaf51446c1a2fc2500e90c28b0f8c361af70e31bd2f22d7882ae74f1924849f2a70379b8b0411ac5ca3bea31b85133526660405f71f3dfe7cd4bc2bcce976ef0a7b24323d8c085c10c05e50eafd8f0e717683c92376c684564594f24dcc511eb21bd2d747e6b55cccda53520d2a43cce552a22db73f4d6c0576bd8a53181de9ce929d92a3bf3b16e256fc20bec4daa586e5c65beaf534be28b1d0f2e2d4c5291a6b14702a15fd68f2deec088b314b5554329b367f150be77a5be91c98200a86ea160314e98310665bb92c8f2ffbc1d696923594036543dd08cba94f19c11487c7683bc9676ea038e6c8c2c0674cff3cd3d06cd2a09a5700bb4d1396ba7cb10d4fa73b6726140dd54677f2e0aa013b4bc8dbe69f1a43c0c1678a46d7ad104736d268c4201a2a273c933f3eef7b4daf9e4f4ef85e1d966cb7e9d70e42e34e33f0087d775ecf6d6005c6f26edd860c3778e2a9143fa7a976d4387e6443f99311d03b69917b70d97c3083a1f50e0d5b73131a3ef00018083e77dbda8531a7429b8f569177a9b2dd56beb944d8ed514a9e2470553e41ac728858939e975850f69850f7edf7dcdcef624efc4dccdf61858d8125096b842f01a3426038a47d87e1271cf362d96820558270dd65cbfb2f85fdb81e069570acd10e8ca747840e5867cd5944d6aac7ce4df701f42cefe500c041ab4b4771a5a5592a3b15d31226b53126ccbc7d7639e0464f053b802e5649669a7d4e264623f7cd42fadf4ab1d2ef3650bddd9c4ca9f4057f942a73514de6488ac3fae73cc763ddee38a0955ca4dcc3df45c82549ce71906bdc92f866e2c4e0fdba2e979c346796433301990a7ddb5c19861843fd7049c76bd6e2d940ff5375c93cd7399b4e9a93b0f46b7af11e3281fa9d8351ca7b0439b48b1b9a8d90c6ba87c1f55aa77eb8f0cbc383757095c6d82998af94976bcdb4cea918e1ff8255d00509d77bb71b43a373b89481300aabb2a43fad07d0a37ad45e601cb38aa1a7dbae1c7f958080977dc187f79af01f033d7fcc4abba9492fd7e7f0d3936832d3330d444f1b2285cd02fc1fb3c52fc2b9d5e96c066fb79bcb92c22d09f1db9d6800868b0f57a3f55eec2dc961249cb67653fd8483414b3fb71823aeb40bd9e1cea11ce7500330501f37d2886fd3c26b0f0ad0423c26a0a4260406d5016355b3f1dc00a3163507fa68c8912729a69f115f75ee3d6169fec248756b99aaf479b48f0697e2520ed307c41a98c36139b0fe1f9aac9b959b69b578b1d044239a5a6c6be22049dc7bafe81170e19e6229ed60ef0aba803f6ca966dc18f692b5f24306a20e410c41b3d43f15449907278d35e91567b0307378e727f4cfe3f76a999f4d561ec5be6e9d17f8abb95c3a4aa1f521f4336b04bde73f436dee3c7adcc07841599161e02188fd55cbb8208b8f7afbb9396b93f53236e80f753f41e85d70a4815847671e7561f3d6ad7ee52255ae7f537e8f1d79edd8bfd44ad16d0b2f2d1fbc4c740c1b9b28b1e800b594dae6381a22599c0a61be0adb0e9e1639d6a54fb8d32b50a62b99bddc560d503f1ca8139a1ae52898cd109c7ef830a7cddca7580ce887f9f32c63a78df68f9b604ad46cc768fadfc4758eaeb8c70d43beb346b27797469a5ea782d262cd8366fa80e9704f37303b27f87f264a11787d5d8486c90ca241dcb4e927dba1110d2f5c083bb0601e52cb8469503f341e06811b8be0688c896ede94877a0eb781cba5b44f726ba7d1df50ac490039181c22503467d4c842cbec7bf5506f5555e84439b1bfe04d664f19833a0174c8e4cb0a9a61496d8efd41993e756b70f9423ba2f8e7d6799d7b4033fc77141656157ebb0bdef1e5d050273f2cab9d1f7e6957420c6964961f4c12e9cc4056c73461e1cff8a6687e4e7aed6556e0497ce080a8018a25ed9bc51272b914bcbc8b4159a7f8cf7d491e73b0f21b7ba3a814c481cde46e613ef1340e833c757e767dbed7350eb33a1456ae5e960a17b72488befec80eefcc1e97091d869216ec9ade238688c19a3bfbe44f34410330ee4e2d8710a2ea1994873b25ea6c18301a2643169df98678b8f70cb574ff24fabde668234708389f447cb", 0x1000) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) write$ppp(0xffffffffffffffff, &(0x7f0000000100)="3da1743450b43b1d875ece93b85316ad70235ae5dc5a2323ea438154fa0727be602688e474b113d0819fb206f875c7e61ea8f277ddaa5423afd0670590f59790673b0b98bef9804016705fa4ce74ada6d1aac3e616569c0e06530b715ef45dae9aa9da23360cbc2621fe2de83bf10d056f241665dfeb05c8bd3e7041e4d4618ebdd306d9219c86f0a2cb2257293ce853f5bfe667a38f8d9a8658333e718deb65b73018f80a43a4e6a1a7c49e3a0bed5e4d95912585dd3430ce0f58c56c348375221e9b3ae225ad4515b7620757ee3befc21ff5ad6f1f88ebbcd749c73c805893d8a3abb07c5913671b9634cc8ae88ef239a2c801a6f81a4aec7f4001f93c658f40d0f9761ed81fe13056ae6cff419d80abc955065add53b107994952de161eaf86b79aaba6ba0a340bf70518358e0936cb3bb6ae02ed35952af09c9a6b0e14e42bc6d127626ba63e7a076e19f06f2e6523e05745787e9261c2fae1321b31d52c882586b033e51d8b74aee85d6dcb25a4f0592d8711ad438468578e778f9bf58316f5896cfe81f4f9908e0cbe19f9175a27b2e20a68b466c259d9a68152e57501a497f0a830c91965661ede044bebefd98e4949710b5f57f8ad2390705367cf60f22f04a9508ad443d6ac13d4622af5e3c8b4798b6dc8e3099d7e2a7b0ca7978d6ccd9c9a87533b4bbffd4c047ba76119a45a32471c3e2e3c8b525f0b9bf8e4d134b119515a6508594fb6a112f4b95e5c6b29c05fc397bc816a6b5f2c1325935a3dae4fea1a8cb61250d96e551dea2c7cd00a448a679b36356027dde94a1904cb0d694e8782b4e80b9d41145cd75702a4e8dd7cf1bba05a41f4f977fd95977e6c079815a8fab39c1abf918d9a8632df464fe20b620a560908cef502e264958a86cb783da238257dc5241a5e87ec5781142b086d671652a4a4caf8939cb4b1897e95334aa104e8f47c33b87e74f6ff8c46ac677d06fecdd720b971903df9a9998983686c7f7dc88679f7da0ccb62616c3f850895e4945552918146eef7a8c4b9b2b6ce8e9a27f4b886d4c0d554b7f5fa8d4d53343f2a15edc1a4f33cbd92670c184abc533d8bc025cfe44ff09a1688573267c5d69f2e8e95d669a87b0d46782f807a0663a28571ddd239cd73b71b4f155579325cbf0aa27873e999a0aad6767e051f7bbbc1e47b0251cc94f467d2d80c3d6dd56bf4809dfed48bdd420e983de64375e2539bcada818a97a266773e321729355c9e70864e65a3b309e36cb0a4e165fdea8eb11d158b14ffd40e38706dcc56c1812740906ebaa8b5c0b5c995013baddbfc30cfd2bd911eab3812830ce216ad5fed78c220974ab67715eb99a6cb2c146c3218b1ec1c584ccea1cefe081e4d89e2b0ef7e2dc14cefd085529c6658e482350e759465884fe31f8e0507f1bf1ee06499d9f64f8eb712607b41283a2cf79e243dfc6509447a53df82f788a881409b61932e5f9ce3b8d2f374c04402e6e94a616b6e272902d26b837c7cde383c5bf735f391d16a697a7b5163487f5eb3dd822216cde31245ed3770369d1b513790226052c3d7ff12b88ea42c9f9060b6a940ee8726c65a88f64e8b2cf037c8f699516c36421732875cecf6f6cf799dd18c54d88547b9fc3d60b57d215f0157dd21b16f4275f64d534beb3cdcbd58517538d9bf0f09aaf4787958eaca1c8c2198a6238a58eeeb6f2cfe85182336a71a8b4f1d4675967376bcb1094805af72cc85117cf777942208f5242741d184329493a51902205228a3aa8670092f0d3ff3e86c108ba2758ce70a2c19dbb32bbab87b3eb414af3adddf430bebcbdef03828c673a306a243fb33e16534c470bff131410ac304ce13ac27235cafadff4022a56f256e53f750027c7c9454b2727424a2f1ee11c5c38eb9c523ef4f3b27b8007458402ad65756f8f8ff06912aacf32f835e50dadfb38f4e9724e29cde95c6b619b7e81006c5265554ef5f60f6063937aff7771458d0d9c788105a95ba6aaeebc9b32606873444515c74b04a4e1dcc3577d5e3412d2a0359714fa51780314490315db2a6af2b048947f34d04352dd9b5ca07db1c05def3b9c6f1b796287e9a74d932b4847ae4e51cc1db6065132b716017adea0f678528b238930a24fb5009f5a060e9669a2961e3965e533c31bef9a2412e95480dbc7148497829d852ed36379ccf289ea18c715b7529fa8200b777960354dbdfd51e532f178c2d33d6936ec80f7fcbed74f44c406e74122d35009ba77a8af25b7dc88cb68bcb5fb4e2b87965e4c1d253ab9ebadd487d354fca7d4ff22c6bf76467d2bc5f3c7353e61422359cb0c4f9b16d0d122c324ff7d5119ed9c99d02014a7c75ec4f58275ae2dc72e572730aeead08eaa14430038babf902e90c9ea635491d541757964aac2080ec391d6c07f84393f002036b29de49441fc1a447db9ea12dd5f15e113e41d8302664a1ab6459485247f6264122dead8df8f8374666878c0ac19de1592290dd87722dc83e385f5a51dc7c7605837f4701b9a95b6ad939a876a4d3555b10b63d064e4b1a3be75220a0fca7e17448fe41fb889551c2ebec6f133800e81827334287b029441b15d1d2576a415b253bb36f055ac6025bb498cd0dc71cf0ebf4e51c5c423f8f90e79a7dfdf35473c0b8e53b670d7232e02275e602e57c99215368002dbab578b8a00ffe07abcdef40a1a71857d31366debb88fd8081ba3a4f8effa4d552c17e38c2715542cd7769ccec7b0d5451968863621cb47096a467672052c6d2b1025e65dfd00ca0734c0f569ddcd7cd741cbc7bbce1d7f7223f99284dc5bcdf0bd6da5c30eca466532b464e709e37df6a5d13992378b1182b0f7f369bb898183be3c1eb6c6c0ec14f12f956096ddffb53a7a49e21798d855536edc6ab9bff784549dab91d7fe8d47b2d1b49a914ec6ae0031622170458fe94b56dd32cde27c095fd6e8477706753f855c2c3798c466ef81141f206253858801c79ef3060afbf0e506762441b33f76eaab34e3e3016da55e580be262fa73a6f3b9dece99037299e450f0109c117737441f1c31cd568b7a551b9cc9480e41d5adbe47b6ed57eabc59b23e5a9a8fcf2ccc228ae61bc34a471f93c082a1eee1dce8303352ca15ec5ceb67b4936b6c7522b74ece49d6f1d4422a32fca5c4338de5dd38983aa84f0fa0210cd81756e4fe50a4f71e91f23d75bb8d473dd5e7a691953a3836ea9537baac5dcd11e87d0809cba703f82c247b19b0148826720b68a63d8a6a943032aeecc357014ac96650d7d8759a116a4f5df1f3aea91b657beadbec6da3f598b814512cf81ae7a7b5f569ff5bbf790b1da6b1fb8cd43d40b047b28f1daaee4545713b89bc14f7951617715d4f622fc6e7761686869bb419ced91d7cac406c3047c3765267020681046d0a3e150b0e6ea2a8cc0beef07fbee78d44f735c5918f65f5c19e1e96ccf9e67d74f5eb600202fdddad872c8f7d87e77b6c40ebcad1d937d1877e4008923a3a81be1714244bc1a68086c3700979ebf1cb8adcec5963f4c9d9dd8f99a5cd0d95a4be3ac4d142b2ac2dbc40e69ee890973eed0a0449e00e8c4f8291c370c364eb3bd3691bc7070e9b6a8cc414d40343b3b41174022d75fd5891a629e60ad61382c57fdb0e8fd471fdaf862e8f1ecd18d6e5d30bc2181efdc61d4eaf51446c1a2fc2500e90c28b0f8c361af70e31bd2f22d7882ae74f1924849f2a70379b8b0411ac5ca3bea31b85133526660405f71f3dfe7cd4bc2bcce976ef0a7b24323d8c085c10c05e50eafd8f0e717683c92376c684564594f24dcc511eb21bd2d747e6b55cccda53520d2a43cce552a22db73f4d6c0576bd8a53181de9ce929d92a3bf3b16e256fc20bec4daa586e5c65beaf534be28b1d0f2e2d4c5291a6b14702a15fd68f2deec088b314b5554329b367f150be77a5be91c98200a86ea160314e98310665bb92c8f2ffbc1d696923594036543dd08cba94f19c11487c7683bc9676ea038e6c8c2c0674cff3cd3d06cd2a09a5700bb4d1396ba7cb10d4fa73b6726140dd54677f2e0aa013b4bc8dbe69f1a43c0c1678a46d7ad104736d268c4201a2a273c933f3eef7b4daf9e4f4ef85e1d966cb7e9d70e42e34e33f0087d775ecf6d6005c6f26edd860c3778e2a9143fa7a976d4387e6443f99311d03b69917b70d97c3083a1f50e0d5b73131a3ef00018083e77dbda8531a7429b8f569177a9b2dd56beb944d8ed514a9e2470553e41ac728858939e975850f69850f7edf7dcdcef624efc4dccdf61858d8125096b842f01a3426038a47d87e1271cf362d96820558270dd65cbfb2f85fdb81e069570acd10e8ca747840e5867cd5944d6aac7ce4df701f42cefe500c041ab4b4771a5a5592a3b15d31226b53126ccbc7d7639e0464f053b802e5649669a7d4e264623f7cd42fadf4ab1d2ef3650bddd9c4ca9f4057f942a73514de6488ac3fae73cc763ddee38a0955ca4dcc3df45c82549ce71906bdc92f866e2c4e0fdba2e979c346796433301990a7ddb5c19861843fd7049c76bd6e2d940ff5375c93cd7399b4e9a93b0f46b7af11e3281fa9d8351ca7b0439b48b1b9a8d90c6ba87c1f55aa77eb8f0cbc383757095c6d82998af94976bcdb4cea918e1ff8255d00509d77bb71b43a373b89481300aabb2a43fad07d0a37ad45e601cb38aa1a7dbae1c7f958080977dc187f79af01f033d7fcc4abba9492fd7e7f0d3936832d3330d444f1b2285cd02fc1fb3c52fc2b9d5e96c066fb79bcb92c22d09f1db9d6800868b0f57a3f55eec2dc961249cb67653fd8483414b3fb71823aeb40bd9e1cea11ce7500330501f37d2886fd3c26b0f0ad0423c26a0a4260406d5016355b3f1dc00a3163507fa68c8912729a69f115f75ee3d6169fec248756b99aaf479b48f0697e2520ed307c41a98c36139b0fe1f9aac9b959b69b578b1d044239a5a6c6be22049dc7bafe81170e19e6229ed60ef0aba803f6ca966dc18f692b5f24306a20e410c41b3d43f15449907278d35e91567b0307378e727f4cfe3f76a999f4d561ec5be6e9d17f8abb95c3a4aa1f521f4336b04bde73f436dee3c7adcc07841599161e02188fd55cbb8208b8f7afbb9396b93f53236e80f753f41e85d70a4815847671e7561f3d6ad7ee52255ae7f537e8f1d79edd8bfd44ad16d0b2f2d1fbc4c740c1b9b28b1e800b594dae6381a22599c0a61be0adb0e9e1639d6a54fb8d32b50a62b99bddc560d503f1ca8139a1ae52898cd109c7ef830a7cddca7580ce887f9f32c63a78df68f9b604ad46cc768fadfc4758eaeb8c70d43beb346b27797469a5ea782d262cd8366fa80e9704f37303b27f87f264a11787d5d8486c90ca241dcb4e927dba1110d2f5c083bb0601e52cb8469503f341e06811b8be0688c896ede94877a0eb781cba5b44f726ba7d1df50ac490039181c22503467d4c842cbec7bf5506f5555e84439b1bfe04d664f19833a0174c8e4cb0a9a61496d8efd41993e756b70f9423ba2f8e7d6799d7b4033fc77141656157ebb0bdef1e5d050273f2cab9d1f7e6957420c6964961f4c12e9cc4056c73461e1cff8a6687e4e7aed6556e0497ce080a8018a25ed9bc51272b914bcbc8b4159a7f8cf7d491e73b0f21b7ba3a814c481cde46e613ef1340e833c757e767dbed7350eb33a1456ae5e960a17b72488befec80eefcc1e97091d869216ec9ade238688c19a3bfbe44f34410330ee4e2d8710a2ea1994873b25ea6c18301a2643169df98678b8f70cb574ff24fabde668234708389f447cb", 0x1000) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000040)) (async) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x18000000, 0x5}, 0x48) 01:04:07 executing program 1: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) accept4$nfc_llcp(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x60, 0x0) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000000)=0x8419, 0x4) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) (async) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) accept4$nfc_llcp(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x60, 0x0) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000000)=0x8419, 0x4) (async) 01:04:07 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x9, &(0x7f00000001c0)=[{0x5, 0x51, 0x4, 0x7}, {0x401, 0x7f, 0x1, 0x8}, {0xa, 0x0, 0x4, 0x401}, {0x800, 0x1, 0x3}, {0x9167, 0x2, 0x1, 0xffff}, {0x83, 0xd8, 0x9}, {0xc33, 0x5, 0x7, 0x8}, {0x2, 0x1, 0x3f, 0x2}, {0x1df, 0x90, 0x0, 0xfffffffa}]}) (async, rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async, rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x9, 0x1f, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async, rerun: 32) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000240)={0x0, 0xea60}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) pipe2$watch_queue(&(0x7f0000000080), 0x80) 01:04:07 executing program 2: ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(0xffffffffffffffff, 0x40045731, &(0x7f0000000000)=0x9) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) recvfrom$packet(r2, &(0x7f0000000140)=""/133, 0x85, 0x40010041, &(0x7f0000000080)={0x11, 0x16, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5}, 0x48) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000100)={'ip_vti0\x00', r1, 0x720, 0xa6, 0x1000, 0x7, {{0x2f, 0x4, 0x3, 0x27, 0xbc, 0x66, 0x0, 0x3f, 0x29, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x13, [@multicast2]}, @rr={0x7, 0x1f, 0xf3, [@multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @loopback]}, @cipso={0x86, 0x22, 0x3, [{0x0, 0x6, "700cf5d3"}, {0x0, 0xe, "8cc4ce268700b19b8f0b18e8"}, {0x5, 0x8, "340403018fcf"}]}, @rr={0x7, 0x23, 0xf9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @empty, @remote]}, @timestamp_prespec={0x44, 0x3c, 0x66, 0x3, 0x6, [{@private=0xa010101, 0x7f}, {@loopback, 0x8}, {@loopback, 0x1}, {@local, 0x8}, {@multicast2, 0xfffffffa}, {@dev={0xac, 0x14, 0x14, 0x39}, 0x9}, {@loopback, 0x7fffffff}]}]}}}}}) 01:04:07 executing program 1: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) accept4$nfc_llcp(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x60, 0x0) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000000)=0x8419, 0x4) 01:04:07 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x9, &(0x7f00000001c0)=[{0x5, 0x51, 0x4, 0x7}, {0x401, 0x7f, 0x1, 0x8}, {0xa, 0x0, 0x4, 0x401}, {0x800, 0x1, 0x3}, {0x9167, 0x2, 0x1, 0xffff}, {0x83, 0xd8, 0x9}, {0xc33, 0x5, 0x7, 0x8}, {0x2, 0x1, 0x3f, 0x2}, {0x1df, 0x90, 0x0, 0xfffffffa}]}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x9, 0x1f, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000240)={0x0, 0xea60}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) pipe2$watch_queue(&(0x7f0000000080), 0x80) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x9, &(0x7f00000001c0)=[{0x5, 0x51, 0x4, 0x7}, {0x401, 0x7f, 0x1, 0x8}, {0xa, 0x0, 0x4, 0x401}, {0x800, 0x1, 0x3}, {0x9167, 0x2, 0x1, 0xffff}, {0x83, 0xd8, 0x9}, {0xc33, 0x5, 0x7, 0x8}, {0x2, 0x1, 0x3f, 0x2}, {0x1df, 0x90, 0x0, 0xfffffffa}]}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x9, 0x1f, 0x9}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r3}) (async) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000240)={0x0, 0xea60}, 0x10) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r3}) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) 01:04:07 executing program 2: socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r1, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x101}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0xd1}, 0x4000004) 01:04:07 executing program 5: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000240), 0xbccb, 0x80200) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000280)={r2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000040)={r2}) r4 = socket$rxrpc(0x21, 0x2, 0x2) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000380)={0x80, 0x0, 0xd2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000003c0)={r6}) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3) recvfrom$rxrpc(r4, &(0x7f0000000140)=""/186, 0xba, 0x10100, &(0x7f0000000200)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @remote}}, 0x24) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8001, 0x5}) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r7, 0x54a1) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000002c0), 0x106, 0x3}}, 0x20) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x2}, 0x48) 01:04:07 executing program 2: socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r1, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x101}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0xd1}, 0x4000004) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000100)={'ip_vti0\x00', r1, 0x720, 0xa6, 0x1000, 0x7, {{0x2f, 0x4, 0x3, 0x27, 0xbc, 0x66, 0x0, 0x3f, 0x29, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x13, [@multicast2]}, @rr={0x7, 0x1f, 0xf3, [@multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @loopback]}, @cipso={0x86, 0x22, 0x3, [{0x0, 0x6, "700cf5d3"}, {0x0, 0xe, "8cc4ce268700b19b8f0b18e8"}, {0x5, 0x8, "340403018fcf"}]}, @rr={0x7, 0x23, 0xf9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @empty, @remote]}, @timestamp_prespec={0x44, 0x3c, 0x66, 0x3, 0x6, [{@private=0xa010101, 0x7f}, {@loopback, 0x8}, {@loopback, 0x1}, {@local, 0x8}, {@multicast2, 0xfffffffa}, {@dev={0xac, 0x14, 0x14, 0x39}, 0x9}, {@loopback, 0x7fffffff}]}]}}}}}) 01:04:07 executing program 1: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x7f, 0x9, 0xa, 0x0, 0x1, 0x40000008, '\x00', r0, r1, 0x5, 0x3, 0x4, 0x4}, 0x48) 01:04:07 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r1, 0x205, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0xc60420469be4d5c8) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0xffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x5, 0x97, 0x0, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) bind$bt_hci(r2, &(0x7f00000002c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) 01:04:07 executing program 5: syz_open_dev$tty20(0xc, 0x4, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000240), 0xbccb, 0x80200) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000280)={r2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000040)={r2}) (async) r4 = socket$rxrpc(0x21, 0x2, 0x2) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000380)={0x80, 0x0, 0xd2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000003c0)={r6}) (async) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3) (async) recvfrom$rxrpc(r4, &(0x7f0000000140)=""/186, 0xba, 0x10100, &(0x7f0000000200)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @remote}}, 0x24) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8001, 0x5}) (async) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r7, 0x54a1) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000002c0), 0x106, 0x3}}, 0x20) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x3}, 0x48) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000100)={'ip_vti0\x00', r1, 0x720, 0xa6, 0x1000, 0x7, {{0x2f, 0x4, 0x3, 0x27, 0xbc, 0x66, 0x0, 0x3f, 0x29, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x13, [@multicast2]}, @rr={0x7, 0x1f, 0xf3, [@multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @loopback]}, @cipso={0x86, 0x22, 0x3, [{0x0, 0x6, "700cf5d3"}, {0x0, 0xe, "8cc4ce268700b19b8f0b18e8"}, {0x5, 0x8, "340403018fcf"}]}, @rr={0x7, 0x23, 0xf9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @empty, @remote]}, @timestamp_prespec={0x44, 0x3c, 0x66, 0x3, 0x6, [{@private=0xa010101, 0x7f}, {@loopback, 0x8}, {@loopback, 0x1}, {@local, 0x8}, {@multicast2, 0xfffffffa}, {@dev={0xac, 0x14, 0x14, 0x39}, 0x9}, {@loopback, 0x7fffffff}]}]}}}}}) 01:04:07 executing program 2: socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async, rerun: 32) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r1, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x101}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0xd1}, 0x4000004) 01:04:07 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r1, 0x205, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0xc60420469be4d5c8) (async) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r1, 0x205, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0xc60420469be4d5c8) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) socket$inet6_udplite(0xa, 0x2, 0x88) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0xffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x5, 0x97, 0x0, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000340), 0x80) (async) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) bind$bt_hci(r2, &(0x7f00000002c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x9, 0x400, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xb}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$TUNGETDEVNETNS(r2, 0x54e3, 0x0) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x2, 0x10, 0x20, 0x2, 0x2, 0x0, 0x70bf2b, 0x25dfdbfc}, 0x10}}, 0x24000000) ioctl$PPPIOCDISCONN(r0, 0x7439) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000000)) 01:04:07 executing program 1: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x7f, 0x9, 0xa, 0x0, 0x1, 0x40000008, '\x00', r0, r1, 0x5, 0x3, 0x4, 0x4}, 0x48) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x4}, 0x48) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x9, 0x400, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xb}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x9, 0x400, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xb}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$TUNGETDEVNETNS(r2, 0x54e3, 0x0) (async) ioctl$TUNGETDEVNETNS(r2, 0x54e3, 0x0) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x2, 0x10, 0x20, 0x2, 0x2, 0x0, 0x70bf2b, 0x25dfdbfc}, 0x10}}, 0x24000000) ioctl$PPPIOCDISCONN(r0, 0x7439) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000000)) 01:04:07 executing program 5: syz_open_dev$tty20(0xc, 0x4, 0x0) (async, rerun: 32) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (rerun: 32) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r3 = syz_open_dev$dri(&(0x7f0000000240), 0xbccb, 0x80200) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000280)={r2}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000040)={r2}) (async) r4 = socket$rxrpc(0x21, 0x2, 0x2) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000380)={0x80, 0x0, 0xd2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000003c0)={r6}) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3) (async) recvfrom$rxrpc(r4, &(0x7f0000000140)=""/186, 0xba, 0x10100, &(0x7f0000000200)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @remote}}, 0x24) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8001, 0x5}) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r7, 0x54a1) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000002c0), 0x106, 0x3}}, 0x20) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) 01:04:07 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a53663653e3ae7baf6b554279cfa043d56e34a70300628fe12ef22d813725d656a0ae0ad7c344bf700"/180, @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x0, 0x5, 0x2, @private2, @mcast1, 0x7800, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8000, 0x0, 0x8, 0x20d6, 0xffffffffffffffff, 0x2, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x4}, 0x48) socket$inet6_udp(0xa, 0x2, 0x0) 01:04:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x4, 0x9, 0x400, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xb}, 0x48) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$TUNGETDEVNETNS(r2, 0x54e3, 0x0) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x2, 0x10, 0x20, 0x2, 0x2, 0x0, 0x70bf2b, 0x25dfdbfc}, 0x10}}, 0x24000000) ioctl$PPPIOCDISCONN(r0, 0x7439) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000000)) 01:04:07 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r1, 0x205, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0xc60420469be4d5c8) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0xffff}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x5, 0x97, 0x0, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) bind$bt_hci(r2, &(0x7f00000002c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) 01:04:07 executing program 1: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x7f, 0x9, 0xa, 0x0, 0x1, 0x40000008, '\x00', r0, r1, 0x5, 0x3, 0x4, 0x4}, 0x48) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x5}, 0x48) 01:04:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) pipe2$watch_queue(&(0x7f0000000140), 0x80) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x7, '\rN7', 0x9, 0x20}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x6}, 0x48) 01:04:07 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:07 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a53663653e3ae7baf6b554279cfa043d56e34a70300628fe12ef22d813725d656a0ae0ad7c344bf700"/180, @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x0, 0x5, 0x2, @private2, @mcast1, 0x7800, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8000, 0x0, 0x8, 0x20d6, 0xffffffffffffffff, 0x2, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x4}, 0x48) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a53663653e3ae7baf6b554279cfa043d56e34a70300628fe12ef22d813725d656a0ae0ad7c344bf700"/180, @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x0, 0x5, 0x2, @private2, @mcast1, 0x7800, 0x0, 0x7, 0x6}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8000, 0x0, 0x8, 0x20d6, 0xffffffffffffffff, 0x2, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x4}, 0x48) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) 01:04:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x7, '\rN7', 0x9, 0x20}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:07 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xb, 0x0, 0x6, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)) 01:04:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x7, '\rN7', 0x9, 0x20}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:07 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xa, 0x9, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x93, 0x0, 0x0, 0x0, 0x401}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @jmp={0x5, 0x1, 0xb, 0xa, 0x0, 0x0, 0xfffffffffffffff0}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x7}, @generic={0x9, 0x3, 0x0, 0x0, 0x5}]}, &(0x7f0000000380)='syzkaller\x00', 0x489, 0xe6, &(0x7f00000003c0)=""/230, 0x41000, 0x3, '\x00', 0x0, 0x23, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000500)={0x3, 0xd, 0x7ff, 0x5}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000540)=[r0]}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x9, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf0}, [@generic={0x7, 0xc, 0xa, 0x400, 0x7fffffff}, @map_fd={0x18, 0x4, 0x1, 0x0, r0}, @generic={0x2, 0x2, 0x2, 0x8, 0xfffffffe}, @map_val={0x18, 0x2, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000100)='GPL\x00', 0x5, 0x5f, &(0x7f0000000140)=""/95, 0x41100, 0x24, '\x00', r1, 0x16, r2, 0x8, &(0x7f0000000280)={0x2, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0x9, 0x101}, 0x10, 0xffffffffffffffff, r3}, 0x80) 01:04:07 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x7}, 0x48) 01:04:08 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:08 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xb, 0x0, 0x6, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)) 01:04:08 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xa, 0x9, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x93, 0x0, 0x0, 0x0, 0x401}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @jmp={0x5, 0x1, 0xb, 0xa, 0x0, 0x0, 0xfffffffffffffff0}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x7}, @generic={0x9, 0x3, 0x0, 0x0, 0x5}]}, &(0x7f0000000380)='syzkaller\x00', 0x489, 0xe6, &(0x7f00000003c0)=""/230, 0x41000, 0x3, '\x00', 0x0, 0x23, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000500)={0x3, 0xd, 0x7ff, 0x5}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000540)=[r0]}, 0x80) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xa, 0x9, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x93, 0x0, 0x0, 0x0, 0x401}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @jmp={0x5, 0x1, 0xb, 0xa, 0x0, 0x0, 0xfffffffffffffff0}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x7}, @generic={0x9, 0x3, 0x0, 0x0, 0x5}]}, &(0x7f0000000380)='syzkaller\x00', 0x489, 0xe6, &(0x7f00000003c0)=""/230, 0x41000, 0x3, '\x00', 0x0, 0x23, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000500)={0x3, 0xd, 0x7ff, 0x5}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000540)=[r0]}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x9, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf0}, [@generic={0x7, 0xc, 0xa, 0x400, 0x7fffffff}, @map_fd={0x18, 0x4, 0x1, 0x0, r0}, @generic={0x2, 0x2, 0x2, 0x8, 0xfffffffe}, @map_val={0x18, 0x2, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000100)='GPL\x00', 0x5, 0x5f, &(0x7f0000000140)=""/95, 0x41100, 0x24, '\x00', r1, 0x16, r2, 0x8, &(0x7f0000000280)={0x2, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0x9, 0x101}, 0x10, 0xffffffffffffffff, r3}, 0x80) 01:04:08 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a53663653e3ae7baf6b554279cfa043d56e34a70300628fe12ef22d813725d656a0ae0ad7c344bf700"/180, @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x0, 0x5, 0x2, @private2, @mcast1, 0x7800, 0x0, 0x7, 0x6}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8000, 0x0, 0x8, 0x20d6, 0xffffffffffffffff, 0x2, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x4}, 0x48) (async) socket$inet6_udp(0xa, 0x2, 0x0) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x8}, 0x48) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r4}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x84) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x2, 0xae, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xb, 0x0, 0x6, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)) 01:04:08 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xa, 0x9, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x93, 0x0, 0x0, 0x0, 0x401}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @jmp={0x5, 0x1, 0xb, 0xa, 0x0, 0x0, 0xfffffffffffffff0}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x7}, @generic={0x9, 0x3, 0x0, 0x0, 0x5}]}, &(0x7f0000000380)='syzkaller\x00', 0x489, 0xe6, &(0x7f00000003c0)=""/230, 0x41000, 0x3, '\x00', 0x0, 0x23, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000500)={0x3, 0xd, 0x7ff, 0x5}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000540)=[r0]}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x9, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf0}, [@generic={0x7, 0xc, 0xa, 0x400, 0x7fffffff}, @map_fd={0x18, 0x4, 0x1, 0x0, r0}, @generic={0x2, 0x2, 0x2, 0x8, 0xfffffffe}, @map_val={0x18, 0x2, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000100)='GPL\x00', 0x5, 0x5f, &(0x7f0000000140)=""/95, 0x41100, 0x24, '\x00', r1, 0x16, r2, 0x8, &(0x7f0000000280)={0x2, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0x9, 0x101}, 0x10, 0xffffffffffffffff, r3}, 0x80) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x9}, 0x48) 01:04:08 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:08 executing program 1: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x29, 0x2, 0x4, 0x210f, 0x42, @mcast2, @local, 0x7800, 0x7800, 0x3caf, 0x1}}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0xf3d, 0x6, 0x1, 0xa00, 0xffffffffffffffff, 0x3, '\x00', r0, 0xffffffffffffffff, 0x1, 0x1, 0x5, 0x9}, 0x48) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff441018000000000900d833ed77d361793b153edb0000030000001f94040000442405037f0000010000ffff000014aa00000001ac1414aa00000007ac14143f0000038d"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r5) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x14, 0x101, 0x1556, 0xb, 0x500, r1, 0x6, '\x00', r3, r4, 0x0, 0x1, 0x3}, 0x48) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r4}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x84) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x2, 0xae, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xa}, 0x48) 01:04:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x800, 0x1}, 0x48) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x5fe, 0x4) 01:04:08 executing program 2: write$tun(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000700000000000000ffffffffff81001300278b63cc59fb3ccf4367da1c9e2026abda74cbc207bead282e0c399c2d966400ead38339e831c10775162bd92cae06e2a15c5804fc450663cd65d40695869b9528b4d73357e653f63ca6d6f24726c96e599f42a104a4b248"], 0x1b) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000040)=0x650, 0x4) 01:04:08 executing program 1: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x29, 0x2, 0x4, 0x210f, 0x42, @mcast2, @local, 0x7800, 0x7800, 0x3caf, 0x1}}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0xf3d, 0x6, 0x1, 0xa00, 0xffffffffffffffff, 0x3, '\x00', r0, 0xffffffffffffffff, 0x1, 0x1, 0x5, 0x9}, 0x48) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff441018000000000900d833ed77d361793b153edb0000030000001f94040000442405037f0000010000ffff000014aa00000001ac1414aa00000007ac14143f0000038d"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async, rerun: 32) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r5) (async) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x14, 0x101, 0x1556, 0xb, 0x500, r1, 0x6, '\x00', r3, r4, 0x0, 0x1, 0x3}, 0x48) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xb}, 0x48) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r4}) (async) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x84) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x2, 0xae, 0x1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x800, 0x1}, 0x48) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x5fe, 0x4) 01:04:08 executing program 2: write$tun(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000700000000000000ffffffffff81001300278b63cc59fb3ccf4367da1c9e2026abda74cbc207bead282e0c399c2d966400ead38339e831c10775162bd92cae06e2a15c5804fc450663cd65d40695869b9528b4d73357e653f63ca6d6f24726c96e599f42a104a4b248"], 0x1b) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000040)=0x650, 0x4) write$tun(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000700000000000000ffffffffff81001300278b63cc59fb3ccf4367da1c9e2026abda74cbc207bead282e0c399c2d966400ead38339e831c10775162bd92cae06e2a15c5804fc450663cd65d40695869b9528b4d73357e653f63ca6d6f24726c96e599f42a104a4b248"], 0x1b) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000040)=0x650, 0x4) (async) 01:04:08 executing program 3: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$nfc_llcp(r0, 0x118, 0x0, 0x0, 0x7fffffffefff) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x3bb40ecc, 0x800, 0x5}) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000080)=0x7fff, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xc}, 0x48) 01:04:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x3, 0x80000000, 0x800, 0x1}, 0x48) (async) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x5fe, 0x4) 01:04:08 executing program 1: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x29, 0x2, 0x4, 0x210f, 0x42, @mcast2, @local, 0x7800, 0x7800, 0x3caf, 0x1}}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0xf3d, 0x6, 0x1, 0xa00, 0xffffffffffffffff, 0x3, '\x00', r0, 0xffffffffffffffff, 0x1, 0x1, 0x5, 0x9}, 0x48) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff441018000000000900d833ed77d361793b153edb0000030000001f94040000442405037f0000010000ffff000014aa00000001ac1414aa00000007ac14143f0000038d"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r3, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r5) (async) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x14, 0x101, 0x1556, 0xb, 0x500, r1, 0x6, '\x00', r3, r4, 0x0, 0x1, 0x3}, 0x48) 01:04:08 executing program 3: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$nfc_llcp(r0, 0x118, 0x0, 0x0, 0x7fffffffefff) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x3bb40ecc, 0x800, 0x5}) (async) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000080)=0x7fff, 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xd}, 0x48) 01:04:08 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:08 executing program 2: write$tun(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000700000000000000ffffffffff81001300278b63cc59fb3ccf4367da1c9e2026abda74cbc207bead282e0c399c2d966400ead38339e831c10775162bd92cae06e2a15c5804fc450663cd65d40695869b9528b4d73357e653f63ca6d6f24726c96e599f42a104a4b248"], 0x1b) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000040)=0x650, 0x4) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x424c00) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 3: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$nfc_llcp(r0, 0x118, 0x0, 0x0, 0x7fffffffefff) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x3bb40ecc, 0x800, 0x5}) (async) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000080)=0x7fff, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:08 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000240), 0x101000) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x1, 0x1, 0x100}) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14, 0x80000) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) r10 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r10, 0x110, 0x3) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000580)=ANY=[]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r9, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r12, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r13, @ANYBLOB="0100000000000000000008000000050022ff07000000c5cad74c31ae7b519c798037d7503857b8db8a4612f131185196c8fdaf574f39de7d879d4604105693b0f400468669593ddebf9c77b46d7ea69c5abff87107389cacea88b95d8355c6f3004c894cdfb26e9fc7bdbcd02eb868de987010e95d7f242f5f0678af8f767e14920b3b3433f6ea56af45db2cf5072777f9e9dc1e5b3c197764b6c51d5de3caef953abbd5e1627c2d31e1589f9e892f4f841d7ba2e2b1058f5e41b2f761153203bd85fd823f139a63"], 0x1c}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x6c, r13, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x3ff}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv_slave_0\x00'}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'ip_vti0\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x4) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f00000002c0)={r9, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}, 0x10) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f0000000280)) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000200)=@req3={0x401, 0xeb80000, 0x8, 0x6, 0x7fffffff, 0x1, 0x80000001}, 0x1c) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}}, 0x10) ioctl$PPPIOCSNPMODE(r6, 0x4008744b, &(0x7f0000000400)={0xc025, 0x1}) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xe}, 0x48) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x424c00) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) 01:04:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socket$inet6_udplite(0xa, 0x2, 0x88) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$ppp(r0, &(0x7f0000000100)="3738fcaa8d3988a59296155e308af99e303d278fd4a814a542b9db5a4f97ee7ee1bab648d6002a9f7cd7b6a3cc3f22aba2720efb31adcac894fddeb90328eb4670d08e0dcfbe40b7e9698500eff60b8b2b4dc693165f7431e2a4b8bfe400a9f8bf16b4a9d59a5b17858bc5a1aa313a187a5275f543bba44b85e386dec9f111ace81acdef26f02356e624f328015f2535a5da65449a2c2fe91091d78753dec03e13d3db289fb5d15ab8e71ac73c7314dcecb80f0eda0398d1c97dd29f7a59c1b28568349b2ec54e04fe94e04e80b029e3c7e89908f4c925371080a7ef2b5ad509803c7b450f9ef0106d596e0901af873c1d2808cb538185a7a0785e2ca23b3a9d418fab888f8e0fea92052667628d4516a10bf434882f2ae6d82c7904e4c8d25ece1169b8a6184115e9ea4ba3efa0044fd24c1e3ba3b27e7a731a2cdd40c743250d9fcab9bd429d002c6f0ae6b921b17f4c69e0f2c54ac0fc82df82eb15d831e7f921492da62d62a1a7285a67da316649befbe12e3386ec8d6cf0c6f5bbae4e8fa067a7869d12c368b7c85fca74da09f6260fc15a5bf867f9dc57d9fe87ec6723cb254342c649d316036b1b5a23139a7a213b08d616caa82144e7b3456c4c7877a946b34c5459befb21d948b6d2eb68522183f73cc85fe8e5f21ad5c289a7009ab20a50742593e94be2ebf472b232198332af49b5e23d345410582cf242eae14843933f33a47f2f8b8a41d5b6319e8141000ff57f8e2414ab80bbbafd9bb973980cddb2cb26cf56f45532cbbca5e96d84a6c8897b99be93dc764f0e1601cde72da8ee4eb088333212d97070444a3d78eb8239550b6c3b1c4105b8bbfcaa611ce9b748136e2b4ef05292983db3760f76622420b11ed5bbd3a55a8282aafec8b048047543b82f5e25696523939235dd59f001ae63d83467da5765968263f3602079c6b51c90189baf50636157c9f59378937092b859a23b7ab6babb2aff5acc0c5a91d5e5de7072e22dad09895d76a765f2ca1e3bf707f9a544dea7b712a7e497516def721e2cebb5cf09e643d621aedca574174feaa0547cfaddba73475173712c560ed8e86ab397ed3b2a1f686556c7cd0153a11a373c51f9085ce14f10f25007a934aa2445dd29133f600a3baec49c3b80a6e6a6944c066774fd22f7177bf3eec1220e981989ce0135e5580fc689090556b0b9a1320edbd28a379c138085dab97b2ec1e4997b25ae472c201e8aef78bef4ac7c9b9e5635c87e0c9c227c496d45748ed8573616d0bd90a526724a0317839422b0e66aaed899839200d45a7803668fcc67201bd26706c7707c3b85a4df6ce2a7a7e2dad898322fe64d6da1277a71b4bac05f8605dc22de15230430c116ca55720319645d004f1d74ff440bc436055a71a5d809cb615c0d3e722cecb0dabe602e49cd1694e59226e3e4cac389d2a8cbb75a1534736a8065f814965beced92685fe4efb212d5dcd5ef708cb5ddce7013b59ff673f63772d25112b33b7844728aa07172832ec21b2e142293e3ae5f4f46d11a0b397e97e9536970d52a30fe259d0ad7f0d54edede5961d79bfaa7d24d9996e45d21619a651460eecdb102c6dac971ae4f08ae26a56a0129bcd7fd88849ba777a36bf44b8afb4ac9420ce9ce140dfe097216caf3470c9ebc273f3230c071e3d3391a9cc0b109f4d74b11d264869fe4d7d45c37136cbe836d279da18d97b5f515d230ca2b2bca6d99c37c18899f9266d8951a5aaa36a461c021cde00a1a3f992b33778ac76672b107342265b538b4bd49da3fe323c7f38fa1658d0d29a0737cbf6269c6e448f37dacda5e3b1c433a8411fc50ae2a253c90f76e6367467e684d3d5561943f83e65e4ce7341ad0988e4fada6ef183a161a8a63b998d2c9b162fcbf9e5e39fdcc0171ea4442c054d46695bbba60b67975a3c6b1c1489b5c553476f341a46d3b1a0979ca3cf1c174d3a03bb01b99735aa2c1f5afffbf02096f0f7395f32c32c26505743dd8807439092b814d0cf0715cc0871d41e0bdffd78f361c9723fce5cb292d65ae82b1483886702a850547f56f4be9a60757d0ec8ce0b560c9714f81e55a98dea1f716156082433291b3296593a9386790150dea5dfe2e6abd0faceb173adbcbd30a25e5639e3df08096e150234af8728561ad26cb44041bde64aca7e9ea386fcb26096d7a0b471b5f993b02f8132e40eb4e01d8add1fefae398012cd0093b5f95283079329cf16c67a2b362e35df7e6a358ab6b202a093428b672517548548cb65069729129dfaccad53243cb23afe63cadcd15681f8bc0abef2eca36df6db75c0dad352ec4b41966a5537a4a110979067f1ac03188893f312312d1e52df4d4a9eb770475941080e61821ee4df17a28082087e0c37fda458d878b885baf2af7f26b10bc25759a0e0c6c71dac4258b0501a8298396d11c5487a667e25b83abd873b95a97c7555163b0d2207627505cc29a79f59f9afb29bbd6fca874ef8ff401a99cfedbfe6bfc38ddd4d9a03324d997f2123d55a5d482102a9b33a2022d3fcfbd973311ac6b29dcef3a9bbf13a86ea59769c8970430015ded8f64662ec380c70467668b783f37d790fef2ab63756afb8163093a9372351c9fdf2c7ac8560efe1bc6bd61a3d4e8530e689a951968d7f5f2445d931305a69f0f349c168bbea15cc09ae8e958a3a39dbdfb9e59f0726f6526c075f4b49612f26ec83a93fd306f55603a99eb58c0d836e6213b4ce700b7588d41be41b5d890cf1e44511eba4f63646c4ae0dcb42a159500ed3d04fdfe76dcb93b076d1259ec8d4fb1daadf4cd9f5542f2699e57370ccc702119c2841c785bd733bb6406d7c9e757dd04e3dc2dc4999a1bed2ea8c57d77c8c66d043577ac35e2679bd66b3587935bd9b9a4c9608a871aa45b75dc16ff07167291a2edebd346278e84bff261ccf24d3fbc811aac87109cad7f281a4862921117f5f810662b11dd1252c389a7aaf5e63dea09e63f403e06a6496dd9d162b6b2812f50c5c0c89460c8ec89a6a8f0c7b7bb0f848052d8a31cfcb1d89e5b2005394a379529b9ff8caac27396ba569e8735be286f622cd2058d5639a890a5027995212a1ef0f51613ad0ca6ba1562f401ed5973b0953b8c6ea8f7b44f6a95845ba550871c426a369f11395f48fb40ebc0852fb874e36ab6d3e967703531c7725233a32b24befe47a5d45cb39a27e0763ef082f2ffef79f022464f3831f81757afff78cb51d45655ccb922fcb0ae820b0afe534ec9b45f6f9fa1f324c04b06439400cdb47dca54658b304428f247f96b86ad7d54ec2598c447ff82254b1443c57dc46eb6e3d1766e2289924c19244404388fb98ce5870468d5addcee502f86df87c9c0dd1d2ebfd6335044fcef425be28d51e523317d0490862b93da98f5cf84e001537b232ceef76f0ce593b608a0b80e959eb16558aa8103f4114decd5f22d2e85276a8be5cc2753689791cd1ac6c2a158c19bf275fef331d96b6d498efeb5026987ee8d196c317fb2068ac75511349390416713dbe3c7f63afa23b8ec9fdda8bc2488a9e753d0dd935f5b25cb43b9e01a6e3629552e53a7e06e470b5b00175d602bcfdaffa7d17e630490ee0989e776f4519786a138bac21699feb0dbc3180bf83c574bc72a3b28daa860361a37939345db7ba94b69aaa87e99e37f2953c6dba7c73fd9089ef39c7bbbe62c22de2a1c5ac8519210960f093e76c0f4dfa2bbccfffdbdc15c343a4b3c49b25986b6193b618265a77eb847f1d8acb9d8054162f8ffe388101d504ab814af53ccfac1c2d21fbdd595cfb4fe941d8b0eaeff6a33c9258a96c1cb83bb5f1546d5d69380e7146c703150ca260a2efab2046a9e7d7d7522881160b33d9353f9c5f413f27ec56dbd790b6edff10f4e7b63de292275176ddec7d791cdda7072b9ae91de0e8a261266e494ead5b9585e34cc07eccbcebc4e02448d271e6b4201b486285d6e4f0104b6d3dc64158c157a761854fb838de48dc77c6edaf1d7d7ccfc76e2faf1c6839d3bb0b03bb67efd258f4bdd91fd8c8ac737710039a7920f7e0431340a60a092b65e9ac72f52f9c03aebb3ecde437a8d2a95251a26e86662c92c3a276f77eaacba204dc67220cbd4db3e6109fe60ca4a1a0915002ffbe4437735009e01d270c8107654cfaea9e2984a3a3afb680fbf3e8641d6a1a60b3ed688266aa532f203a3c283b26f1ec63459693b0397045d7308b0d44a8d5f10a15a5b72f6a147c5800acf5b46ba8f6543c4bee7d45ee9e3765ec7c0399d385dd7601c330f19e6c9db83ac0b8f2c2f3b4ede6483069a67d03cb9ac3ad1707ab6fd0dc1f5c59a21b38d7015109e370226119d1b6d22d0b75c24526b8ba561f5d1470bc78001dfa90cb82175cf2e8f4abdb9ce12c71f2ece99ce6e3fc2c35a988e875c9184eb71a9d5b76da4356d9a5568fb39efed4c3c8f0a77fdf2e22e74c6d62478243e7ba1f6672bf1827c2dacbc5ea32979632aeb02328ff6a5f678998e9c5cf4af839e972436f35d90f584bf4b98a58cc111187fc854994c6fd8b62dd84c9c7e130520661e463adb984f9268b23c1b4814ffe75f84d5aed0a2bf4173cc53007f95b2ed5d1eba76ae693339f10b17589332082ccfa78828790ab2e356d8e0affbd96e3aa059aba5497e8595ce6dec5c6c7da742bd1850fda5a937a250f8b3f7adf3ab59dd2de7b851251c6b223ba1c12b0873fa30389e3002939e22feea40b96597e16236c236229110e5971340e7e195862b5e2a021f2326ff3ca6bf5c242e2b87c058fe3d58c0e1d52457ad2f52e6e5905d8bd73c7892056fe9c295b8c1aafded7616aaabde0c7cb4c6bf938a53ec9eef3c937625844cb8b9feea079e93367025f04524dcc9b62d3156a7b3500c9a8184fb613095b0c0ba9401f5be66dda72491f24523e068e750ab0a9fe580d20dd669c6f2ffaa99d46571be6ab951199fe5744e2656d66e8169f0f085b3949828dbbdf6bcecbde80591b87f3469edf05bcfc833a62da2185038ef5e8191ffba78fa36136aa3b018ea2c8a55273cdaacc3e493e84c75b01cf4bf295ba7c1172c0c60e9f7425d3aa1ef68266faaca33dcfb1c9efe1541f5b9a9ff5dd958b1642d04774d6b404c193995e9524982d0711847fdc9964544f4dea3d0328e69d6fbab0292af8d5abfcf7a116c1ba794d1642c5fa8da56f8ad8ac9e8a7160d20c5bbca5ec66a1047ce06cf3177085927b565d15eb41ff01c3d83dea5c187e78e35c557624937451e13beaa38f6eff4b04041d7692b056f6c0a054c1e65f0029b4a2662179712dd2fd52e5766d932da7e66bca44b3215e567e866d58a56e19e6b2618f54219489e39298965642760688a134ff08cd75f5c8ee022b14695863c3e7f01937c1ce1e1b26e823b65c010a58c59de9c388bff567988e9eaf4837b1dbdd979f6f4d7e37a47d14a5fed967e6acf731517aca213d7556018b14f589c5f61b6e18b6f2e24cacebcca1e32b4b2413030911429dde6880b99f7bf83136fe817f0bccd84c5a50c535e95f1844d07d5df6189f359f63d086b88a687cb378986c9cf732558671cd586314cbbcc7b45380c0b05742ff6a7cc460a042960415c9f6d689c4667e5e07d1b1e5ca704a4fe2da7eb59f382ea098f445b6c7e8c0d1a47a2df9228bcf9899147a88297528d4fb398540cd15f050e2988dab43ad41a9ff26e09b9a9433a6ea95c8d6cb28d4355cca509ba4e6567098dc316f23f92957d071cdb20ea7111d3c08d2391e36cdb977cfaa55da9b70d0f270592d7698b", 0x1000) 01:04:08 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x5, 0x400, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000240), 0x101000) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) (async) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x1, 0x1, 0x100}) (async) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14, 0x80000) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) r10 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r10, 0x110, 0x3) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000580)=ANY=[]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r9, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) (async) r13 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r12, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r13, @ANYBLOB="0100000000000000000008000000050022ff07000000c5cad74c31ae7b519c798037d7503857b8db8a4612f131185196c8fdaf574f39de7d879d4604105693b0f400468669593ddebf9c77b46d7ea69c5abff87107389cacea88b95d8355c6f3004c894cdfb26e9fc7bdbcd02eb868de987010e95d7f242f5f0678af8f767e14920b3b3433f6ea56af45db2cf5072777f9e9dc1e5b3c197764b6c51d5de3caef953abbd5e1627c2d31e1589f9e892f4f841d7ba2e2b1058f5e41b2f761153203bd85fd823f139a63"], 0x1c}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x6c, r13, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x3ff}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv_slave_0\x00'}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'ip_vti0\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x4) (async) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f00000002c0)={r9, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}, 0x10) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f0000000280)) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000200)=@req3={0x401, 0xeb80000, 0x8, 0x6, 0x7fffffff, 0x1, 0x80000001}, 0x1c) (async) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}}, 0x10) (async) ioctl$PPPIOCSNPMODE(r6, 0x4008744b, &(0x7f0000000400)={0xc025, 0x1}) 01:04:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socket$inet6_udplite(0xa, 0x2, 0x88) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$ppp(r0, &(0x7f0000000100)="3738fcaa8d3988a59296155e308af99e303d278fd4a814a542b9db5a4f97ee7ee1bab648d6002a9f7cd7b6a3cc3f22aba2720efb31adcac894fddeb90328eb4670d08e0dcfbe40b7e9698500eff60b8b2b4dc693165f7431e2a4b8bfe400a9f8bf16b4a9d59a5b17858bc5a1aa313a187a5275f543bba44b85e386dec9f111ace81acdef26f02356e624f328015f2535a5da65449a2c2fe91091d78753dec03e13d3db289fb5d15ab8e71ac73c7314dcecb80f0eda0398d1c97dd29f7a59c1b28568349b2ec54e04fe94e04e80b029e3c7e89908f4c925371080a7ef2b5ad509803c7b450f9ef0106d596e0901af873c1d2808cb538185a7a0785e2ca23b3a9d418fab888f8e0fea92052667628d4516a10bf434882f2ae6d82c7904e4c8d25ece1169b8a6184115e9ea4ba3efa0044fd24c1e3ba3b27e7a731a2cdd40c743250d9fcab9bd429d002c6f0ae6b921b17f4c69e0f2c54ac0fc82df82eb15d831e7f921492da62d62a1a7285a67da316649befbe12e3386ec8d6cf0c6f5bbae4e8fa067a7869d12c368b7c85fca74da09f6260fc15a5bf867f9dc57d9fe87ec6723cb254342c649d316036b1b5a23139a7a213b08d616caa82144e7b3456c4c7877a946b34c5459befb21d948b6d2eb68522183f73cc85fe8e5f21ad5c289a7009ab20a50742593e94be2ebf472b232198332af49b5e23d345410582cf242eae14843933f33a47f2f8b8a41d5b6319e8141000ff57f8e2414ab80bbbafd9bb973980cddb2cb26cf56f45532cbbca5e96d84a6c8897b99be93dc764f0e1601cde72da8ee4eb088333212d97070444a3d78eb8239550b6c3b1c4105b8bbfcaa611ce9b748136e2b4ef05292983db3760f76622420b11ed5bbd3a55a8282aafec8b048047543b82f5e25696523939235dd59f001ae63d83467da5765968263f3602079c6b51c90189baf50636157c9f59378937092b859a23b7ab6babb2aff5acc0c5a91d5e5de7072e22dad09895d76a765f2ca1e3bf707f9a544dea7b712a7e497516def721e2cebb5cf09e643d621aedca574174feaa0547cfaddba73475173712c560ed8e86ab397ed3b2a1f686556c7cd0153a11a373c51f9085ce14f10f25007a934aa2445dd29133f600a3baec49c3b80a6e6a6944c066774fd22f7177bf3eec1220e981989ce0135e5580fc689090556b0b9a1320edbd28a379c138085dab97b2ec1e4997b25ae472c201e8aef78bef4ac7c9b9e5635c87e0c9c227c496d45748ed8573616d0bd90a526724a0317839422b0e66aaed899839200d45a7803668fcc67201bd26706c7707c3b85a4df6ce2a7a7e2dad898322fe64d6da1277a71b4bac05f8605dc22de15230430c116ca55720319645d004f1d74ff440bc436055a71a5d809cb615c0d3e722cecb0dabe602e49cd1694e59226e3e4cac389d2a8cbb75a1534736a8065f814965beced92685fe4efb212d5dcd5ef708cb5ddce7013b59ff673f63772d25112b33b7844728aa07172832ec21b2e142293e3ae5f4f46d11a0b397e97e9536970d52a30fe259d0ad7f0d54edede5961d79bfaa7d24d9996e45d21619a651460eecdb102c6dac971ae4f08ae26a56a0129bcd7fd88849ba777a36bf44b8afb4ac9420ce9ce140dfe097216caf3470c9ebc273f3230c071e3d3391a9cc0b109f4d74b11d264869fe4d7d45c37136cbe836d279da18d97b5f515d230ca2b2bca6d99c37c18899f9266d8951a5aaa36a461c021cde00a1a3f992b33778ac76672b107342265b538b4bd49da3fe323c7f38fa1658d0d29a0737cbf6269c6e448f37dacda5e3b1c433a8411fc50ae2a253c90f76e6367467e684d3d5561943f83e65e4ce7341ad0988e4fada6ef183a161a8a63b998d2c9b162fcbf9e5e39fdcc0171ea4442c054d46695bbba60b67975a3c6b1c1489b5c553476f341a46d3b1a0979ca3cf1c174d3a03bb01b99735aa2c1f5afffbf02096f0f7395f32c32c26505743dd8807439092b814d0cf0715cc0871d41e0bdffd78f361c9723fce5cb292d65ae82b1483886702a850547f56f4be9a60757d0ec8ce0b560c9714f81e55a98dea1f716156082433291b3296593a9386790150dea5dfe2e6abd0faceb173adbcbd30a25e5639e3df08096e150234af8728561ad26cb44041bde64aca7e9ea386fcb26096d7a0b471b5f993b02f8132e40eb4e01d8add1fefae398012cd0093b5f95283079329cf16c67a2b362e35df7e6a358ab6b202a093428b672517548548cb65069729129dfaccad53243cb23afe63cadcd15681f8bc0abef2eca36df6db75c0dad352ec4b41966a5537a4a110979067f1ac03188893f312312d1e52df4d4a9eb770475941080e61821ee4df17a28082087e0c37fda458d878b885baf2af7f26b10bc25759a0e0c6c71dac4258b0501a8298396d11c5487a667e25b83abd873b95a97c7555163b0d2207627505cc29a79f59f9afb29bbd6fca874ef8ff401a99cfedbfe6bfc38ddd4d9a03324d997f2123d55a5d482102a9b33a2022d3fcfbd973311ac6b29dcef3a9bbf13a86ea59769c8970430015ded8f64662ec380c70467668b783f37d790fef2ab63756afb8163093a9372351c9fdf2c7ac8560efe1bc6bd61a3d4e8530e689a951968d7f5f2445d931305a69f0f349c168bbea15cc09ae8e958a3a39dbdfb9e59f0726f6526c075f4b49612f26ec83a93fd306f55603a99eb58c0d836e6213b4ce700b7588d41be41b5d890cf1e44511eba4f63646c4ae0dcb42a159500ed3d04fdfe76dcb93b076d1259ec8d4fb1daadf4cd9f5542f2699e57370ccc702119c2841c785bd733bb6406d7c9e757dd04e3dc2dc4999a1bed2ea8c57d77c8c66d043577ac35e2679bd66b3587935bd9b9a4c9608a871aa45b75dc16ff07167291a2edebd346278e84bff261ccf24d3fbc811aac87109cad7f281a4862921117f5f810662b11dd1252c389a7aaf5e63dea09e63f403e06a6496dd9d162b6b2812f50c5c0c89460c8ec89a6a8f0c7b7bb0f848052d8a31cfcb1d89e5b2005394a379529b9ff8caac27396ba569e8735be286f622cd2058d5639a890a5027995212a1ef0f51613ad0ca6ba1562f401ed5973b0953b8c6ea8f7b44f6a95845ba550871c426a369f11395f48fb40ebc0852fb874e36ab6d3e967703531c7725233a32b24befe47a5d45cb39a27e0763ef082f2ffef79f022464f3831f81757afff78cb51d45655ccb922fcb0ae820b0afe534ec9b45f6f9fa1f324c04b06439400cdb47dca54658b304428f247f96b86ad7d54ec2598c447ff82254b1443c57dc46eb6e3d1766e2289924c19244404388fb98ce5870468d5addcee502f86df87c9c0dd1d2ebfd6335044fcef425be28d51e523317d0490862b93da98f5cf84e001537b232ceef76f0ce593b608a0b80e959eb16558aa8103f4114decd5f22d2e85276a8be5cc2753689791cd1ac6c2a158c19bf275fef331d96b6d498efeb5026987ee8d196c317fb2068ac75511349390416713dbe3c7f63afa23b8ec9fdda8bc2488a9e753d0dd935f5b25cb43b9e01a6e3629552e53a7e06e470b5b00175d602bcfdaffa7d17e630490ee0989e776f4519786a138bac21699feb0dbc3180bf83c574bc72a3b28daa860361a37939345db7ba94b69aaa87e99e37f2953c6dba7c73fd9089ef39c7bbbe62c22de2a1c5ac8519210960f093e76c0f4dfa2bbccfffdbdc15c343a4b3c49b25986b6193b618265a77eb847f1d8acb9d8054162f8ffe388101d504ab814af53ccfac1c2d21fbdd595cfb4fe941d8b0eaeff6a33c9258a96c1cb83bb5f1546d5d69380e7146c703150ca260a2efab2046a9e7d7d7522881160b33d9353f9c5f413f27ec56dbd790b6edff10f4e7b63de292275176ddec7d791cdda7072b9ae91de0e8a261266e494ead5b9585e34cc07eccbcebc4e02448d271e6b4201b486285d6e4f0104b6d3dc64158c157a761854fb838de48dc77c6edaf1d7d7ccfc76e2faf1c6839d3bb0b03bb67efd258f4bdd91fd8c8ac737710039a7920f7e0431340a60a092b65e9ac72f52f9c03aebb3ecde437a8d2a95251a26e86662c92c3a276f77eaacba204dc67220cbd4db3e6109fe60ca4a1a0915002ffbe4437735009e01d270c8107654cfaea9e2984a3a3afb680fbf3e8641d6a1a60b3ed688266aa532f203a3c283b26f1ec63459693b0397045d7308b0d44a8d5f10a15a5b72f6a147c5800acf5b46ba8f6543c4bee7d45ee9e3765ec7c0399d385dd7601c330f19e6c9db83ac0b8f2c2f3b4ede6483069a67d03cb9ac3ad1707ab6fd0dc1f5c59a21b38d7015109e370226119d1b6d22d0b75c24526b8ba561f5d1470bc78001dfa90cb82175cf2e8f4abdb9ce12c71f2ece99ce6e3fc2c35a988e875c9184eb71a9d5b76da4356d9a5568fb39efed4c3c8f0a77fdf2e22e74c6d62478243e7ba1f6672bf1827c2dacbc5ea32979632aeb02328ff6a5f678998e9c5cf4af839e972436f35d90f584bf4b98a58cc111187fc854994c6fd8b62dd84c9c7e130520661e463adb984f9268b23c1b4814ffe75f84d5aed0a2bf4173cc53007f95b2ed5d1eba76ae693339f10b17589332082ccfa78828790ab2e356d8e0affbd96e3aa059aba5497e8595ce6dec5c6c7da742bd1850fda5a937a250f8b3f7adf3ab59dd2de7b851251c6b223ba1c12b0873fa30389e3002939e22feea40b96597e16236c236229110e5971340e7e195862b5e2a021f2326ff3ca6bf5c242e2b87c058fe3d58c0e1d52457ad2f52e6e5905d8bd73c7892056fe9c295b8c1aafded7616aaabde0c7cb4c6bf938a53ec9eef3c937625844cb8b9feea079e93367025f04524dcc9b62d3156a7b3500c9a8184fb613095b0c0ba9401f5be66dda72491f24523e068e750ab0a9fe580d20dd669c6f2ffaa99d46571be6ab951199fe5744e2656d66e8169f0f085b3949828dbbdf6bcecbde80591b87f3469edf05bcfc833a62da2185038ef5e8191ffba78fa36136aa3b018ea2c8a55273cdaacc3e493e84c75b01cf4bf295ba7c1172c0c60e9f7425d3aa1ef68266faaca33dcfb1c9efe1541f5b9a9ff5dd958b1642d04774d6b404c193995e9524982d0711847fdc9964544f4dea3d0328e69d6fbab0292af8d5abfcf7a116c1ba794d1642c5fa8da56f8ad8ac9e8a7160d20c5bbca5ec66a1047ce06cf3177085927b565d15eb41ff01c3d83dea5c187e78e35c557624937451e13beaa38f6eff4b04041d7692b056f6c0a054c1e65f0029b4a2662179712dd2fd52e5766d932da7e66bca44b3215e567e866d58a56e19e6b2618f54219489e39298965642760688a134ff08cd75f5c8ee022b14695863c3e7f01937c1ce1e1b26e823b65c010a58c59de9c388bff567988e9eaf4837b1dbdd979f6f4d7e37a47d14a5fed967e6acf731517aca213d7556018b14f589c5f61b6e18b6f2e24cacebcca1e32b4b2413030911429dde6880b99f7bf83136fe817f0bccd84c5a50c535e95f1844d07d5df6189f359f63d086b88a687cb378986c9cf732558671cd586314cbbcc7b45380c0b05742ff6a7cc460a042960415c9f6d689c4667e5e07d1b1e5ca704a4fe2da7eb59f382ea098f445b6c7e8c0d1a47a2df9228bcf9899147a88297528d4fb398540cd15f050e2988dab43ad41a9ff26e09b9a9433a6ea95c8d6cb28d4355cca509ba4e6567098dc316f23f92957d071cdb20ea7111d3c08d2391e36cdb977cfaa55da9b70d0f270592d7698b", 0x1000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) write$ppp(r0, &(0x7f0000000100)="3738fcaa8d3988a59296155e308af99e303d278fd4a814a542b9db5a4f97ee7ee1bab648d6002a9f7cd7b6a3cc3f22aba2720efb31adcac894fddeb90328eb4670d08e0dcfbe40b7e9698500eff60b8b2b4dc693165f7431e2a4b8bfe400a9f8bf16b4a9d59a5b17858bc5a1aa313a187a5275f543bba44b85e386dec9f111ace81acdef26f02356e624f328015f2535a5da65449a2c2fe91091d78753dec03e13d3db289fb5d15ab8e71ac73c7314dcecb80f0eda0398d1c97dd29f7a59c1b28568349b2ec54e04fe94e04e80b029e3c7e89908f4c925371080a7ef2b5ad509803c7b450f9ef0106d596e0901af873c1d2808cb538185a7a0785e2ca23b3a9d418fab888f8e0fea92052667628d4516a10bf434882f2ae6d82c7904e4c8d25ece1169b8a6184115e9ea4ba3efa0044fd24c1e3ba3b27e7a731a2cdd40c743250d9fcab9bd429d002c6f0ae6b921b17f4c69e0f2c54ac0fc82df82eb15d831e7f921492da62d62a1a7285a67da316649befbe12e3386ec8d6cf0c6f5bbae4e8fa067a7869d12c368b7c85fca74da09f6260fc15a5bf867f9dc57d9fe87ec6723cb254342c649d316036b1b5a23139a7a213b08d616caa82144e7b3456c4c7877a946b34c5459befb21d948b6d2eb68522183f73cc85fe8e5f21ad5c289a7009ab20a50742593e94be2ebf472b232198332af49b5e23d345410582cf242eae14843933f33a47f2f8b8a41d5b6319e8141000ff57f8e2414ab80bbbafd9bb973980cddb2cb26cf56f45532cbbca5e96d84a6c8897b99be93dc764f0e1601cde72da8ee4eb088333212d97070444a3d78eb8239550b6c3b1c4105b8bbfcaa611ce9b748136e2b4ef05292983db3760f76622420b11ed5bbd3a55a8282aafec8b048047543b82f5e25696523939235dd59f001ae63d83467da5765968263f3602079c6b51c90189baf50636157c9f59378937092b859a23b7ab6babb2aff5acc0c5a91d5e5de7072e22dad09895d76a765f2ca1e3bf707f9a544dea7b712a7e497516def721e2cebb5cf09e643d621aedca574174feaa0547cfaddba73475173712c560ed8e86ab397ed3b2a1f686556c7cd0153a11a373c51f9085ce14f10f25007a934aa2445dd29133f600a3baec49c3b80a6e6a6944c066774fd22f7177bf3eec1220e981989ce0135e5580fc689090556b0b9a1320edbd28a379c138085dab97b2ec1e4997b25ae472c201e8aef78bef4ac7c9b9e5635c87e0c9c227c496d45748ed8573616d0bd90a526724a0317839422b0e66aaed899839200d45a7803668fcc67201bd26706c7707c3b85a4df6ce2a7a7e2dad898322fe64d6da1277a71b4bac05f8605dc22de15230430c116ca55720319645d004f1d74ff440bc436055a71a5d809cb615c0d3e722cecb0dabe602e49cd1694e59226e3e4cac389d2a8cbb75a1534736a8065f814965beced92685fe4efb212d5dcd5ef708cb5ddce7013b59ff673f63772d25112b33b7844728aa07172832ec21b2e142293e3ae5f4f46d11a0b397e97e9536970d52a30fe259d0ad7f0d54edede5961d79bfaa7d24d9996e45d21619a651460eecdb102c6dac971ae4f08ae26a56a0129bcd7fd88849ba777a36bf44b8afb4ac9420ce9ce140dfe097216caf3470c9ebc273f3230c071e3d3391a9cc0b109f4d74b11d264869fe4d7d45c37136cbe836d279da18d97b5f515d230ca2b2bca6d99c37c18899f9266d8951a5aaa36a461c021cde00a1a3f992b33778ac76672b107342265b538b4bd49da3fe323c7f38fa1658d0d29a0737cbf6269c6e448f37dacda5e3b1c433a8411fc50ae2a253c90f76e6367467e684d3d5561943f83e65e4ce7341ad0988e4fada6ef183a161a8a63b998d2c9b162fcbf9e5e39fdcc0171ea4442c054d46695bbba60b67975a3c6b1c1489b5c553476f341a46d3b1a0979ca3cf1c174d3a03bb01b99735aa2c1f5afffbf02096f0f7395f32c32c26505743dd8807439092b814d0cf0715cc0871d41e0bdffd78f361c9723fce5cb292d65ae82b1483886702a850547f56f4be9a60757d0ec8ce0b560c9714f81e55a98dea1f716156082433291b3296593a9386790150dea5dfe2e6abd0faceb173adbcbd30a25e5639e3df08096e150234af8728561ad26cb44041bde64aca7e9ea386fcb26096d7a0b471b5f993b02f8132e40eb4e01d8add1fefae398012cd0093b5f95283079329cf16c67a2b362e35df7e6a358ab6b202a093428b672517548548cb65069729129dfaccad53243cb23afe63cadcd15681f8bc0abef2eca36df6db75c0dad352ec4b41966a5537a4a110979067f1ac03188893f312312d1e52df4d4a9eb770475941080e61821ee4df17a28082087e0c37fda458d878b885baf2af7f26b10bc25759a0e0c6c71dac4258b0501a8298396d11c5487a667e25b83abd873b95a97c7555163b0d2207627505cc29a79f59f9afb29bbd6fca874ef8ff401a99cfedbfe6bfc38ddd4d9a03324d997f2123d55a5d482102a9b33a2022d3fcfbd973311ac6b29dcef3a9bbf13a86ea59769c8970430015ded8f64662ec380c70467668b783f37d790fef2ab63756afb8163093a9372351c9fdf2c7ac8560efe1bc6bd61a3d4e8530e689a951968d7f5f2445d931305a69f0f349c168bbea15cc09ae8e958a3a39dbdfb9e59f0726f6526c075f4b49612f26ec83a93fd306f55603a99eb58c0d836e6213b4ce700b7588d41be41b5d890cf1e44511eba4f63646c4ae0dcb42a159500ed3d04fdfe76dcb93b076d1259ec8d4fb1daadf4cd9f5542f2699e57370ccc702119c2841c785bd733bb6406d7c9e757dd04e3dc2dc4999a1bed2ea8c57d77c8c66d043577ac35e2679bd66b3587935bd9b9a4c9608a871aa45b75dc16ff07167291a2edebd346278e84bff261ccf24d3fbc811aac87109cad7f281a4862921117f5f810662b11dd1252c389a7aaf5e63dea09e63f403e06a6496dd9d162b6b2812f50c5c0c89460c8ec89a6a8f0c7b7bb0f848052d8a31cfcb1d89e5b2005394a379529b9ff8caac27396ba569e8735be286f622cd2058d5639a890a5027995212a1ef0f51613ad0ca6ba1562f401ed5973b0953b8c6ea8f7b44f6a95845ba550871c426a369f11395f48fb40ebc0852fb874e36ab6d3e967703531c7725233a32b24befe47a5d45cb39a27e0763ef082f2ffef79f022464f3831f81757afff78cb51d45655ccb922fcb0ae820b0afe534ec9b45f6f9fa1f324c04b06439400cdb47dca54658b304428f247f96b86ad7d54ec2598c447ff82254b1443c57dc46eb6e3d1766e2289924c19244404388fb98ce5870468d5addcee502f86df87c9c0dd1d2ebfd6335044fcef425be28d51e523317d0490862b93da98f5cf84e001537b232ceef76f0ce593b608a0b80e959eb16558aa8103f4114decd5f22d2e85276a8be5cc2753689791cd1ac6c2a158c19bf275fef331d96b6d498efeb5026987ee8d196c317fb2068ac75511349390416713dbe3c7f63afa23b8ec9fdda8bc2488a9e753d0dd935f5b25cb43b9e01a6e3629552e53a7e06e470b5b00175d602bcfdaffa7d17e630490ee0989e776f4519786a138bac21699feb0dbc3180bf83c574bc72a3b28daa860361a37939345db7ba94b69aaa87e99e37f2953c6dba7c73fd9089ef39c7bbbe62c22de2a1c5ac8519210960f093e76c0f4dfa2bbccfffdbdc15c343a4b3c49b25986b6193b618265a77eb847f1d8acb9d8054162f8ffe388101d504ab814af53ccfac1c2d21fbdd595cfb4fe941d8b0eaeff6a33c9258a96c1cb83bb5f1546d5d69380e7146c703150ca260a2efab2046a9e7d7d7522881160b33d9353f9c5f413f27ec56dbd790b6edff10f4e7b63de292275176ddec7d791cdda7072b9ae91de0e8a261266e494ead5b9585e34cc07eccbcebc4e02448d271e6b4201b486285d6e4f0104b6d3dc64158c157a761854fb838de48dc77c6edaf1d7d7ccfc76e2faf1c6839d3bb0b03bb67efd258f4bdd91fd8c8ac737710039a7920f7e0431340a60a092b65e9ac72f52f9c03aebb3ecde437a8d2a95251a26e86662c92c3a276f77eaacba204dc67220cbd4db3e6109fe60ca4a1a0915002ffbe4437735009e01d270c8107654cfaea9e2984a3a3afb680fbf3e8641d6a1a60b3ed688266aa532f203a3c283b26f1ec63459693b0397045d7308b0d44a8d5f10a15a5b72f6a147c5800acf5b46ba8f6543c4bee7d45ee9e3765ec7c0399d385dd7601c330f19e6c9db83ac0b8f2c2f3b4ede6483069a67d03cb9ac3ad1707ab6fd0dc1f5c59a21b38d7015109e370226119d1b6d22d0b75c24526b8ba561f5d1470bc78001dfa90cb82175cf2e8f4abdb9ce12c71f2ece99ce6e3fc2c35a988e875c9184eb71a9d5b76da4356d9a5568fb39efed4c3c8f0a77fdf2e22e74c6d62478243e7ba1f6672bf1827c2dacbc5ea32979632aeb02328ff6a5f678998e9c5cf4af839e972436f35d90f584bf4b98a58cc111187fc854994c6fd8b62dd84c9c7e130520661e463adb984f9268b23c1b4814ffe75f84d5aed0a2bf4173cc53007f95b2ed5d1eba76ae693339f10b17589332082ccfa78828790ab2e356d8e0affbd96e3aa059aba5497e8595ce6dec5c6c7da742bd1850fda5a937a250f8b3f7adf3ab59dd2de7b851251c6b223ba1c12b0873fa30389e3002939e22feea40b96597e16236c236229110e5971340e7e195862b5e2a021f2326ff3ca6bf5c242e2b87c058fe3d58c0e1d52457ad2f52e6e5905d8bd73c7892056fe9c295b8c1aafded7616aaabde0c7cb4c6bf938a53ec9eef3c937625844cb8b9feea079e93367025f04524dcc9b62d3156a7b3500c9a8184fb613095b0c0ba9401f5be66dda72491f24523e068e750ab0a9fe580d20dd669c6f2ffaa99d46571be6ab951199fe5744e2656d66e8169f0f085b3949828dbbdf6bcecbde80591b87f3469edf05bcfc833a62da2185038ef5e8191ffba78fa36136aa3b018ea2c8a55273cdaacc3e493e84c75b01cf4bf295ba7c1172c0c60e9f7425d3aa1ef68266faaca33dcfb1c9efe1541f5b9a9ff5dd958b1642d04774d6b404c193995e9524982d0711847fdc9964544f4dea3d0328e69d6fbab0292af8d5abfcf7a116c1ba794d1642c5fa8da56f8ad8ac9e8a7160d20c5bbca5ec66a1047ce06cf3177085927b565d15eb41ff01c3d83dea5c187e78e35c557624937451e13beaa38f6eff4b04041d7692b056f6c0a054c1e65f0029b4a2662179712dd2fd52e5766d932da7e66bca44b3215e567e866d58a56e19e6b2618f54219489e39298965642760688a134ff08cd75f5c8ee022b14695863c3e7f01937c1ce1e1b26e823b65c010a58c59de9c388bff567988e9eaf4837b1dbdd979f6f4d7e37a47d14a5fed967e6acf731517aca213d7556018b14f589c5f61b6e18b6f2e24cacebcca1e32b4b2413030911429dde6880b99f7bf83136fe817f0bccd84c5a50c535e95f1844d07d5df6189f359f63d086b88a687cb378986c9cf732558671cd586314cbbcc7b45380c0b05742ff6a7cc460a042960415c9f6d689c4667e5e07d1b1e5ca704a4fe2da7eb59f382ea098f445b6c7e8c0d1a47a2df9228bcf9899147a88297528d4fb398540cd15f050e2988dab43ad41a9ff26e09b9a9433a6ea95c8d6cb28d4355cca509ba4e6567098dc316f23f92957d071cdb20ea7111d3c08d2391e36cdb977cfaa55da9b70d0f270592d7698b", 0x1000) (async) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xf}, 0x48) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x424c00) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x5, 0x400, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x10}, 0x48) 01:04:08 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x11}, 0x48) 01:04:08 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000240), 0x101000) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) (async) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x1, 0x1, 0x100}) (async) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14, 0x80000) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) r10 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r10, 0x110, 0x3) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000580)=ANY=[]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r9, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) (async) r13 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r12, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r13, @ANYBLOB="0100000000000000000008000000050022ff07000000c5cad74c31ae7b519c798037d7503857b8db8a4612f131185196c8fdaf574f39de7d879d4604105693b0f400468669593ddebf9c77b46d7ea69c5abff87107389cacea88b95d8355c6f3004c894cdfb26e9fc7bdbcd02eb868de987010e95d7f242f5f0678af8f767e14920b3b3433f6ea56af45db2cf5072777f9e9dc1e5b3c197764b6c51d5de3caef953abbd5e1627c2d31e1589f9e892f4f841d7ba2e2b1058f5e41b2f761153203bd85fd823f139a63"], 0x1c}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x6c, r13, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x3ff}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv_slave_0\x00'}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'ip_vti0\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x4) (async) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f00000002c0)={r9, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}, 0x10) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f0000000280)) (async) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000200)=@req3={0x401, 0xeb80000, 0x8, 0x6, 0x7fffffff, 0x1, 0x80000001}, 0x1c) (async) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}}, 0x10) (async) ioctl$PPPIOCSNPMODE(r6, 0x4008744b, &(0x7f0000000400)={0xc025, 0x1}) 01:04:08 executing program 3: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x5, 0x400, 0x7}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x5, 0x400, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000000)) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0x5452, &(0x7f0000000180)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) 01:04:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socket$inet6_udplite(0xa, 0x2, 0x88) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$ppp(r0, &(0x7f0000000100)="3738fcaa8d3988a59296155e308af99e303d278fd4a814a542b9db5a4f97ee7ee1bab648d6002a9f7cd7b6a3cc3f22aba2720efb31adcac894fddeb90328eb4670d08e0dcfbe40b7e9698500eff60b8b2b4dc693165f7431e2a4b8bfe400a9f8bf16b4a9d59a5b17858bc5a1aa313a187a5275f543bba44b85e386dec9f111ace81acdef26f02356e624f328015f2535a5da65449a2c2fe91091d78753dec03e13d3db289fb5d15ab8e71ac73c7314dcecb80f0eda0398d1c97dd29f7a59c1b28568349b2ec54e04fe94e04e80b029e3c7e89908f4c925371080a7ef2b5ad509803c7b450f9ef0106d596e0901af873c1d2808cb538185a7a0785e2ca23b3a9d418fab888f8e0fea92052667628d4516a10bf434882f2ae6d82c7904e4c8d25ece1169b8a6184115e9ea4ba3efa0044fd24c1e3ba3b27e7a731a2cdd40c743250d9fcab9bd429d002c6f0ae6b921b17f4c69e0f2c54ac0fc82df82eb15d831e7f921492da62d62a1a7285a67da316649befbe12e3386ec8d6cf0c6f5bbae4e8fa067a7869d12c368b7c85fca74da09f6260fc15a5bf867f9dc57d9fe87ec6723cb254342c649d316036b1b5a23139a7a213b08d616caa82144e7b3456c4c7877a946b34c5459befb21d948b6d2eb68522183f73cc85fe8e5f21ad5c289a7009ab20a50742593e94be2ebf472b232198332af49b5e23d345410582cf242eae14843933f33a47f2f8b8a41d5b6319e8141000ff57f8e2414ab80bbbafd9bb973980cddb2cb26cf56f45532cbbca5e96d84a6c8897b99be93dc764f0e1601cde72da8ee4eb088333212d97070444a3d78eb8239550b6c3b1c4105b8bbfcaa611ce9b748136e2b4ef05292983db3760f76622420b11ed5bbd3a55a8282aafec8b048047543b82f5e25696523939235dd59f001ae63d83467da5765968263f3602079c6b51c90189baf50636157c9f59378937092b859a23b7ab6babb2aff5acc0c5a91d5e5de7072e22dad09895d76a765f2ca1e3bf707f9a544dea7b712a7e497516def721e2cebb5cf09e643d621aedca574174feaa0547cfaddba73475173712c560ed8e86ab397ed3b2a1f686556c7cd0153a11a373c51f9085ce14f10f25007a934aa2445dd29133f600a3baec49c3b80a6e6a6944c066774fd22f7177bf3eec1220e981989ce0135e5580fc689090556b0b9a1320edbd28a379c138085dab97b2ec1e4997b25ae472c201e8aef78bef4ac7c9b9e5635c87e0c9c227c496d45748ed8573616d0bd90a526724a0317839422b0e66aaed899839200d45a7803668fcc67201bd26706c7707c3b85a4df6ce2a7a7e2dad898322fe64d6da1277a71b4bac05f8605dc22de15230430c116ca55720319645d004f1d74ff440bc436055a71a5d809cb615c0d3e722cecb0dabe602e49cd1694e59226e3e4cac389d2a8cbb75a1534736a8065f814965beced92685fe4efb212d5dcd5ef708cb5ddce7013b59ff673f63772d25112b33b7844728aa07172832ec21b2e142293e3ae5f4f46d11a0b397e97e9536970d52a30fe259d0ad7f0d54edede5961d79bfaa7d24d9996e45d21619a651460eecdb102c6dac971ae4f08ae26a56a0129bcd7fd88849ba777a36bf44b8afb4ac9420ce9ce140dfe097216caf3470c9ebc273f3230c071e3d3391a9cc0b109f4d74b11d264869fe4d7d45c37136cbe836d279da18d97b5f515d230ca2b2bca6d99c37c18899f9266d8951a5aaa36a461c021cde00a1a3f992b33778ac76672b107342265b538b4bd49da3fe323c7f38fa1658d0d29a0737cbf6269c6e448f37dacda5e3b1c433a8411fc50ae2a253c90f76e6367467e684d3d5561943f83e65e4ce7341ad0988e4fada6ef183a161a8a63b998d2c9b162fcbf9e5e39fdcc0171ea4442c054d46695bbba60b67975a3c6b1c1489b5c553476f341a46d3b1a0979ca3cf1c174d3a03bb01b99735aa2c1f5afffbf02096f0f7395f32c32c26505743dd8807439092b814d0cf0715cc0871d41e0bdffd78f361c9723fce5cb292d65ae82b1483886702a850547f56f4be9a60757d0ec8ce0b560c9714f81e55a98dea1f716156082433291b3296593a9386790150dea5dfe2e6abd0faceb173adbcbd30a25e5639e3df08096e150234af8728561ad26cb44041bde64aca7e9ea386fcb26096d7a0b471b5f993b02f8132e40eb4e01d8add1fefae398012cd0093b5f95283079329cf16c67a2b362e35df7e6a358ab6b202a093428b672517548548cb65069729129dfaccad53243cb23afe63cadcd15681f8bc0abef2eca36df6db75c0dad352ec4b41966a5537a4a110979067f1ac03188893f312312d1e52df4d4a9eb770475941080e61821ee4df17a28082087e0c37fda458d878b885baf2af7f26b10bc25759a0e0c6c71dac4258b0501a8298396d11c5487a667e25b83abd873b95a97c7555163b0d2207627505cc29a79f59f9afb29bbd6fca874ef8ff401a99cfedbfe6bfc38ddd4d9a03324d997f2123d55a5d482102a9b33a2022d3fcfbd973311ac6b29dcef3a9bbf13a86ea59769c8970430015ded8f64662ec380c70467668b783f37d790fef2ab63756afb8163093a9372351c9fdf2c7ac8560efe1bc6bd61a3d4e8530e689a951968d7f5f2445d931305a69f0f349c168bbea15cc09ae8e958a3a39dbdfb9e59f0726f6526c075f4b49612f26ec83a93fd306f55603a99eb58c0d836e6213b4ce700b7588d41be41b5d890cf1e44511eba4f63646c4ae0dcb42a159500ed3d04fdfe76dcb93b076d1259ec8d4fb1daadf4cd9f5542f2699e57370ccc702119c2841c785bd733bb6406d7c9e757dd04e3dc2dc4999a1bed2ea8c57d77c8c66d043577ac35e2679bd66b3587935bd9b9a4c9608a871aa45b75dc16ff07167291a2edebd346278e84bff261ccf24d3fbc811aac87109cad7f281a4862921117f5f810662b11dd1252c389a7aaf5e63dea09e63f403e06a6496dd9d162b6b2812f50c5c0c89460c8ec89a6a8f0c7b7bb0f848052d8a31cfcb1d89e5b2005394a379529b9ff8caac27396ba569e8735be286f622cd2058d5639a890a5027995212a1ef0f51613ad0ca6ba1562f401ed5973b0953b8c6ea8f7b44f6a95845ba550871c426a369f11395f48fb40ebc0852fb874e36ab6d3e967703531c7725233a32b24befe47a5d45cb39a27e0763ef082f2ffef79f022464f3831f81757afff78cb51d45655ccb922fcb0ae820b0afe534ec9b45f6f9fa1f324c04b06439400cdb47dca54658b304428f247f96b86ad7d54ec2598c447ff82254b1443c57dc46eb6e3d1766e2289924c19244404388fb98ce5870468d5addcee502f86df87c9c0dd1d2ebfd6335044fcef425be28d51e523317d0490862b93da98f5cf84e001537b232ceef76f0ce593b608a0b80e959eb16558aa8103f4114decd5f22d2e85276a8be5cc2753689791cd1ac6c2a158c19bf275fef331d96b6d498efeb5026987ee8d196c317fb2068ac75511349390416713dbe3c7f63afa23b8ec9fdda8bc2488a9e753d0dd935f5b25cb43b9e01a6e3629552e53a7e06e470b5b00175d602bcfdaffa7d17e630490ee0989e776f4519786a138bac21699feb0dbc3180bf83c574bc72a3b28daa860361a37939345db7ba94b69aaa87e99e37f2953c6dba7c73fd9089ef39c7bbbe62c22de2a1c5ac8519210960f093e76c0f4dfa2bbccfffdbdc15c343a4b3c49b25986b6193b618265a77eb847f1d8acb9d8054162f8ffe388101d504ab814af53ccfac1c2d21fbdd595cfb4fe941d8b0eaeff6a33c9258a96c1cb83bb5f1546d5d69380e7146c703150ca260a2efab2046a9e7d7d7522881160b33d9353f9c5f413f27ec56dbd790b6edff10f4e7b63de292275176ddec7d791cdda7072b9ae91de0e8a261266e494ead5b9585e34cc07eccbcebc4e02448d271e6b4201b486285d6e4f0104b6d3dc64158c157a761854fb838de48dc77c6edaf1d7d7ccfc76e2faf1c6839d3bb0b03bb67efd258f4bdd91fd8c8ac737710039a7920f7e0431340a60a092b65e9ac72f52f9c03aebb3ecde437a8d2a95251a26e86662c92c3a276f77eaacba204dc67220cbd4db3e6109fe60ca4a1a0915002ffbe4437735009e01d270c8107654cfaea9e2984a3a3afb680fbf3e8641d6a1a60b3ed688266aa532f203a3c283b26f1ec63459693b0397045d7308b0d44a8d5f10a15a5b72f6a147c5800acf5b46ba8f6543c4bee7d45ee9e3765ec7c0399d385dd7601c330f19e6c9db83ac0b8f2c2f3b4ede6483069a67d03cb9ac3ad1707ab6fd0dc1f5c59a21b38d7015109e370226119d1b6d22d0b75c24526b8ba561f5d1470bc78001dfa90cb82175cf2e8f4abdb9ce12c71f2ece99ce6e3fc2c35a988e875c9184eb71a9d5b76da4356d9a5568fb39efed4c3c8f0a77fdf2e22e74c6d62478243e7ba1f6672bf1827c2dacbc5ea32979632aeb02328ff6a5f678998e9c5cf4af839e972436f35d90f584bf4b98a58cc111187fc854994c6fd8b62dd84c9c7e130520661e463adb984f9268b23c1b4814ffe75f84d5aed0a2bf4173cc53007f95b2ed5d1eba76ae693339f10b17589332082ccfa78828790ab2e356d8e0affbd96e3aa059aba5497e8595ce6dec5c6c7da742bd1850fda5a937a250f8b3f7adf3ab59dd2de7b851251c6b223ba1c12b0873fa30389e3002939e22feea40b96597e16236c236229110e5971340e7e195862b5e2a021f2326ff3ca6bf5c242e2b87c058fe3d58c0e1d52457ad2f52e6e5905d8bd73c7892056fe9c295b8c1aafded7616aaabde0c7cb4c6bf938a53ec9eef3c937625844cb8b9feea079e93367025f04524dcc9b62d3156a7b3500c9a8184fb613095b0c0ba9401f5be66dda72491f24523e068e750ab0a9fe580d20dd669c6f2ffaa99d46571be6ab951199fe5744e2656d66e8169f0f085b3949828dbbdf6bcecbde80591b87f3469edf05bcfc833a62da2185038ef5e8191ffba78fa36136aa3b018ea2c8a55273cdaacc3e493e84c75b01cf4bf295ba7c1172c0c60e9f7425d3aa1ef68266faaca33dcfb1c9efe1541f5b9a9ff5dd958b1642d04774d6b404c193995e9524982d0711847fdc9964544f4dea3d0328e69d6fbab0292af8d5abfcf7a116c1ba794d1642c5fa8da56f8ad8ac9e8a7160d20c5bbca5ec66a1047ce06cf3177085927b565d15eb41ff01c3d83dea5c187e78e35c557624937451e13beaa38f6eff4b04041d7692b056f6c0a054c1e65f0029b4a2662179712dd2fd52e5766d932da7e66bca44b3215e567e866d58a56e19e6b2618f54219489e39298965642760688a134ff08cd75f5c8ee022b14695863c3e7f01937c1ce1e1b26e823b65c010a58c59de9c388bff567988e9eaf4837b1dbdd979f6f4d7e37a47d14a5fed967e6acf731517aca213d7556018b14f589c5f61b6e18b6f2e24cacebcca1e32b4b2413030911429dde6880b99f7bf83136fe817f0bccd84c5a50c535e95f1844d07d5df6189f359f63d086b88a687cb378986c9cf732558671cd586314cbbcc7b45380c0b05742ff6a7cc460a042960415c9f6d689c4667e5e07d1b1e5ca704a4fe2da7eb59f382ea098f445b6c7e8c0d1a47a2df9228bcf9899147a88297528d4fb398540cd15f050e2988dab43ad41a9ff26e09b9a9433a6ea95c8d6cb28d4355cca509ba4e6567098dc316f23f92957d071cdb20ea7111d3c08d2391e36cdb977cfaa55da9b70d0f270592d7698b", 0x1000) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x51b7fdb3, 0x800, 0xd}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000000)) (async) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0x5452, &(0x7f0000000180)) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) 01:04:08 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x40000000, 0x8883) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3, 0x5, 0x1, 0x0, 0x0}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x4, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter={0x1e, 0x4, 0xffff, 0x8, 0x200, r0, 0x4, '\x00', 0x0, r1, 0x4, 0x5, 0x0, 0x3}, 0x48) 01:04:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x12}, 0x48) 01:04:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x51b7fdb3, 0x800, 0xd}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:08 executing program 1: bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e22, 0x9, @loopback, 0x1}}, 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x13}, 0x48) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000000)) (async) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0x5452, &(0x7f0000000180)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) 01:04:09 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter={0x1e, 0x4, 0xffff, 0x8, 0x200, r0, 0x4, '\x00', 0x0, r1, 0x4, 0x5, 0x0, 0x3}, 0x48) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x40000000, 0x8883) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3, 0x5, 0x1, 0x0, 0x0}) (async, rerun: 32) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x4, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r2}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) 01:04:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x51b7fdb3, 0x800, 0xd}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 1: bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e22, 0x9, @loopback, 0x1}}, 0x24) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x40000000, 0x8883) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x3, 0x5, 0x1, 0x0, 0x0}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x6, 0x4, 0x9}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r2}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter={0x1e, 0x4, 0xffff, 0x8, 0x200, r0, 0x4, '\x00', 0x0, r1, 0x4, 0x5, 0x0, 0x3}, 0x48) 01:04:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x8, 0x4, 0xfffc0000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f00000001c0)=0x7, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000200)={0x3, 0x2e61, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xfffff0f0, 0x451, 0x5}) syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r2) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x14}, 0x48) 01:04:09 executing program 1: bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e22, 0x9, @loopback, 0x1}}, 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x4}, 0x48) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x18}, 0x48) 01:04:09 executing program 2: socketpair(0x2, 0x80000, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000040)='\x00', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x1f1d4ed4, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) 01:04:09 executing program 3: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0xffffffff}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xffffffff}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x4008020) bind$802154_raw(r0, &(0x7f0000000080)={0x24, @short={0x2, 0x1, 0xfffe}}, 0x14) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x3, 0x17, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280), 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x8, 0x4, 0xfffc0000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f00000001c0)=0x7, 0x4) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000200)={0x3, 0x2e61, 0x6}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xfffff0f0, 0x451, 0x5}) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r2) 01:04:09 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000002640)) recvmsg$kcm(r0, &(0x7f0000002600)={&(0x7f0000000000)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000100)=""/226, 0xe2}, {&(0x7f0000000200)=""/69, 0x45}, {&(0x7f0000000280)=""/180, 0xb4}, {&(0x7f0000000340)=""/43, 0x2b}, {&(0x7f0000000380)=""/94, 0x5e}, {&(0x7f0000000400)=""/45, 0x2d}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/65, 0x41}, {&(0x7f00000014c0)=""/32, 0x20}, {&(0x7f0000001500)=""/4096, 0x1000}], 0xa, &(0x7f00000025c0)=""/17, 0x11}, 0x40002001) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x4}, 0x48) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x300}, 0x48) 01:04:09 executing program 3: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0xffffffff}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xffffffff}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x4008020) bind$802154_raw(r0, &(0x7f0000000080)={0x24, @short={0x2, 0x1, 0xfffe}}, 0x14) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x3, 0x17, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280), 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r2}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0xffffffff}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xffffffff}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x4008020) (async) bind$802154_raw(r0, &(0x7f0000000080)={0x24, @short={0x2, 0x1, 0xfffe}}, 0x14) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x3, 0x17, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280), 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) 01:04:09 executing program 5: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x8, 0x4, 0xfffc0000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f00000001c0)=0x7, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000200)={0x3, 0x2e61, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xfffff0f0, 0x451, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0xfffff0f0, 0x451, 0x5}) syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r2) 01:04:09 executing program 2: socketpair(0x2, 0x80000, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000040)='\x00', 0x1) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x1f1d4ed4, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) 01:04:09 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000002640)) recvmsg$kcm(r0, &(0x7f0000002600)={&(0x7f0000000000)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000100)=""/226, 0xe2}, {&(0x7f0000000200)=""/69, 0x45}, {&(0x7f0000000280)=""/180, 0xb4}, {&(0x7f0000000340)=""/43, 0x2b}, {&(0x7f0000000380)=""/94, 0x5e}, {&(0x7f0000000400)=""/45, 0x2d}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/65, 0x41}, {&(0x7f00000014c0)=""/32, 0x20}, {&(0x7f0000001500)=""/4096, 0x1000}], 0xa, &(0x7f00000025c0)=""/17, 0x11}, 0x40002001) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000002640)) (async) recvmsg$kcm(r0, &(0x7f0000002600)={&(0x7f0000000000)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000100)=""/226, 0xe2}, {&(0x7f0000000200)=""/69, 0x45}, {&(0x7f0000000280)=""/180, 0xb4}, {&(0x7f0000000340)=""/43, 0x2b}, {&(0x7f0000000380)=""/94, 0x5e}, {&(0x7f0000000400)=""/45, 0x2d}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/65, 0x41}, {&(0x7f00000014c0)=""/32, 0x20}, {&(0x7f0000001500)=""/4096, 0x1000}], 0xa, &(0x7f00000025c0)=""/17, 0x11}, 0x40002001) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x500}, 0x48) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1, 0x4}, 0x48) 01:04:09 executing program 3: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0xffffffff}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xffffffff}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x4008020) (async) bind$802154_raw(r0, &(0x7f0000000080)={0x24, @short={0x2, 0x1, 0xfffe}}, 0x14) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x3, 0x17, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280), 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r2}) 01:04:09 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000002640)) recvmsg$kcm(r0, &(0x7f0000002600)={&(0x7f0000000000)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000100)=""/226, 0xe2}, {&(0x7f0000000200)=""/69, 0x45}, {&(0x7f0000000280)=""/180, 0xb4}, {&(0x7f0000000340)=""/43, 0x2b}, {&(0x7f0000000380)=""/94, 0x5e}, {&(0x7f0000000400)=""/45, 0x2d}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/65, 0x41}, {&(0x7f00000014c0)=""/32, 0x20}, {&(0x7f0000001500)=""/4096, 0x1000}], 0xa, &(0x7f00000025c0)=""/17, 0x11}, 0x40002001) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000002640)) (async) recvmsg$kcm(r0, &(0x7f0000002600)={&(0x7f0000000000)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000100)=""/226, 0xe2}, {&(0x7f0000000200)=""/69, 0x45}, {&(0x7f0000000280)=""/180, 0xb4}, {&(0x7f0000000340)=""/43, 0x2b}, {&(0x7f0000000380)=""/94, 0x5e}, {&(0x7f0000000400)=""/45, 0x2d}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/65, 0x41}, {&(0x7f00000014c0)=""/32, 0x20}, {&(0x7f0000001500)=""/4096, 0x1000}], 0xa, &(0x7f00000025c0)=""/17, 0x11}, 0x40002001) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) 01:04:09 executing program 2: socketpair(0x2, 0x80000, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000040)='\x00', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x1f1d4ed4, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) socketpair(0x2, 0x80000, 0x1, &(0x7f0000000000)) (async) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000040)='\x00', 0x1) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x1f1d4ed4, 0x4, 0x80000000, 0x2, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) (async) 01:04:09 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r0}) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x861, 0x1}, 0x48) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x861, 0x1}, 0x48) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x600}, 0x48) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x80440) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x200012, 0x7ec, 0x8009, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000180)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x2, 0x7, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0x6f, 0xffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r0}) 01:04:09 executing program 2: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xffff, 0x7, 0x4, 0x2, 0xffffffffffffffff, 0x40, '\x00', r0, 0xffffffffffffffff, 0x3, 0x5, 0x4, 0xf}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1b, 0x8, 0x4, 0x1, 0x1036, 0x1, 0xfffffff7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x2}, 0x48) 01:04:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x861, 0x1}, 0x48) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x700}, 0x48) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x80440) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x200012, 0x7ec, 0x8009}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x200012, 0x7ec, 0x8009, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000180)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x2, 0x7, 0x8}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x2, 0x7, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0x6f, 0xffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 1: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) setpriority(0x2, r0, 0x7fff) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:09 executing program 2: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xffff, 0x7, 0x4, 0x2, 0xffffffffffffffff, 0x40, '\x00', r0, 0xffffffffffffffff, 0x3, 0x5, 0x4, 0xf}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1b, 0x8, 0x4, 0x1, 0x1036, 0x1, 0xfffffff7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x2}, 0x48) 01:04:09 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r0}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r0}) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x80440) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x200012, 0x7ec, 0x8009, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000180)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000001c0)={0x2, 0x7, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0x6f, 0xffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 4: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000100)=r0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@empty}}, &(0x7f0000000340)=0xe8) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000400)={'syztnl2\x00', &(0x7f0000000380)={'ip6tnl0\x00', r2, 0x2f, 0x9, 0x6, 0x9, 0x5, @dev={0xfe, 0x80, '\x00', 0x2a}, @ipv4={'\x00', '\xff\xff', @local}, 0x10, 0x40, 0x5, 0x5}}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000440)=r3) ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000200)={0x5}) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000140)=""/73, 0x49, 0x2100, &(0x7f00000001c0)={0x11, 0xec, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x900}, 0x48) 01:04:09 executing program 2: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0xffff, 0x7, 0x4, 0x2, 0xffffffffffffffff, 0x40, '\x00', r0, 0xffffffffffffffff, 0x3, 0x5, 0x4, 0xf}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1b, 0x8, 0x4, 0x1, 0x1036, 0x1, 0xfffffff7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x2}, 0x48) 01:04:09 executing program 1: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) setpriority(0x2, r0, 0x7fff) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getpgrp(0x0) (async) syz_open_procfs$namespace(r0, 0x0) (async) setpriority(0x2, r0, 0x7fff) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0xffffff81, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 4: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000100)=r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@empty}}, &(0x7f0000000340)=0xe8) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000400)={'syztnl2\x00', &(0x7f0000000380)={'ip6tnl0\x00', r2, 0x2f, 0x9, 0x6, 0x9, 0x5, @dev={0xfe, 0x80, '\x00', 0x2a}, @ipv4={'\x00', '\xff\xff', @local}, 0x10, 0x40, 0x5, 0x5}}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000440)=r3) (async) ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000200)={0x5}) (async) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000140)=""/73, 0x49, 0x2100, &(0x7f00000001c0)={0x11, 0xec, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x9, 0x400300) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xb, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x6, 0x800, 0x4}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)={'ipvlan1\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x200100, 0x0) write$tun(r3, &(0x7f00000001c0)={@val={0x0, 0x8}, @val={0x1, 0x0, 0x18, 0x7, 0x9, 0x7c}, @eth={@random="edd967a7b147", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@mpls_uc={0x8847, {[{0x2, 0x0, 0x1}, {0x29}, {0x2, 0x0, 0x1}, {0x800}, {0x1f, 0x0, 0x1}, {0xa}], @generic="cbf6b3"}}}}}, 0x37) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="ed9a0533", @ANYRES16=r1, @ANYBLOB="00012cbd7000fcdbdf25030000000500050000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x74d141bde22cca21) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x6}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x24}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008800}, 0x40048) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg$kcm(r0, &(0x7f0000000680)={&(0x7f0000000500)=@generic, 0x80, 0xfffffffffffffffd, 0x0, &(0x7f0000000580)=""/203, 0xcb}, 0x40000025) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000003c0), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x50, r4, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xfff7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1f}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x10fc}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_CONN_ID={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0xfffffff8, 0x3, 0x4, 0x5, 0x7, 0x400, 0xaff}, 0x1c) recvfrom$packet(r0, &(0x7f00000006c0)=""/243, 0xf3, 0x0, 0x0, 0x0) 01:04:09 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xa00}, 0x48) 01:04:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x9, 0x400300) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xb, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x6, 0x800, 0x4}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)={'ipvlan1\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x200100, 0x0) write$tun(r3, &(0x7f00000001c0)={@val={0x0, 0x8}, @val={0x1, 0x0, 0x18, 0x7, 0x9, 0x7c}, @eth={@random="edd967a7b147", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@mpls_uc={0x8847, {[{0x2, 0x0, 0x1}, {0x29}, {0x2, 0x0, 0x1}, {0x800}, {0x1f, 0x0, 0x1}, {0xa}], @generic="cbf6b3"}}}}}, 0x37) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 1: r0 = getpgrp(0x0) syz_open_procfs$namespace(r0, 0x0) (async, rerun: 64) setpriority(0x2, r0, 0x7fff) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:09 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0xffffff81, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:09 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="ed9a0533", @ANYRES16=r1, @ANYBLOB="00012cbd7000fcdbdf25030000000500050000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x74d141bde22cca21) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x6}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x24}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008800}, 0x40048) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) recvmsg$kcm(r0, &(0x7f0000000680)={&(0x7f0000000500)=@generic, 0x80, 0xfffffffffffffffd, 0x0, &(0x7f0000000580)=""/203, 0xcb}, 0x40000025) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000003c0), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x50, r4, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xfff7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1f}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x10fc}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_CONN_ID={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) (async) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0xfffffff8, 0x3, 0x4, 0x5, 0x7, 0x400, 0xaff}, 0x1c) (async, rerun: 64) recvfrom$packet(r0, &(0x7f00000006c0)=""/243, 0xf3, 0x0, 0x0, 0x0) (rerun: 64) 01:04:09 executing program 4: getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000100)=r0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@empty}}, &(0x7f0000000340)=0xe8) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000400)={'syztnl2\x00', &(0x7f0000000380)={'ip6tnl0\x00', r2, 0x2f, 0x9, 0x6, 0x9, 0x5, @dev={0xfe, 0x80, '\x00', 0x2a}, @ipv4={'\x00', '\xff\xff', @local}, 0x10, 0x40, 0x5, 0x5}}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000440)=r3) ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000200)={0x5}) (async) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000140)=""/73, 0x49, 0x2100, &(0x7f00000001c0)={0x11, 0xec, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xb00}, 0x48) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x9, 0x400300) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xb, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x6, 0x800, 0x4}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)={'ipvlan1\x00'}) (async) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)={'ipvlan1\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x200100, 0x0) write$tun(r3, &(0x7f00000001c0)={@val={0x0, 0x8}, @val={0x1, 0x0, 0x18, 0x7, 0x9, 0x7c}, @eth={@random="edd967a7b147", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@mpls_uc={0x8847, {[{0x2, 0x0, 0x1}, {0x29}, {0x2, 0x0, 0x1}, {0x800}, {0x1f, 0x0, 0x1}, {0xa}], @generic="cbf6b3"}}}}}, 0x37) (async) write$tun(r3, &(0x7f00000001c0)={@val={0x0, 0x8}, @val={0x1, 0x0, 0x18, 0x7, 0x9, 0x7c}, @eth={@random="edd967a7b147", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@mpls_uc={0x8847, {[{0x2, 0x0, 0x1}, {0x29}, {0x2, 0x0, 0x1}, {0x800}, {0x1f, 0x0, 0x1}, {0xa}], @generic="cbf6b3"}}}}}, 0x37) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="ed9a0533", @ANYRES16=r1, @ANYBLOB="00012cbd7000fcdbdf25030000000500050000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x74d141bde22cca21) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x6}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x24}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008800}, 0x40048) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg$kcm(r0, &(0x7f0000000680)={&(0x7f0000000500)=@generic, 0x80, 0xfffffffffffffffd, 0x0, &(0x7f0000000580)=""/203, 0xcb}, 0x40000025) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000003c0), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x50, r4, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xfff7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1f}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x10fc}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_CONN_ID={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x50, r4, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xfff7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1f}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x10fc}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_CONN_ID={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0xfffffff8, 0x3, 0x4, 0x5, 0x7, 0x400, 0xaff}, 0x1c) recvfrom$packet(r0, &(0x7f00000006c0)=""/243, 0xf3, 0x0, 0x0, 0x0) (async) recvfrom$packet(r0, &(0x7f00000006c0)=""/243, 0xf3, 0x0, 0x0, 0x0) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast2, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000240)=0xe8) sendto$packet(0xffffffffffffffff, &(0x7f0000000680)="abda0892c0916619366d61f3426259ec3b3c86eaaa87be57266aa517dcc5c2594fa27cddd841227353aea40463cac5a78d3427d20b52dd8d8f20f2310a3f", 0x3e, 0x4080, &(0x7f00000006c0)={0x11, 0x19, r0, 0x1, 0x6, 0x6, @random="ee4044a8d5e5"}, 0x14) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@delpolicy={0x36c, 0x14, 0x100, 0x70bd25, 0x25dfdbfe, {{@in6=@private1, @in=@dev={0xac, 0x14, 0x14, 0xb}, 0x4e24, 0x6ba, 0x4e22, 0x7f, 0xa, 0x0, 0x20, 0x73, r0, 0xee00}, 0x6e6bbd, 0x2}, [@policy={0xac, 0x7, {{@in6=@private1, @in=@private=0xa010101, 0x4e21, 0x8, 0x4e22, 0xed7a, 0x2, 0x0, 0x0, 0x16, 0x0, r1}, {0x3, 0x3f, 0x7, 0x9, 0x80000000, 0x86, 0xffffffffffff4ecf, 0x6}, {0x400, 0x100000001, 0x9, 0x5}, 0x0, 0x6e6bb0, 0x0, 0x0, 0x1, 0x2}}, @algo_crypt={0xb1, 0x2, {{'ecb-camellia-asm\x00'}, 0x348, "c141acce593de23bf93fe155e9e09835be9aeca35b95d604b04f8cb0d20c65aef03855984209bbf8fb6d59c39cd6ca2e22e87b14e24a1358d2ba157ccea59320c2f789ce17c6e85e3ad3acf19a1263429a6b8bc755ec821ce99f814a97a0ac950daf522aff2f964b39"}}, @algo_comp={0x72, 0x3, {{'deflate\x00'}, 0x150, "3b55872c660c542220b4eb4afb23ff5cee1688a31683784f8882a8188a321cb43159b001eb4c8d8a9210"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x5}, @migrate={0x134, 0x11, [{@in=@dev={0xac, 0x14, 0x14, 0x15}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x2e}, @in6=@mcast1, 0x2b, 0x1, 0x0, 0x3500, 0xa, 0xa}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, @in=@rand_addr=0x64010100, @in6=@loopback, 0x33, 0x2, 0x0, 0x3504, 0xa, 0x2}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private2, @in=@rand_addr=0x64010102, @in=@empty, 0x2b, 0x4, 0x0, 0x3500, 0x2, 0x2}, {@in6=@dev={0xfe, 0x80, '\x00', 0x28}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@multicast2, @in=@dev={0xac, 0x14, 0x14, 0x25}, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x2}]}, @mark={0xc, 0x15, {0x35075c, 0x4d1e416d}}]}, 0x36c}}, 0x4000000) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xc00}, 0x48) 01:04:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x7, 0x1, 0x442, 0xffffffffffffffff, 0xfffffff9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x4, 0xc}, 0x48) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x101000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080), 0x1a1c80, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x820, 0x3}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000000c0)={r5}) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000140)={r5}) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0xffffff81, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000140)={r3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x3, 0x8001, 0x1804, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xd}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000180)=""/66, 0x42, 0x0, &(0x7f0000000200)={0x11, 0x9, r1, 0x1, 0x6, 0x6, @broadcast}, 0x14) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0xffffffff, [0x9, 0x3], 0x4d}, 0x10) r3 = accept4$packet(r2, 0x0, &(0x7f0000000040), 0x80000) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000100), 0x10) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) (async) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast2, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000240)=0xe8) sendto$packet(0xffffffffffffffff, &(0x7f0000000680)="abda0892c0916619366d61f3426259ec3b3c86eaaa87be57266aa517dcc5c2594fa27cddd841227353aea40463cac5a78d3427d20b52dd8d8f20f2310a3f", 0x3e, 0x4080, &(0x7f00000006c0)={0x11, 0x19, r0, 0x1, 0x6, 0x6, @random="ee4044a8d5e5"}, 0x14) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@delpolicy={0x36c, 0x14, 0x100, 0x70bd25, 0x25dfdbfe, {{@in6=@private1, @in=@dev={0xac, 0x14, 0x14, 0xb}, 0x4e24, 0x6ba, 0x4e22, 0x7f, 0xa, 0x0, 0x20, 0x73, r0, 0xee00}, 0x6e6bbd, 0x2}, [@policy={0xac, 0x7, {{@in6=@private1, @in=@private=0xa010101, 0x4e21, 0x8, 0x4e22, 0xed7a, 0x2, 0x0, 0x0, 0x16, 0x0, r1}, {0x3, 0x3f, 0x7, 0x9, 0x80000000, 0x86, 0xffffffffffff4ecf, 0x6}, {0x400, 0x100000001, 0x9, 0x5}, 0x0, 0x6e6bb0, 0x0, 0x0, 0x1, 0x2}}, @algo_crypt={0xb1, 0x2, {{'ecb-camellia-asm\x00'}, 0x348, "c141acce593de23bf93fe155e9e09835be9aeca35b95d604b04f8cb0d20c65aef03855984209bbf8fb6d59c39cd6ca2e22e87b14e24a1358d2ba157ccea59320c2f789ce17c6e85e3ad3acf19a1263429a6b8bc755ec821ce99f814a97a0ac950daf522aff2f964b39"}}, @algo_comp={0x72, 0x3, {{'deflate\x00'}, 0x150, "3b55872c660c542220b4eb4afb23ff5cee1688a31683784f8882a8188a321cb43159b001eb4c8d8a9210"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x5}, @migrate={0x134, 0x11, [{@in=@dev={0xac, 0x14, 0x14, 0x15}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x2e}, @in6=@mcast1, 0x2b, 0x1, 0x0, 0x3500, 0xa, 0xa}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, @in=@rand_addr=0x64010100, @in6=@loopback, 0x33, 0x2, 0x0, 0x3504, 0xa, 0x2}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private2, @in=@rand_addr=0x64010102, @in=@empty, 0x2b, 0x4, 0x0, 0x3500, 0x2, 0x2}, {@in6=@dev={0xfe, 0x80, '\x00', 0x28}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@multicast2, @in=@dev={0xac, 0x14, 0x14, 0x25}, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x2}]}, @mark={0xc, 0x15, {0x35075c, 0x4d1e416d}}]}, 0x36c}}, 0x4000000) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x101000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080), 0x1a1c80, 0x0) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x820, 0x3}) (async, rerun: 64) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000000c0)={r5}) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000140)={r5}) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xd00}, 0x48) 01:04:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x7, 0x1, 0x442, 0xffffffffffffffff, 0xfffffff9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x4, 0xc}, 0x48) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x3, 0x8001, 0x1804, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xd}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000180)=""/66, 0x42, 0x0, &(0x7f0000000200)={0x11, 0x9, r1, 0x1, 0x6, 0x6, @broadcast}, 0x14) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0xffffffff, [0x9, 0x3], 0x4d}, 0x10) (async) r3 = accept4$packet(r2, 0x0, &(0x7f0000000040), 0x80000) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000100), 0x10) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xffff, 0xffff, 0x800}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0xfffffff9, 0x4}) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xe00}, 0x48) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x101000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080), 0x1a1c80, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x820, 0x3}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r2}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000000c0)={r5}) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r6) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000140)={r5}) (rerun: 32) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast2, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000240)=0xe8) sendto$packet(0xffffffffffffffff, &(0x7f0000000680)="abda0892c0916619366d61f3426259ec3b3c86eaaa87be57266aa517dcc5c2594fa27cddd841227353aea40463cac5a78d3427d20b52dd8d8f20f2310a3f", 0x3e, 0x4080, &(0x7f00000006c0)={0x11, 0x19, r0, 0x1, 0x6, 0x6, @random="ee4044a8d5e5"}, 0x14) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@delpolicy={0x36c, 0x14, 0x100, 0x70bd25, 0x25dfdbfe, {{@in6=@private1, @in=@dev={0xac, 0x14, 0x14, 0xb}, 0x4e24, 0x6ba, 0x4e22, 0x7f, 0xa, 0x0, 0x20, 0x73, r0, 0xee00}, 0x6e6bbd, 0x2}, [@policy={0xac, 0x7, {{@in6=@private1, @in=@private=0xa010101, 0x4e21, 0x8, 0x4e22, 0xed7a, 0x2, 0x0, 0x0, 0x16, 0x0, r1}, {0x3, 0x3f, 0x7, 0x9, 0x80000000, 0x86, 0xffffffffffff4ecf, 0x6}, {0x400, 0x100000001, 0x9, 0x5}, 0x0, 0x6e6bb0, 0x0, 0x0, 0x1, 0x2}}, @algo_crypt={0xb1, 0x2, {{'ecb-camellia-asm\x00'}, 0x348, "c141acce593de23bf93fe155e9e09835be9aeca35b95d604b04f8cb0d20c65aef03855984209bbf8fb6d59c39cd6ca2e22e87b14e24a1358d2ba157ccea59320c2f789ce17c6e85e3ad3acf19a1263429a6b8bc755ec821ce99f814a97a0ac950daf522aff2f964b39"}}, @algo_comp={0x72, 0x3, {{'deflate\x00'}, 0x150, "3b55872c660c542220b4eb4afb23ff5cee1688a31683784f8882a8188a321cb43159b001eb4c8d8a9210"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x5}, @migrate={0x134, 0x11, [{@in=@dev={0xac, 0x14, 0x14, 0x15}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x2e}, @in6=@mcast1, 0x2b, 0x1, 0x0, 0x3500, 0xa, 0xa}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, @in=@rand_addr=0x64010100, @in6=@loopback, 0x33, 0x2, 0x0, 0x3504, 0xa, 0x2}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private2, @in=@rand_addr=0x64010102, @in=@empty, 0x2b, 0x4, 0x0, 0x3500, 0x2, 0x2}, {@in6=@dev={0xfe, 0x80, '\x00', 0x28}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@multicast2, @in=@dev={0xac, 0x14, 0x14, 0x25}, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x2}]}, @mark={0xc, 0x15, {0x35075c, 0x4d1e416d}}]}, 0x36c}}, 0x4000000) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x3, 0x8001, 0x1804, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2, 0xd}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000180)=""/66, 0x42, 0x0, &(0x7f0000000200)={0x11, 0x9, r1, 0x1, 0x6, 0x6, @broadcast}, 0x14) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0xffffffff, [0x9, 0x3], 0x4d}, 0x10) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0xffffffff, [0x9, 0x3], 0x4d}, 0x10) r3 = accept4$packet(r2, 0x0, &(0x7f0000000040), 0x80000) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000100), 0x10) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xffff, 0xffff, 0x800}) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0xfffffff9, 0x4}) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xf00}, 0x48) 01:04:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x7, 0x1, 0x442, 0xffffffffffffffff, 0xfffffff9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x4, 0xc}, 0x48) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000240)='\x00', 0x1) recvfrom$packet(r0, &(0x7f0000000100)=""/112, 0x70, 0x10043, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getpeername$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x18, 0x3, 0x1, 0x1fe0, 0x480, r0, 0x6, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) pipe2$watch_queue(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000580)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000005c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x12, 0x9, &(0x7f0000000300)=@raw=[@map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xd7a}, @ldst={0x0, 0x1, 0x6, 0x2, 0xddea9cf94b0c0f3, 0x8}, @generic={0x9, 0x1, 0x2, 0xffff, 0x66e}, @generic={0x0, 0x1, 0xb, 0x9, 0x1}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000380)='GPL\x00', 0xfffffffb, 0xe9, &(0x7f00000003c0)=""/233, 0x40f00, 0x5, '\x00', 0x0, 0xa, r4, 0x8, &(0x7f0000000500)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0xc, 0x0, 0x1}, 0x10, 0x0, r5, 0x0, &(0x7f0000000600)=[r0, r6, r7, r8]}, 0x80) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={0xffffffffffffffff}, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x1100}, 0x48) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xffff, 0xffff, 0x800}) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0xfffffff9, 0x4}) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000240)='\x00', 0x1) recvfrom$packet(r0, &(0x7f0000000100)=""/112, 0x70, 0x10043, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getpeername$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x18, 0x3, 0x1, 0x1fe0, 0x480, r0, 0x6, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) pipe2$watch_queue(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000580)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000005c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x12, 0x9, &(0x7f0000000300)=@raw=[@map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xd7a}, @ldst={0x0, 0x1, 0x6, 0x2, 0xddea9cf94b0c0f3, 0x8}, @generic={0x9, 0x1, 0x2, 0xffff, 0x66e}, @generic={0x0, 0x1, 0xb, 0x9, 0x1}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000380)='GPL\x00', 0xfffffffb, 0xe9, &(0x7f00000003c0)=""/233, 0x40f00, 0x5, '\x00', 0x0, 0xa, r4, 0x8, &(0x7f0000000500)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0xc, 0x0, 0x1}, 0x10, 0x0, r5, 0x0, &(0x7f0000000600)=[r0, r6, r7, r8]}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000200), 0x80) (async) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000240)='\x00', 0x1) (async) recvfrom$packet(r0, &(0x7f0000000100)=""/112, 0x70, 0x10043, 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000040), 0x80) (async) getpeername$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x18, 0x3, 0x1, 0x1fe0, 0x480, r0, 0x6, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) (async) pipe2$watch_queue(&(0x7f00000004c0), 0x80) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000580)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000005c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x12, 0x9, &(0x7f0000000300)=@raw=[@map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xd7a}, @ldst={0x0, 0x1, 0x6, 0x2, 0xddea9cf94b0c0f3, 0x8}, @generic={0x9, 0x1, 0x2, 0xffff, 0x66e}, @generic={0x0, 0x1, 0xb, 0x9, 0x1}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000380)='GPL\x00', 0xfffffffb, 0xe9, &(0x7f00000003c0)=""/233, 0x40f00, 0x5, '\x00', 0x0, 0xa, r4, 0x8, &(0x7f0000000500)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0xc, 0x0, 0x1}, 0x10, 0x0, r5, 0x0, &(0x7f0000000600)=[r0, r6, r7, r8]}, 0x80) (async) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socket$nl_crypto(0x10, 0x3, 0x15) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x1200}, 0x48) 01:04:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000000040)=""/29, 0x1d) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={0xffffffffffffffff}, 0x4) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0xea4, 0x402100) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={0xffffffffffffffff}, 0x4) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x1300}, 0x48) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socket$nl_crypto(0x10, 0x3, 0x15) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) socket$nl_crypto(0x10, 0x3, 0x15) (async) 01:04:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000000040)=""/29, 0x1d) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000000040)=""/29, 0x1d) (async) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000240)='\x00', 0x1) (async) recvfrom$packet(r0, &(0x7f0000000100)=""/112, 0x70, 0x10043, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getpeername$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x18, 0x3, 0x1, 0x1fe0, 0x480, r0, 0x6, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) (async) pipe2$watch_queue(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r5) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000580)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000005c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x12, 0x9, &(0x7f0000000300)=@raw=[@map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xd7a}, @ldst={0x0, 0x1, 0x6, 0x2, 0xddea9cf94b0c0f3, 0x8}, @generic={0x9, 0x1, 0x2, 0xffff, 0x66e}, @generic={0x0, 0x1, 0xb, 0x9, 0x1}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000380)='GPL\x00', 0xfffffffb, 0xe9, &(0x7f00000003c0)=""/233, 0x40f00, 0x5, '\x00', 0x0, 0xa, r4, 0x8, &(0x7f0000000500)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0xc, 0x0, 0x1}, 0x10, 0x0, r5, 0x0, &(0x7f0000000600)=[r0, r6, r7, r8]}, 0x80) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0xea4, 0x402100) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000080), 0xea4, 0x402100) (async) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9, 0x8, 0xbb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) 01:04:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) socket$nl_crypto(0x10, 0x3, 0x15) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x1400}, 0x48) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14, 0x80800) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000100)={'syztnl1\x00', r0, 0xa8b15dc7821a3764, 0x20, 0x3, 0x7, {{0xe, 0x4, 0x1, 0x5, 0x38, 0x66, 0x0, 0x7, 0x2f, 0x0, @loopback, @empty, {[@cipso={0x86, 0x15, 0x1, [{0x0, 0x6, "998d22b2"}, {0x1, 0x9, "a5736523595ce6"}]}, @lsrr={0x83, 0xf, 0xcd, [@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @loopback]}]}}}}}) socketpair(0x27, 0x800, 0x8, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$packet(r2, &(0x7f0000000200), &(0x7f0000000240)=0x14, 0x800) 01:04:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000000040)=""/29, 0x1d) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000000040)=""/29, 0x1d) (async) 01:04:10 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9, 0x8, 0xbb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x1800}, 0x48) 01:04:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x44, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x80000001}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000800}, 0x4008000) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xfa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10000}, 0x4004000) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$PPPIOCATTACH(r3, 0x4004743d, &(0x7f0000000300)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:10 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000080), 0xea4, 0x402100) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) syz_open_dev$dri(&(0x7f0000000080), 0xea4, 0x402100) (async) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14, 0x80800) (async) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14, 0x80800) socket$inet_udplite(0x2, 0x2, 0x88) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000100)={'syztnl1\x00', r0, 0xa8b15dc7821a3764, 0x20, 0x3, 0x7, {{0xe, 0x4, 0x1, 0x5, 0x38, 0x66, 0x0, 0x7, 0x2f, 0x0, @loopback, @empty, {[@cipso={0x86, 0x15, 0x1, [{0x0, 0x6, "998d22b2"}, {0x1, 0x9, "a5736523595ce6"}]}, @lsrr={0x83, 0xf, 0xcd, [@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @loopback]}]}}}}}) socketpair(0x27, 0x800, 0x8, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$packet(r2, &(0x7f0000000200), &(0x7f0000000240)=0x14, 0x800) 01:04:10 executing program 5: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9, 0x8, 0xbb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000140)={r2}) 01:04:10 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000240)={0xa, &(0x7f0000000000)=[{0x3ff, 0xfa, 0x0, 0x5}, {0x1000, 0x7, 0x1, 0x3}, {0x2, 0x7f, 0x2, 0x9c8}, {0xa0, 0x4, 0x4, 0xa6}, {0x3f, 0x6, 0x20, 0x9}, {0x9, 0x12, 0x69, 0x4}, {0x1, 0x2, 0x80, 0x3}, {0xd9, 0xf7, 0x7, 0x9}, {0x6, 0x7a, 0x8, 0x2}, {0x8, 0x80, 0x81, 0x80}]}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000001c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000100)={r2, 0x1, 0xffffffffffffffff, 0x528fba79, 0x80000}) ioctl$PPPIOCSMRU1(r0, 0x40047452, &(0x7f0000000180)=0xfc9d) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xd, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:10 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x1000000}, 0x48) 01:04:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x44, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x80000001}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000800}, 0x4008000) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xfa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10000}, 0x4004000) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) ioctl$PPPIOCATTACH(r3, 0x4004743d, &(0x7f0000000300)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x44, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x80000001}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000800}, 0x4008000) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xfa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10000}, 0x4004000) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$PPPIOCATTACH(r3, 0x4004743d, &(0x7f0000000300)=0x2) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) 01:04:10 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async, rerun: 32) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14, 0x80800) (rerun: 32) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000100)={'syztnl1\x00', r0, 0xa8b15dc7821a3764, 0x20, 0x3, 0x7, {{0xe, 0x4, 0x1, 0x5, 0x38, 0x66, 0x0, 0x7, 0x2f, 0x0, @loopback, @empty, {[@cipso={0x86, 0x15, 0x1, [{0x0, 0x6, "998d22b2"}, {0x1, 0x9, "a5736523595ce6"}]}, @lsrr={0x83, 0xf, 0xcd, [@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @loopback]}]}}}}}) (async, rerun: 64) socketpair(0x27, 0x800, 0x8, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) accept4$packet(r2, &(0x7f0000000200), &(0x7f0000000240)=0x14, 0x800) 01:04:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x44, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x80000001}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000800}, 0x4008000) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xfa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10000}, 0x4004000) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) ioctl$PPPIOCATTACH(r3, 0x4004743d, &(0x7f0000000300)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)="0599c77146e1fe2247d180256fc6243084da8bba7baad21a53a12b44b9ed647c3efc2aa42858822241b1c03bc7b39c5d1a35f28b0795e7c03e1e259825407cdd9186f821613d01a970d36531f05e211f7af086ea05dc8c464341f8f061dd458856c556b92f98a47e7280a5a5b145b9bc748337bf2ffc5e27ac80cfd426690fde1ae9f8e93f01aaeb443d19333ba8cdc7c9411e7552c03e0471e049ef4aadff080210ed235da1aecafa3bfb8578f98d011f35c8814f8894c01f29026be65c6aec5ac148a4512622699e6722d0a4b24a7a03537f81c156b395cf521c29ad1732923439624e4a34d23cedd30477d25f5383cb773be254abe3906d9c333db08e941cbee549eee73319737f3a0bb53647c7c0d91b0b02766b0e31fcbeae77c1912447cb705e0e82b0271558e4684f16455b915e6f42d001fcb5b4363a673c28cb0cc434f916ce77a974dcf2ace9c2a42584ece5c9af57164a50e12b35dd35d9f4e54d5d7e173e8d35bd51d89027b5a9827d0175a4bc40b1b2ebcbe99f8f522c86596108276b2154743382982de4f367114dbde1955ec8e089d181414e9bc2f8006d7d5e062e334221a7da276cdd03efb84ef8d7dab87012cbdf2348d4eb105198fc9b08ec6787b06a80b25fa32b7cdfacc692e2e432c6cf37f7086c115f0504fd5d9bb6e72cc99e9537152d04fcd1dfb6a0c6139ab72fece8d781001733ac74fa2b7cc1562da4b7b8407147936293dc2940a60dcb6e548cbd72b6bf766cc567099a610919842855b4cc73b61ba197c8c180da7e1ee88b4f0efcfebd04b8e4578a49a9cf9e91ee8b6e9439905a3e5398990c7d44d0882eb3821faa16061c5454b9e88a86ad3bf538156d97b2ab5a4dfcfd246928e83993e9604f10f304d4e0a20efebbfda049e49934d42c7daada5606c8e37497fab272b63b3571a0bdc50a34e4eede44d9b7c006e1324254a67f8c21191fe86de5f1340fce68ea1b1f5d3fe03441a4bd2e94e708b74a51a4ee7a9c560a55711f40ab97840e912d322e7751e6ef8ae07bdace71c77a233c4685449baed2c526ddd55c7e8add9aa9f576f4467edfbfa3d701bd14d09ab3d2bcfb9caca602fc4ab28ad87c2c4c795f9b49ff48f047159b68566fc07aaf27111ee1461078b2839db5889a457f08499cc5d2454faefa54b413e16c33bf214be9d1c27c8a43aa0d15210a80e69a6efe02d5c498efe22db6cb628dbe7062cdf59ee422bc539c1b79c2a691afb1614747695660231cde2044efd986f7bb431076a7f55b53ea26fd9f5d2b40704ae14ee80b67e5e60322128c176eaec92a1c2b18281e8a7f6930b9d1d4a7f331ce0a56c25d7832dc588006667c6685237f69cc20407b43d406c15d35b649796f4699f38233f13341a622b06c5d988a61ff0bb890295a1622df6233ac6c76daa2aefb99fb658ae1483c9b1c50232d0b089fa031b7c116d37ae3fecdd7967d8f71d0e0afbdfba6a80cee44a29d0437191289e7adfed802c6c6def5b6daf77f9a1c3ef871b793227ee74b0dd64e3a84e15239dbb71e76a1c1a424054fc1684eca10581b96a34b01056ef0856e27cf6c4eaf389fdae045963858751822d3c496d0e14b2ed584b51550e8245c367d82db2bba04662dbafd85f8f8ebdd5efbc30dc21146ca400e33acad40ab7570a76ffcbd2efbb875887966a5387e9d2f8fd1e8f6dd7cac3bd52f2f3aded32319445781e2e869e377ed7409d37fd855a46f8f659f180cdfb8dd13454f247715c0193356925e087b6e2000ddcc89476f062404584bfd183b412a30e6202156c45112f0462e9aa98f2edb500b096e6956ba04be091f40176d091cd3e173125a173f7295c4127779872a0162ea204463f99a13bd45e2b1969778db31077a18accd809755d14e0ce4b81baefe196719961ed3fd2b0fe060dc16756114ed95072203c5f298690cdfe1f3cf6960479db114f381b9da5944cbdc85183a7b8f958048bd2dbe3b1a05915bfa55e6a2975c6160d7dfd3330b7570390dafca7fcfca47a6e631130ea47af5d068152ae0f5283884568385c87a7da3c96ab6785d3efe951bac53faf25ea767404aa2dab952eb8e7aef9cdbeae931944ab02ae144d52def5ef89a9449155c5b5c1d5660d26f993a4a75b51e4473c7dc3f56637987e5c4cfab5afc1d93b322751a43546948bb658a51109526bae477fca5ff518c5382e762ee6fbd376a432d9eaae48e4a9717b57ad4b84df6bc0f3358116d0a5ef2952bc7671365f8ac47a6e2bd4f28a136482a597ae07aec0e3074fc077db38038e061a3b5b26ef62a37177f000ecd3677e7677806f0db5b6f28dadcc090b0ca1008538cf6b79186f0f46bceb28a84f13d42557476ff97243dd6364389cdb2e909217fa76f36251a57145dae4cf12b266b4173ee4df5a89962d9b5d211670c612be56419bdf37e52f11729b642a34afb0f969674ad3e7f1790c340f29515ce57f0093a10eab16d1fb615a336fb776a27663ccd19ccbdf35ea10b27a3259d2b890d7faf44b0bb1d241a01a2c394b5dedddf2d1e436ddbeacd0689909e2256188498829939ad6a54eca79dcde0df1dedc6952602bfb893df4c9c0a5c3a7e63c1a28fe73b2d8f94d2814d4e6d3cd37f8d0a3bbe1f73366d376a50f745be1dfe7959885669811eccf36b323cca1d8b3558048c414ecafa6fb62d004a772fed0a2ba118ebf9c2904663712081a05464eb9213b5304db68590cb4ecbd3a502662a65b5f9b75a0242f696edf68ce21bfca47bb002703b15c642335029387439c5c1523f14014996f212e741026eb996c5e0d06ca8c996790c3fac58ab36e2063b5bdec68aa516de31dafcbb3295549bedeafc71ee4c6b9ae7ca84a02b2c86dd44aa42eaf7308373fffed002021b00f70b3bc70b7f35b7349b3340e59e98a56b2e4a2d3c1bdec239efc0d5dc2badf1d0e9c430d1d6841114284a453fd6d93217910afe319bc21560b853272962f966b857d4c39412282286a245b317f5142aac9237f815f0008ecbce338bca1d726c5f027267c114eee0bb91b3f2ae4fa9396f1cddc1ac8673a43d3ab7a721702de921147c54c3b8cd66ce7bdd3c1f8054dab1c16e4984a8e0f8b4c9ea88779671b562518ecc9bfd2311d5e3bce2a51d6a88ea98b025b3916314f0c835395e8741b8754892f8ca267b795087ce6e5769dd4b792776abe075fc558c309dc59d4c17049590bf4d1b09e0198cddc8ff3a9169d9dd69a0d405926df4dad10ce4dcb488dbd2ce6fd1ad2b6b1fd069a89832dcb8ee115f189cf3f1e34f75271a8631fcc74ee80f79463dd2b2526f786ed865a06ba086e6b71b20db1094fbc6966afc55790f2d8ffb32646d68dbe21dacb1c934899d8b56825ed013c16dd241bf69ce1897d8bf627114d8420e43fba6b8009154ad118fb51af60044ae278e25e5a09a4b1c8a198d0aa357d389335cd01a03442ccd676784d61ee3aaf3fbf6634d5e896eed90ad304f798543c8542f220155d96edb30d361cbe755f267a42fa1d62814e2e888141ff1b4b1f5df2e0e607e6239a8ff71a57f733310b6203e0996eb3f8fd90a31af64b9896011c2b3da1dfceb9071f2196ac0f57546d264e35b8374b5f6c67484d582e451d675ce83ba1c055c0e1529c2a09421afe5ae750211e251e99ba1954eb4f2308444bc875d5bb4d4723167dfcd8944ee40d1e2e991844a74290bfbf4078d71e2280a6d46ab7bc64a369528dc5753d8d1e62995f1dcdbe1eeafb4e53581a9c61d8ede06cbf6080682a50766be03060a8fae30b7044832bc7b952c3e457efa53e6eccc8555c250d86b2576737e331b238b3b3f1ae8e9ecaff843653e9286bf3c486a300bcd7a9e3b1664539e989a23e529646985d1932262aecc724cdb3b3246c98cfb43d32235e3948478be1b57a5f1e19d3b25991c69c507a0d36791218522d436ebde1cefb9e7d30bbfe3b3bbf31dad3e32410a777dc5a673820227546bf88c91726ae439c6186519d3604e5e1c86a898e23a8abe4bf05563e44fcd9f0a328cebd66128c58adf51a85378ec0e762b9d11f94012148ef97a71bf496c745e49910949b1fb766e4c49afbb74d4d2712d45e8bb7761207d87ab27eb1e03ae26c3aa7f1295b4c1458479218b6cd446e0c162107fc155411d228cb3a2cfb4a6137f50cd80e30974c0a095e13598dfcc64b26e06c7dd195188e643687af083abc31755f0a9a8f5cb079961c277eedb1ddc429b197ef2799fbc5ea4e47deb7658fc95fa01a778c8cc3adb623f21205e6af04d3cc9d1a96b61481b832ed0954835e4af953870c459f6ed83c84ccca0cff9a65b40b7e1dfd9135207465d79ad7461eb43973381fa95399a7e1a7fe25d33fab636dfe283d90e14db9d417afcbbe9637e0d3a598ec169981fc9538e0ce3c0721f7e669da2f79f325c751fe0825daa9b732fb4fd23bcf3ec328ae50be2b263d63454bed7dcae9457f9e3023f752ff8aa54557f1c5d89fa1c3d82e4b93c15e1a44347728f2e8797c6a4966d15c220bb88381145a7cd071fb1f6f195be1b819c3eea01bf21af6a748dbe35caa0dc2a9f6d3d47db78730e899518d31dd8915647d78494fd7f859a84d1acf54815a8ad7084e4f9d179204ae981a63e03ac4a3bef7c628c432ab8acc1fa88b6708e7e679e59bed739094e276cbc3ab340faa14ec9645970ead45359ae46a5e6c72e8a5e268e36eec571c3ae59784e686c99fb1247984714a800b8528eb89b484b8dccbe9965417fc3db2557fc44f76f22b93817138e545fab757f28ded25d276927f69e054594f3b5527bbfe6591a2f80dec335199db9216de73f2d3470b2d8fe670e0a07cecfc1e53141c0e85b6f5ffdd5a0c48d1530fdee6156e748450c92e6c90809b4ecd7cf3349f1564d21a6f53fc18dae2f31b3d6223fe8df1cadaa7163550787f6fb887b0a09d3aae1e3da08e48514b0fd109b822f96f0d52f061dc3fb08f794056d9a2e1310143a5cca552616d4817cf45145470a513b758b06a432f1a67bffe202fcb259c40ec220819b1d97a6265d33030b2cdd01e76878f5a27d1cbbea24fa8c7bae61937d4824b5df06a93f1d667c03d0d10843643c4e16d6f34de985726a432e41164f79801fc994fe886cad2a2989b37d48948590b844607b9df24f814df83dea981c3ad91ecc56267336c8c598aba1d5ab963255d23861608cfa8b389704e05054eee2d566ceefcd57e1c54105bd05afa3690b50d4c3f8b1d9f9908a270b236b567d22c080670f6021f2adc97cd46a3d6cd5409189a996c5d5c11f384aa26068d346fcdccb4e37907c46076a5d2b4f4753e7b76702dac6dc485ab40d5b52661a9e8d20eaf16c89017c371dd83948b50dbe4198ac000161c33bd9f43c042c628beed7585a2782f739f00c27173dcc03bbd4082f8250dfb766be73d1c6ca704ae6a5510f70fd90c9c056ad1131fc7f20792ee62e021ad1ab281c51ec8dea60fda24a288d4dbef454da9f972574efccd0716ccffb3a7ba77f048d06d44c83e760ec8797bbf14df3f7a1753f4118e5a66827bfeb75e81fc4b21d54fd94ef54ce9a67476f458ccd21a1cdfa880cd3d1de1988500c41708d02173a5a239f5ea7463cc88ac9c10795cc331a6a1211a3187c6bcee1d6a50092de8e79871791b20f11c71f90e89526eba3d917a499f738d503c3ce4f1273304c7e2636f78a500e392cec347895a79fc2723ac4b2e91f42228c4f557bf5756930feff6fca8541d2c41018e856af98e5cda6f7a184c987236db80385cbd6b67407d2f35a8ff8941e", 0x1000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000240)={0xa, &(0x7f0000000000)=[{0x3ff, 0xfa, 0x0, 0x5}, {0x1000, 0x7, 0x1, 0x3}, {0x2, 0x7f, 0x2, 0x9c8}, {0xa0, 0x4, 0x4, 0xa6}, {0x3f, 0x6, 0x20, 0x9}, {0x9, 0x12, 0x69, 0x4}, {0x1, 0x2, 0x80, 0x3}, {0xd9, 0xf7, 0x7, 0x9}, {0x6, 0x7a, 0x8, 0x2}, {0x8, 0x80, 0x81, 0x80}]}) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000001c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000100)={r2, 0x1, 0xffffffffffffffff, 0x528fba79, 0x80000}) (async) ioctl$PPPIOCSMRU1(r0, 0x40047452, &(0x7f0000000180)=0xfc9d) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xd, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0xa, &(0x7f0000000140)=[{0x8, 0x8, 0x81, 0x80}, {0x1, 0x47, 0x3a, 0x10001}, {0x94, 0x0, 0xf0, 0x6}, {0x2, 0x81, 0x2}, {0x9, 0x85, 0x0, 0x80000000}, {0xffff, 0x3, 0x51}, {0x3, 0x40, 0x5, 0x1}, {0xff12, 0xfc, 0xfa, 0x2}, {0xffff, 0x2, 0x2, 0x1}, {0x40, 0x20, 0x80, 0x7}]}) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0xf00e, 0x101800) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x8, 0x800}, 0x48) 01:04:11 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f00000000c0), 0x4) syz_open_dev$sndmidi(&(0x7f0000000000), 0xfffffffffffffe9d, 0x400000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)="0599c77146e1fe2247d180256fc6243084da8bba7baad21a53a12b44b9ed647c3efc2aa42858822241b1c03bc7b39c5d1a35f28b0795e7c03e1e259825407cdd9186f821613d01a970d36531f05e211f7af086ea05dc8c464341f8f061dd458856c556b92f98a47e7280a5a5b145b9bc748337bf2ffc5e27ac80cfd426690fde1ae9f8e93f01aaeb443d19333ba8cdc7c9411e7552c03e0471e049ef4aadff080210ed235da1aecafa3bfb8578f98d011f35c8814f8894c01f29026be65c6aec5ac148a4512622699e6722d0a4b24a7a03537f81c156b395cf521c29ad1732923439624e4a34d23cedd30477d25f5383cb773be254abe3906d9c333db08e941cbee549eee73319737f3a0bb53647c7c0d91b0b02766b0e31fcbeae77c1912447cb705e0e82b0271558e4684f16455b915e6f42d001fcb5b4363a673c28cb0cc434f916ce77a974dcf2ace9c2a42584ece5c9af57164a50e12b35dd35d9f4e54d5d7e173e8d35bd51d89027b5a9827d0175a4bc40b1b2ebcbe99f8f522c86596108276b2154743382982de4f367114dbde1955ec8e089d181414e9bc2f8006d7d5e062e334221a7da276cdd03efb84ef8d7dab87012cbdf2348d4eb105198fc9b08ec6787b06a80b25fa32b7cdfacc692e2e432c6cf37f7086c115f0504fd5d9bb6e72cc99e9537152d04fcd1dfb6a0c6139ab72fece8d781001733ac74fa2b7cc1562da4b7b8407147936293dc2940a60dcb6e548cbd72b6bf766cc567099a610919842855b4cc73b61ba197c8c180da7e1ee88b4f0efcfebd04b8e4578a49a9cf9e91ee8b6e9439905a3e5398990c7d44d0882eb3821faa16061c5454b9e88a86ad3bf538156d97b2ab5a4dfcfd246928e83993e9604f10f304d4e0a20efebbfda049e49934d42c7daada5606c8e37497fab272b63b3571a0bdc50a34e4eede44d9b7c006e1324254a67f8c21191fe86de5f1340fce68ea1b1f5d3fe03441a4bd2e94e708b74a51a4ee7a9c560a55711f40ab97840e912d322e7751e6ef8ae07bdace71c77a233c4685449baed2c526ddd55c7e8add9aa9f576f4467edfbfa3d701bd14d09ab3d2bcfb9caca602fc4ab28ad87c2c4c795f9b49ff48f047159b68566fc07aaf27111ee1461078b2839db5889a457f08499cc5d2454faefa54b413e16c33bf214be9d1c27c8a43aa0d15210a80e69a6efe02d5c498efe22db6cb628dbe7062cdf59ee422bc539c1b79c2a691afb1614747695660231cde2044efd986f7bb431076a7f55b53ea26fd9f5d2b40704ae14ee80b67e5e60322128c176eaec92a1c2b18281e8a7f6930b9d1d4a7f331ce0a56c25d7832dc588006667c6685237f69cc20407b43d406c15d35b649796f4699f38233f13341a622b06c5d988a61ff0bb890295a1622df6233ac6c76daa2aefb99fb658ae1483c9b1c50232d0b089fa031b7c116d37ae3fecdd7967d8f71d0e0afbdfba6a80cee44a29d0437191289e7adfed802c6c6def5b6daf77f9a1c3ef871b793227ee74b0dd64e3a84e15239dbb71e76a1c1a424054fc1684eca10581b96a34b01056ef0856e27cf6c4eaf389fdae045963858751822d3c496d0e14b2ed584b51550e8245c367d82db2bba04662dbafd85f8f8ebdd5efbc30dc21146ca400e33acad40ab7570a76ffcbd2efbb875887966a5387e9d2f8fd1e8f6dd7cac3bd52f2f3aded32319445781e2e869e377ed7409d37fd855a46f8f659f180cdfb8dd13454f247715c0193356925e087b6e2000ddcc89476f062404584bfd183b412a30e6202156c45112f0462e9aa98f2edb500b096e6956ba04be091f40176d091cd3e173125a173f7295c4127779872a0162ea204463f99a13bd45e2b1969778db31077a18accd809755d14e0ce4b81baefe196719961ed3fd2b0fe060dc16756114ed95072203c5f298690cdfe1f3cf6960479db114f381b9da5944cbdc85183a7b8f958048bd2dbe3b1a05915bfa55e6a2975c6160d7dfd3330b7570390dafca7fcfca47a6e631130ea47af5d068152ae0f5283884568385c87a7da3c96ab6785d3efe951bac53faf25ea767404aa2dab952eb8e7aef9cdbeae931944ab02ae144d52def5ef89a9449155c5b5c1d5660d26f993a4a75b51e4473c7dc3f56637987e5c4cfab5afc1d93b322751a43546948bb658a51109526bae477fca5ff518c5382e762ee6fbd376a432d9eaae48e4a9717b57ad4b84df6bc0f3358116d0a5ef2952bc7671365f8ac47a6e2bd4f28a136482a597ae07aec0e3074fc077db38038e061a3b5b26ef62a37177f000ecd3677e7677806f0db5b6f28dadcc090b0ca1008538cf6b79186f0f46bceb28a84f13d42557476ff97243dd6364389cdb2e909217fa76f36251a57145dae4cf12b266b4173ee4df5a89962d9b5d211670c612be56419bdf37e52f11729b642a34afb0f969674ad3e7f1790c340f29515ce57f0093a10eab16d1fb615a336fb776a27663ccd19ccbdf35ea10b27a3259d2b890d7faf44b0bb1d241a01a2c394b5dedddf2d1e436ddbeacd0689909e2256188498829939ad6a54eca79dcde0df1dedc6952602bfb893df4c9c0a5c3a7e63c1a28fe73b2d8f94d2814d4e6d3cd37f8d0a3bbe1f73366d376a50f745be1dfe7959885669811eccf36b323cca1d8b3558048c414ecafa6fb62d004a772fed0a2ba118ebf9c2904663712081a05464eb9213b5304db68590cb4ecbd3a502662a65b5f9b75a0242f696edf68ce21bfca47bb002703b15c642335029387439c5c1523f14014996f212e741026eb996c5e0d06ca8c996790c3fac58ab36e2063b5bdec68aa516de31dafcbb3295549bedeafc71ee4c6b9ae7ca84a02b2c86dd44aa42eaf7308373fffed002021b00f70b3bc70b7f35b7349b3340e59e98a56b2e4a2d3c1bdec239efc0d5dc2badf1d0e9c430d1d6841114284a453fd6d93217910afe319bc21560b853272962f966b857d4c39412282286a245b317f5142aac9237f815f0008ecbce338bca1d726c5f027267c114eee0bb91b3f2ae4fa9396f1cddc1ac8673a43d3ab7a721702de921147c54c3b8cd66ce7bdd3c1f8054dab1c16e4984a8e0f8b4c9ea88779671b562518ecc9bfd2311d5e3bce2a51d6a88ea98b025b3916314f0c835395e8741b8754892f8ca267b795087ce6e5769dd4b792776abe075fc558c309dc59d4c17049590bf4d1b09e0198cddc8ff3a9169d9dd69a0d405926df4dad10ce4dcb488dbd2ce6fd1ad2b6b1fd069a89832dcb8ee115f189cf3f1e34f75271a8631fcc74ee80f79463dd2b2526f786ed865a06ba086e6b71b20db1094fbc6966afc55790f2d8ffb32646d68dbe21dacb1c934899d8b56825ed013c16dd241bf69ce1897d8bf627114d8420e43fba6b8009154ad118fb51af60044ae278e25e5a09a4b1c8a198d0aa357d389335cd01a03442ccd676784d61ee3aaf3fbf6634d5e896eed90ad304f798543c8542f220155d96edb30d361cbe755f267a42fa1d62814e2e888141ff1b4b1f5df2e0e607e6239a8ff71a57f733310b6203e0996eb3f8fd90a31af64b9896011c2b3da1dfceb9071f2196ac0f57546d264e35b8374b5f6c67484d582e451d675ce83ba1c055c0e1529c2a09421afe5ae750211e251e99ba1954eb4f2308444bc875d5bb4d4723167dfcd8944ee40d1e2e991844a74290bfbf4078d71e2280a6d46ab7bc64a369528dc5753d8d1e62995f1dcdbe1eeafb4e53581a9c61d8ede06cbf6080682a50766be03060a8fae30b7044832bc7b952c3e457efa53e6eccc8555c250d86b2576737e331b238b3b3f1ae8e9ecaff843653e9286bf3c486a300bcd7a9e3b1664539e989a23e529646985d1932262aecc724cdb3b3246c98cfb43d32235e3948478be1b57a5f1e19d3b25991c69c507a0d36791218522d436ebde1cefb9e7d30bbfe3b3bbf31dad3e32410a777dc5a673820227546bf88c91726ae439c6186519d3604e5e1c86a898e23a8abe4bf05563e44fcd9f0a328cebd66128c58adf51a85378ec0e762b9d11f94012148ef97a71bf496c745e49910949b1fb766e4c49afbb74d4d2712d45e8bb7761207d87ab27eb1e03ae26c3aa7f1295b4c1458479218b6cd446e0c162107fc155411d228cb3a2cfb4a6137f50cd80e30974c0a095e13598dfcc64b26e06c7dd195188e643687af083abc31755f0a9a8f5cb079961c277eedb1ddc429b197ef2799fbc5ea4e47deb7658fc95fa01a778c8cc3adb623f21205e6af04d3cc9d1a96b61481b832ed0954835e4af953870c459f6ed83c84ccca0cff9a65b40b7e1dfd9135207465d79ad7461eb43973381fa95399a7e1a7fe25d33fab636dfe283d90e14db9d417afcbbe9637e0d3a598ec169981fc9538e0ce3c0721f7e669da2f79f325c751fe0825daa9b732fb4fd23bcf3ec328ae50be2b263d63454bed7dcae9457f9e3023f752ff8aa54557f1c5d89fa1c3d82e4b93c15e1a44347728f2e8797c6a4966d15c220bb88381145a7cd071fb1f6f195be1b819c3eea01bf21af6a748dbe35caa0dc2a9f6d3d47db78730e899518d31dd8915647d78494fd7f859a84d1acf54815a8ad7084e4f9d179204ae981a63e03ac4a3bef7c628c432ab8acc1fa88b6708e7e679e59bed739094e276cbc3ab340faa14ec9645970ead45359ae46a5e6c72e8a5e268e36eec571c3ae59784e686c99fb1247984714a800b8528eb89b484b8dccbe9965417fc3db2557fc44f76f22b93817138e545fab757f28ded25d276927f69e054594f3b5527bbfe6591a2f80dec335199db9216de73f2d3470b2d8fe670e0a07cecfc1e53141c0e85b6f5ffdd5a0c48d1530fdee6156e748450c92e6c90809b4ecd7cf3349f1564d21a6f53fc18dae2f31b3d6223fe8df1cadaa7163550787f6fb887b0a09d3aae1e3da08e48514b0fd109b822f96f0d52f061dc3fb08f794056d9a2e1310143a5cca552616d4817cf45145470a513b758b06a432f1a67bffe202fcb259c40ec220819b1d97a6265d33030b2cdd01e76878f5a27d1cbbea24fa8c7bae61937d4824b5df06a93f1d667c03d0d10843643c4e16d6f34de985726a432e41164f79801fc994fe886cad2a2989b37d48948590b844607b9df24f814df83dea981c3ad91ecc56267336c8c598aba1d5ab963255d23861608cfa8b389704e05054eee2d566ceefcd57e1c54105bd05afa3690b50d4c3f8b1d9f9908a270b236b567d22c080670f6021f2adc97cd46a3d6cd5409189a996c5d5c11f384aa26068d346fcdccb4e37907c46076a5d2b4f4753e7b76702dac6dc485ab40d5b52661a9e8d20eaf16c89017c371dd83948b50dbe4198ac000161c33bd9f43c042c628beed7585a2782f739f00c27173dcc03bbd4082f8250dfb766be73d1c6ca704ae6a5510f70fd90c9c056ad1131fc7f20792ee62e021ad1ab281c51ec8dea60fda24a288d4dbef454da9f972574efccd0716ccffb3a7ba77f048d06d44c83e760ec8797bbf14df3f7a1753f4118e5a66827bfeb75e81fc4b21d54fd94ef54ce9a67476f458ccd21a1cdfa880cd3d1de1988500c41708d02173a5a239f5ea7463cc88ac9c10795cc331a6a1211a3187c6bcee1d6a50092de8e79871791b20f11c71f90e89526eba3d917a499f738d503c3ce4f1273304c7e2636f78a500e392cec347895a79fc2723ac4b2e91f42228c4f557bf5756930feff6fca8541d2c41018e856af98e5cda6f7a184c987236db80385cbd6b67407d2f35a8ff8941e", 0x1000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)="0599c77146e1fe2247d180256fc6243084da8bba7baad21a53a12b44b9ed647c3efc2aa42858822241b1c03bc7b39c5d1a35f28b0795e7c03e1e259825407cdd9186f821613d01a970d36531f05e211f7af086ea05dc8c464341f8f061dd458856c556b92f98a47e7280a5a5b145b9bc748337bf2ffc5e27ac80cfd426690fde1ae9f8e93f01aaeb443d19333ba8cdc7c9411e7552c03e0471e049ef4aadff080210ed235da1aecafa3bfb8578f98d011f35c8814f8894c01f29026be65c6aec5ac148a4512622699e6722d0a4b24a7a03537f81c156b395cf521c29ad1732923439624e4a34d23cedd30477d25f5383cb773be254abe3906d9c333db08e941cbee549eee73319737f3a0bb53647c7c0d91b0b02766b0e31fcbeae77c1912447cb705e0e82b0271558e4684f16455b915e6f42d001fcb5b4363a673c28cb0cc434f916ce77a974dcf2ace9c2a42584ece5c9af57164a50e12b35dd35d9f4e54d5d7e173e8d35bd51d89027b5a9827d0175a4bc40b1b2ebcbe99f8f522c86596108276b2154743382982de4f367114dbde1955ec8e089d181414e9bc2f8006d7d5e062e334221a7da276cdd03efb84ef8d7dab87012cbdf2348d4eb105198fc9b08ec6787b06a80b25fa32b7cdfacc692e2e432c6cf37f7086c115f0504fd5d9bb6e72cc99e9537152d04fcd1dfb6a0c6139ab72fece8d781001733ac74fa2b7cc1562da4b7b8407147936293dc2940a60dcb6e548cbd72b6bf766cc567099a610919842855b4cc73b61ba197c8c180da7e1ee88b4f0efcfebd04b8e4578a49a9cf9e91ee8b6e9439905a3e5398990c7d44d0882eb3821faa16061c5454b9e88a86ad3bf538156d97b2ab5a4dfcfd246928e83993e9604f10f304d4e0a20efebbfda049e49934d42c7daada5606c8e37497fab272b63b3571a0bdc50a34e4eede44d9b7c006e1324254a67f8c21191fe86de5f1340fce68ea1b1f5d3fe03441a4bd2e94e708b74a51a4ee7a9c560a55711f40ab97840e912d322e7751e6ef8ae07bdace71c77a233c4685449baed2c526ddd55c7e8add9aa9f576f4467edfbfa3d701bd14d09ab3d2bcfb9caca602fc4ab28ad87c2c4c795f9b49ff48f047159b68566fc07aaf27111ee1461078b2839db5889a457f08499cc5d2454faefa54b413e16c33bf214be9d1c27c8a43aa0d15210a80e69a6efe02d5c498efe22db6cb628dbe7062cdf59ee422bc539c1b79c2a691afb1614747695660231cde2044efd986f7bb431076a7f55b53ea26fd9f5d2b40704ae14ee80b67e5e60322128c176eaec92a1c2b18281e8a7f6930b9d1d4a7f331ce0a56c25d7832dc588006667c6685237f69cc20407b43d406c15d35b649796f4699f38233f13341a622b06c5d988a61ff0bb890295a1622df6233ac6c76daa2aefb99fb658ae1483c9b1c50232d0b089fa031b7c116d37ae3fecdd7967d8f71d0e0afbdfba6a80cee44a29d0437191289e7adfed802c6c6def5b6daf77f9a1c3ef871b793227ee74b0dd64e3a84e15239dbb71e76a1c1a424054fc1684eca10581b96a34b01056ef0856e27cf6c4eaf389fdae045963858751822d3c496d0e14b2ed584b51550e8245c367d82db2bba04662dbafd85f8f8ebdd5efbc30dc21146ca400e33acad40ab7570a76ffcbd2efbb875887966a5387e9d2f8fd1e8f6dd7cac3bd52f2f3aded32319445781e2e869e377ed7409d37fd855a46f8f659f180cdfb8dd13454f247715c0193356925e087b6e2000ddcc89476f062404584bfd183b412a30e6202156c45112f0462e9aa98f2edb500b096e6956ba04be091f40176d091cd3e173125a173f7295c4127779872a0162ea204463f99a13bd45e2b1969778db31077a18accd809755d14e0ce4b81baefe196719961ed3fd2b0fe060dc16756114ed95072203c5f298690cdfe1f3cf6960479db114f381b9da5944cbdc85183a7b8f958048bd2dbe3b1a05915bfa55e6a2975c6160d7dfd3330b7570390dafca7fcfca47a6e631130ea47af5d068152ae0f5283884568385c87a7da3c96ab6785d3efe951bac53faf25ea767404aa2dab952eb8e7aef9cdbeae931944ab02ae144d52def5ef89a9449155c5b5c1d5660d26f993a4a75b51e4473c7dc3f56637987e5c4cfab5afc1d93b322751a43546948bb658a51109526bae477fca5ff518c5382e762ee6fbd376a432d9eaae48e4a9717b57ad4b84df6bc0f3358116d0a5ef2952bc7671365f8ac47a6e2bd4f28a136482a597ae07aec0e3074fc077db38038e061a3b5b26ef62a37177f000ecd3677e7677806f0db5b6f28dadcc090b0ca1008538cf6b79186f0f46bceb28a84f13d42557476ff97243dd6364389cdb2e909217fa76f36251a57145dae4cf12b266b4173ee4df5a89962d9b5d211670c612be56419bdf37e52f11729b642a34afb0f969674ad3e7f1790c340f29515ce57f0093a10eab16d1fb615a336fb776a27663ccd19ccbdf35ea10b27a3259d2b890d7faf44b0bb1d241a01a2c394b5dedddf2d1e436ddbeacd0689909e2256188498829939ad6a54eca79dcde0df1dedc6952602bfb893df4c9c0a5c3a7e63c1a28fe73b2d8f94d2814d4e6d3cd37f8d0a3bbe1f73366d376a50f745be1dfe7959885669811eccf36b323cca1d8b3558048c414ecafa6fb62d004a772fed0a2ba118ebf9c2904663712081a05464eb9213b5304db68590cb4ecbd3a502662a65b5f9b75a0242f696edf68ce21bfca47bb002703b15c642335029387439c5c1523f14014996f212e741026eb996c5e0d06ca8c996790c3fac58ab36e2063b5bdec68aa516de31dafcbb3295549bedeafc71ee4c6b9ae7ca84a02b2c86dd44aa42eaf7308373fffed002021b00f70b3bc70b7f35b7349b3340e59e98a56b2e4a2d3c1bdec239efc0d5dc2badf1d0e9c430d1d6841114284a453fd6d93217910afe319bc21560b853272962f966b857d4c39412282286a245b317f5142aac9237f815f0008ecbce338bca1d726c5f027267c114eee0bb91b3f2ae4fa9396f1cddc1ac8673a43d3ab7a721702de921147c54c3b8cd66ce7bdd3c1f8054dab1c16e4984a8e0f8b4c9ea88779671b562518ecc9bfd2311d5e3bce2a51d6a88ea98b025b3916314f0c835395e8741b8754892f8ca267b795087ce6e5769dd4b792776abe075fc558c309dc59d4c17049590bf4d1b09e0198cddc8ff3a9169d9dd69a0d405926df4dad10ce4dcb488dbd2ce6fd1ad2b6b1fd069a89832dcb8ee115f189cf3f1e34f75271a8631fcc74ee80f79463dd2b2526f786ed865a06ba086e6b71b20db1094fbc6966afc55790f2d8ffb32646d68dbe21dacb1c934899d8b56825ed013c16dd241bf69ce1897d8bf627114d8420e43fba6b8009154ad118fb51af60044ae278e25e5a09a4b1c8a198d0aa357d389335cd01a03442ccd676784d61ee3aaf3fbf6634d5e896eed90ad304f798543c8542f220155d96edb30d361cbe755f267a42fa1d62814e2e888141ff1b4b1f5df2e0e607e6239a8ff71a57f733310b6203e0996eb3f8fd90a31af64b9896011c2b3da1dfceb9071f2196ac0f57546d264e35b8374b5f6c67484d582e451d675ce83ba1c055c0e1529c2a09421afe5ae750211e251e99ba1954eb4f2308444bc875d5bb4d4723167dfcd8944ee40d1e2e991844a74290bfbf4078d71e2280a6d46ab7bc64a369528dc5753d8d1e62995f1dcdbe1eeafb4e53581a9c61d8ede06cbf6080682a50766be03060a8fae30b7044832bc7b952c3e457efa53e6eccc8555c250d86b2576737e331b238b3b3f1ae8e9ecaff843653e9286bf3c486a300bcd7a9e3b1664539e989a23e529646985d1932262aecc724cdb3b3246c98cfb43d32235e3948478be1b57a5f1e19d3b25991c69c507a0d36791218522d436ebde1cefb9e7d30bbfe3b3bbf31dad3e32410a777dc5a673820227546bf88c91726ae439c6186519d3604e5e1c86a898e23a8abe4bf05563e44fcd9f0a328cebd66128c58adf51a85378ec0e762b9d11f94012148ef97a71bf496c745e49910949b1fb766e4c49afbb74d4d2712d45e8bb7761207d87ab27eb1e03ae26c3aa7f1295b4c1458479218b6cd446e0c162107fc155411d228cb3a2cfb4a6137f50cd80e30974c0a095e13598dfcc64b26e06c7dd195188e643687af083abc31755f0a9a8f5cb079961c277eedb1ddc429b197ef2799fbc5ea4e47deb7658fc95fa01a778c8cc3adb623f21205e6af04d3cc9d1a96b61481b832ed0954835e4af953870c459f6ed83c84ccca0cff9a65b40b7e1dfd9135207465d79ad7461eb43973381fa95399a7e1a7fe25d33fab636dfe283d90e14db9d417afcbbe9637e0d3a598ec169981fc9538e0ce3c0721f7e669da2f79f325c751fe0825daa9b732fb4fd23bcf3ec328ae50be2b263d63454bed7dcae9457f9e3023f752ff8aa54557f1c5d89fa1c3d82e4b93c15e1a44347728f2e8797c6a4966d15c220bb88381145a7cd071fb1f6f195be1b819c3eea01bf21af6a748dbe35caa0dc2a9f6d3d47db78730e899518d31dd8915647d78494fd7f859a84d1acf54815a8ad7084e4f9d179204ae981a63e03ac4a3bef7c628c432ab8acc1fa88b6708e7e679e59bed739094e276cbc3ab340faa14ec9645970ead45359ae46a5e6c72e8a5e268e36eec571c3ae59784e686c99fb1247984714a800b8528eb89b484b8dccbe9965417fc3db2557fc44f76f22b93817138e545fab757f28ded25d276927f69e054594f3b5527bbfe6591a2f80dec335199db9216de73f2d3470b2d8fe670e0a07cecfc1e53141c0e85b6f5ffdd5a0c48d1530fdee6156e748450c92e6c90809b4ecd7cf3349f1564d21a6f53fc18dae2f31b3d6223fe8df1cadaa7163550787f6fb887b0a09d3aae1e3da08e48514b0fd109b822f96f0d52f061dc3fb08f794056d9a2e1310143a5cca552616d4817cf45145470a513b758b06a432f1a67bffe202fcb259c40ec220819b1d97a6265d33030b2cdd01e76878f5a27d1cbbea24fa8c7bae61937d4824b5df06a93f1d667c03d0d10843643c4e16d6f34de985726a432e41164f79801fc994fe886cad2a2989b37d48948590b844607b9df24f814df83dea981c3ad91ecc56267336c8c598aba1d5ab963255d23861608cfa8b389704e05054eee2d566ceefcd57e1c54105bd05afa3690b50d4c3f8b1d9f9908a270b236b567d22c080670f6021f2adc97cd46a3d6cd5409189a996c5d5c11f384aa26068d346fcdccb4e37907c46076a5d2b4f4753e7b76702dac6dc485ab40d5b52661a9e8d20eaf16c89017c371dd83948b50dbe4198ac000161c33bd9f43c042c628beed7585a2782f739f00c27173dcc03bbd4082f8250dfb766be73d1c6ca704ae6a5510f70fd90c9c056ad1131fc7f20792ee62e021ad1ab281c51ec8dea60fda24a288d4dbef454da9f972574efccd0716ccffb3a7ba77f048d06d44c83e760ec8797bbf14df3f7a1753f4118e5a66827bfeb75e81fc4b21d54fd94ef54ce9a67476f458ccd21a1cdfa880cd3d1de1988500c41708d02173a5a239f5ea7463cc88ac9c10795cc331a6a1211a3187c6bcee1d6a50092de8e79871791b20f11c71f90e89526eba3d917a499f738d503c3ce4f1273304c7e2636f78a500e392cec347895a79fc2723ac4b2e91f42228c4f557bf5756930feff6fca8541d2c41018e856af98e5cda6f7a184c987236db80385cbd6b67407d2f35a8ff8941e", 0x1000) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x2000000}, 0x48) 01:04:11 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x8, 0x800}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x8, 0x800}, 0x48) (async) 01:04:11 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f00000000c0), 0x4) syz_open_dev$sndmidi(&(0x7f0000000000), 0xfffffffffffffe9d, 0x400000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:11 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000240)={0xa, &(0x7f0000000000)=[{0x3ff, 0xfa, 0x0, 0x5}, {0x1000, 0x7, 0x1, 0x3}, {0x2, 0x7f, 0x2, 0x9c8}, {0xa0, 0x4, 0x4, 0xa6}, {0x3f, 0x6, 0x20, 0x9}, {0x9, 0x12, 0x69, 0x4}, {0x1, 0x2, 0x80, 0x3}, {0xd9, 0xf7, 0x7, 0x9}, {0x6, 0x7a, 0x8, 0x2}, {0x8, 0x80, 0x81, 0x80}]}) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000001c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000100)={r2, 0x1, 0xffffffffffffffff, 0x528fba79, 0x80000}) (async) ioctl$PPPIOCSMRU1(r0, 0x40047452, &(0x7f0000000180)=0xfc9d) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xd, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0xa, &(0x7f0000000140)=[{0x8, 0x8, 0x81, 0x80}, {0x1, 0x47, 0x3a, 0x10001}, {0x94, 0x0, 0xf0, 0x6}, {0x2, 0x81, 0x2}, {0x9, 0x85, 0x0, 0x80000000}, {0xffff, 0x3, 0x51}, {0x3, 0x40, 0x5, 0x1}, {0xff12, 0xfc, 0xfa, 0x2}, {0xffff, 0x2, 0x2, 0x1}, {0x40, 0x20, 0x80, 0x7}]}) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0xf00e, 0x101800) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0xa, &(0x7f0000000140)=[{0x8, 0x8, 0x81, 0x80}, {0x1, 0x47, 0x3a, 0x10001}, {0x94, 0x0, 0xf0, 0x6}, {0x2, 0x81, 0x2}, {0x9, 0x85, 0x0, 0x80000000}, {0xffff, 0x3, 0x51}, {0x3, 0x40, 0x5, 0x1}, {0xff12, 0xfc, 0xfa, 0x2}, {0xffff, 0x2, 0x2, 0x1}, {0x40, 0x20, 0x80, 0x7}]}) (async) syz_open_dev$dri(&(0x7f00000001c0), 0xf00e, 0x101800) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x3000000}, 0x48) 01:04:11 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f00000000c0), 0x4) (async) syz_open_dev$sndmidi(&(0x7f0000000000), 0xfffffffffffffe9d, 0x400000) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (rerun: 64) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000140)="0599c77146e1fe2247d180256fc6243084da8bba7baad21a53a12b44b9ed647c3efc2aa42858822241b1c03bc7b39c5d1a35f28b0795e7c03e1e259825407cdd9186f821613d01a970d36531f05e211f7af086ea05dc8c464341f8f061dd458856c556b92f98a47e7280a5a5b145b9bc748337bf2ffc5e27ac80cfd426690fde1ae9f8e93f01aaeb443d19333ba8cdc7c9411e7552c03e0471e049ef4aadff080210ed235da1aecafa3bfb8578f98d011f35c8814f8894c01f29026be65c6aec5ac148a4512622699e6722d0a4b24a7a03537f81c156b395cf521c29ad1732923439624e4a34d23cedd30477d25f5383cb773be254abe3906d9c333db08e941cbee549eee73319737f3a0bb53647c7c0d91b0b02766b0e31fcbeae77c1912447cb705e0e82b0271558e4684f16455b915e6f42d001fcb5b4363a673c28cb0cc434f916ce77a974dcf2ace9c2a42584ece5c9af57164a50e12b35dd35d9f4e54d5d7e173e8d35bd51d89027b5a9827d0175a4bc40b1b2ebcbe99f8f522c86596108276b2154743382982de4f367114dbde1955ec8e089d181414e9bc2f8006d7d5e062e334221a7da276cdd03efb84ef8d7dab87012cbdf2348d4eb105198fc9b08ec6787b06a80b25fa32b7cdfacc692e2e432c6cf37f7086c115f0504fd5d9bb6e72cc99e9537152d04fcd1dfb6a0c6139ab72fece8d781001733ac74fa2b7cc1562da4b7b8407147936293dc2940a60dcb6e548cbd72b6bf766cc567099a610919842855b4cc73b61ba197c8c180da7e1ee88b4f0efcfebd04b8e4578a49a9cf9e91ee8b6e9439905a3e5398990c7d44d0882eb3821faa16061c5454b9e88a86ad3bf538156d97b2ab5a4dfcfd246928e83993e9604f10f304d4e0a20efebbfda049e49934d42c7daada5606c8e37497fab272b63b3571a0bdc50a34e4eede44d9b7c006e1324254a67f8c21191fe86de5f1340fce68ea1b1f5d3fe03441a4bd2e94e708b74a51a4ee7a9c560a55711f40ab97840e912d322e7751e6ef8ae07bdace71c77a233c4685449baed2c526ddd55c7e8add9aa9f576f4467edfbfa3d701bd14d09ab3d2bcfb9caca602fc4ab28ad87c2c4c795f9b49ff48f047159b68566fc07aaf27111ee1461078b2839db5889a457f08499cc5d2454faefa54b413e16c33bf214be9d1c27c8a43aa0d15210a80e69a6efe02d5c498efe22db6cb628dbe7062cdf59ee422bc539c1b79c2a691afb1614747695660231cde2044efd986f7bb431076a7f55b53ea26fd9f5d2b40704ae14ee80b67e5e60322128c176eaec92a1c2b18281e8a7f6930b9d1d4a7f331ce0a56c25d7832dc588006667c6685237f69cc20407b43d406c15d35b649796f4699f38233f13341a622b06c5d988a61ff0bb890295a1622df6233ac6c76daa2aefb99fb658ae1483c9b1c50232d0b089fa031b7c116d37ae3fecdd7967d8f71d0e0afbdfba6a80cee44a29d0437191289e7adfed802c6c6def5b6daf77f9a1c3ef871b793227ee74b0dd64e3a84e15239dbb71e76a1c1a424054fc1684eca10581b96a34b01056ef0856e27cf6c4eaf389fdae045963858751822d3c496d0e14b2ed584b51550e8245c367d82db2bba04662dbafd85f8f8ebdd5efbc30dc21146ca400e33acad40ab7570a76ffcbd2efbb875887966a5387e9d2f8fd1e8f6dd7cac3bd52f2f3aded32319445781e2e869e377ed7409d37fd855a46f8f659f180cdfb8dd13454f247715c0193356925e087b6e2000ddcc89476f062404584bfd183b412a30e6202156c45112f0462e9aa98f2edb500b096e6956ba04be091f40176d091cd3e173125a173f7295c4127779872a0162ea204463f99a13bd45e2b1969778db31077a18accd809755d14e0ce4b81baefe196719961ed3fd2b0fe060dc16756114ed95072203c5f298690cdfe1f3cf6960479db114f381b9da5944cbdc85183a7b8f958048bd2dbe3b1a05915bfa55e6a2975c6160d7dfd3330b7570390dafca7fcfca47a6e631130ea47af5d068152ae0f5283884568385c87a7da3c96ab6785d3efe951bac53faf25ea767404aa2dab952eb8e7aef9cdbeae931944ab02ae144d52def5ef89a9449155c5b5c1d5660d26f993a4a75b51e4473c7dc3f56637987e5c4cfab5afc1d93b322751a43546948bb658a51109526bae477fca5ff518c5382e762ee6fbd376a432d9eaae48e4a9717b57ad4b84df6bc0f3358116d0a5ef2952bc7671365f8ac47a6e2bd4f28a136482a597ae07aec0e3074fc077db38038e061a3b5b26ef62a37177f000ecd3677e7677806f0db5b6f28dadcc090b0ca1008538cf6b79186f0f46bceb28a84f13d42557476ff97243dd6364389cdb2e909217fa76f36251a57145dae4cf12b266b4173ee4df5a89962d9b5d211670c612be56419bdf37e52f11729b642a34afb0f969674ad3e7f1790c340f29515ce57f0093a10eab16d1fb615a336fb776a27663ccd19ccbdf35ea10b27a3259d2b890d7faf44b0bb1d241a01a2c394b5dedddf2d1e436ddbeacd0689909e2256188498829939ad6a54eca79dcde0df1dedc6952602bfb893df4c9c0a5c3a7e63c1a28fe73b2d8f94d2814d4e6d3cd37f8d0a3bbe1f73366d376a50f745be1dfe7959885669811eccf36b323cca1d8b3558048c414ecafa6fb62d004a772fed0a2ba118ebf9c2904663712081a05464eb9213b5304db68590cb4ecbd3a502662a65b5f9b75a0242f696edf68ce21bfca47bb002703b15c642335029387439c5c1523f14014996f212e741026eb996c5e0d06ca8c996790c3fac58ab36e2063b5bdec68aa516de31dafcbb3295549bedeafc71ee4c6b9ae7ca84a02b2c86dd44aa42eaf7308373fffed002021b00f70b3bc70b7f35b7349b3340e59e98a56b2e4a2d3c1bdec239efc0d5dc2badf1d0e9c430d1d6841114284a453fd6d93217910afe319bc21560b853272962f966b857d4c39412282286a245b317f5142aac9237f815f0008ecbce338bca1d726c5f027267c114eee0bb91b3f2ae4fa9396f1cddc1ac8673a43d3ab7a721702de921147c54c3b8cd66ce7bdd3c1f8054dab1c16e4984a8e0f8b4c9ea88779671b562518ecc9bfd2311d5e3bce2a51d6a88ea98b025b3916314f0c835395e8741b8754892f8ca267b795087ce6e5769dd4b792776abe075fc558c309dc59d4c17049590bf4d1b09e0198cddc8ff3a9169d9dd69a0d405926df4dad10ce4dcb488dbd2ce6fd1ad2b6b1fd069a89832dcb8ee115f189cf3f1e34f75271a8631fcc74ee80f79463dd2b2526f786ed865a06ba086e6b71b20db1094fbc6966afc55790f2d8ffb32646d68dbe21dacb1c934899d8b56825ed013c16dd241bf69ce1897d8bf627114d8420e43fba6b8009154ad118fb51af60044ae278e25e5a09a4b1c8a198d0aa357d389335cd01a03442ccd676784d61ee3aaf3fbf6634d5e896eed90ad304f798543c8542f220155d96edb30d361cbe755f267a42fa1d62814e2e888141ff1b4b1f5df2e0e607e6239a8ff71a57f733310b6203e0996eb3f8fd90a31af64b9896011c2b3da1dfceb9071f2196ac0f57546d264e35b8374b5f6c67484d582e451d675ce83ba1c055c0e1529c2a09421afe5ae750211e251e99ba1954eb4f2308444bc875d5bb4d4723167dfcd8944ee40d1e2e991844a74290bfbf4078d71e2280a6d46ab7bc64a369528dc5753d8d1e62995f1dcdbe1eeafb4e53581a9c61d8ede06cbf6080682a50766be03060a8fae30b7044832bc7b952c3e457efa53e6eccc8555c250d86b2576737e331b238b3b3f1ae8e9ecaff843653e9286bf3c486a300bcd7a9e3b1664539e989a23e529646985d1932262aecc724cdb3b3246c98cfb43d32235e3948478be1b57a5f1e19d3b25991c69c507a0d36791218522d436ebde1cefb9e7d30bbfe3b3bbf31dad3e32410a777dc5a673820227546bf88c91726ae439c6186519d3604e5e1c86a898e23a8abe4bf05563e44fcd9f0a328cebd66128c58adf51a85378ec0e762b9d11f94012148ef97a71bf496c745e49910949b1fb766e4c49afbb74d4d2712d45e8bb7761207d87ab27eb1e03ae26c3aa7f1295b4c1458479218b6cd446e0c162107fc155411d228cb3a2cfb4a6137f50cd80e30974c0a095e13598dfcc64b26e06c7dd195188e643687af083abc31755f0a9a8f5cb079961c277eedb1ddc429b197ef2799fbc5ea4e47deb7658fc95fa01a778c8cc3adb623f21205e6af04d3cc9d1a96b61481b832ed0954835e4af953870c459f6ed83c84ccca0cff9a65b40b7e1dfd9135207465d79ad7461eb43973381fa95399a7e1a7fe25d33fab636dfe283d90e14db9d417afcbbe9637e0d3a598ec169981fc9538e0ce3c0721f7e669da2f79f325c751fe0825daa9b732fb4fd23bcf3ec328ae50be2b263d63454bed7dcae9457f9e3023f752ff8aa54557f1c5d89fa1c3d82e4b93c15e1a44347728f2e8797c6a4966d15c220bb88381145a7cd071fb1f6f195be1b819c3eea01bf21af6a748dbe35caa0dc2a9f6d3d47db78730e899518d31dd8915647d78494fd7f859a84d1acf54815a8ad7084e4f9d179204ae981a63e03ac4a3bef7c628c432ab8acc1fa88b6708e7e679e59bed739094e276cbc3ab340faa14ec9645970ead45359ae46a5e6c72e8a5e268e36eec571c3ae59784e686c99fb1247984714a800b8528eb89b484b8dccbe9965417fc3db2557fc44f76f22b93817138e545fab757f28ded25d276927f69e054594f3b5527bbfe6591a2f80dec335199db9216de73f2d3470b2d8fe670e0a07cecfc1e53141c0e85b6f5ffdd5a0c48d1530fdee6156e748450c92e6c90809b4ecd7cf3349f1564d21a6f53fc18dae2f31b3d6223fe8df1cadaa7163550787f6fb887b0a09d3aae1e3da08e48514b0fd109b822f96f0d52f061dc3fb08f794056d9a2e1310143a5cca552616d4817cf45145470a513b758b06a432f1a67bffe202fcb259c40ec220819b1d97a6265d33030b2cdd01e76878f5a27d1cbbea24fa8c7bae61937d4824b5df06a93f1d667c03d0d10843643c4e16d6f34de985726a432e41164f79801fc994fe886cad2a2989b37d48948590b844607b9df24f814df83dea981c3ad91ecc56267336c8c598aba1d5ab963255d23861608cfa8b389704e05054eee2d566ceefcd57e1c54105bd05afa3690b50d4c3f8b1d9f9908a270b236b567d22c080670f6021f2adc97cd46a3d6cd5409189a996c5d5c11f384aa26068d346fcdccb4e37907c46076a5d2b4f4753e7b76702dac6dc485ab40d5b52661a9e8d20eaf16c89017c371dd83948b50dbe4198ac000161c33bd9f43c042c628beed7585a2782f739f00c27173dcc03bbd4082f8250dfb766be73d1c6ca704ae6a5510f70fd90c9c056ad1131fc7f20792ee62e021ad1ab281c51ec8dea60fda24a288d4dbef454da9f972574efccd0716ccffb3a7ba77f048d06d44c83e760ec8797bbf14df3f7a1753f4118e5a66827bfeb75e81fc4b21d54fd94ef54ce9a67476f458ccd21a1cdfa880cd3d1de1988500c41708d02173a5a239f5ea7463cc88ac9c10795cc331a6a1211a3187c6bcee1d6a50092de8e79871791b20f11c71f90e89526eba3d917a499f738d503c3ce4f1273304c7e2636f78a500e392cec347895a79fc2723ac4b2e91f42228c4f557bf5756930feff6fca8541d2c41018e856af98e5cda6f7a184c987236db80385cbd6b67407d2f35a8ff8941e", 0x1000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6, @in=@remote}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000000)=0xe8) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0xa, &(0x7f0000000140)=[{0x8, 0x8, 0x81, 0x80}, {0x1, 0x47, 0x3a, 0x10001}, {0x94, 0x0, 0xf0, 0x6}, {0x2, 0x81, 0x2}, {0x9, 0x85, 0x0, 0x80000000}, {0xffff, 0x3, 0x51}, {0x3, 0x40, 0x5, 0x1}, {0xff12, 0xfc, 0xfa, 0x2}, {0xffff, 0x2, 0x2, 0x1}, {0x40, 0x20, 0x80, 0x7}]}) (async) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0xf00e, 0x101800) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x8, 0x800}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x0, 0x0, 0x8, 0x800}, 0x48) (async) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x4000000}, 0x48) 01:04:11 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) (async) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6, @in=@remote}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000000)=0xe8) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0xfffffffd}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x1, 0x8}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0x400, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa8c, 0x1000, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) 01:04:11 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r1, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x28, r1, 0x100, 0xfff, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x48090}, 0x4) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x5000000}, 0x48) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x99, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6, @in=@remote}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000000)=0xe8) 01:04:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) (async) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0xfffffffd}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x1, 0x8}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0x400, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa8c, 0x1000, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0xfffffffd}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x1, 0x8}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) (async) syz_open_dev$dri(&(0x7f00000001c0), 0x400, 0x40000) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa8c, 0x1000, 0x9}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) (async) 01:04:11 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r1, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x28, r1, 0x100, 0xfff, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x48090}, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r1, 0x1}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x28, r1, 0x100, 0xfff, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x48090}, 0x4) (async) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x6000000}, 0x48) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x99, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x99, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) 01:04:11 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x100, 0x1}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x17, 0x6, 0x6, 0x1, 0x61, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x7000000}, 0x48) 01:04:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0xfffffffd}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x0, 0x1, 0x8}) (async, rerun: 64) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r1) r2 = syz_open_dev$dri(&(0x7f00000001c0), 0x400, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0xa8c, 0x1000, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:11 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r1, 0x1}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x28, r1, 0x100, 0xfff, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x48090}, 0x4) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x99, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) 01:04:11 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x100, 0x1}, 0x48) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x17, 0x6, 0x6, 0x1, 0x61, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x8000000}, 0x48) 01:04:11 executing program 2: clock_gettime(0x0, &(0x7f0000000000)) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000140)={0x1}) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000040)={0x77359400}, 0x10) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x1, 0x4, 0x80000000, 0x206, 0x1, 0x0, '\x00', r3}, 0x48) getpgrp(0xffffffffffffffff) r4 = getpgrp(0x0) syz_open_procfs$namespace(r4, 0x0) sched_rr_get_interval(r4, &(0x7f0000000180)) 01:04:11 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x100, 0x1}, 0x48) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x17, 0x6, 0x6, 0x1, 0x61, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) 01:04:11 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 2: clock_gettime(0x0, &(0x7f0000000000)) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000140)={0x1}) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000040)={0x77359400}, 0x10) (async) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000040)={0x77359400}, 0x10) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x1, 0x4, 0x80000000, 0x206, 0x1, 0x0, '\x00', r3}, 0x48) getpgrp(0xffffffffffffffff) (async) getpgrp(0xffffffffffffffff) r4 = getpgrp(0x0) syz_open_procfs$namespace(r4, 0x0) sched_rr_get_interval(r4, &(0x7f0000000180)) 01:04:11 executing program 1: sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf25030000000c0016000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4040) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl0\x00', &(0x7f0000000300)={'ip6tnl0\x00', r0, 0x2f, 0x5, 0x20, 0x2, 0x18, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x40, 0x40, 0x1ff, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6tnl0\x00', r0, 0x2f, 0xf0, 0x8, 0x4, 0x41, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8000, 0x40, 0x2, 0x6}}) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f00000001c0)) 01:04:11 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x1, 0x2, 0x1, 0x4, 0xffffffffffffffff, 0x2, '\x00', r1, r2, 0x2, 0x2, 0x4dae, 0x5}, 0x48) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x801) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r5, 0x100}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8046000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r5, 0x200, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x2, 0xa190, 0xb9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 1: sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf25030000000c0016000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4040) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl0\x00', &(0x7f0000000300)={'ip6tnl0\x00', r0, 0x2f, 0x5, 0x20, 0x2, 0x18, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x40, 0x40, 0x1ff, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6tnl0\x00', r0, 0x2f, 0xf0, 0x8, 0x4, 0x41, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8000, 0x40, 0x2, 0x6}}) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f00000001c0)) (async) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f00000001c0)) 01:04:11 executing program 2: clock_gettime(0x0, &(0x7f0000000000)) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000140)={0x1}) (async) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000040)={0x77359400}, 0x10) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r2, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x1, 0x4, 0x80000000, 0x206, 0x1, 0x0, '\x00', r3}, 0x48) getpgrp(0xffffffffffffffff) (async, rerun: 64) r4 = getpgrp(0x0) (rerun: 64) syz_open_procfs$namespace(r4, 0x0) (async) sched_rr_get_interval(r4, &(0x7f0000000180)) 01:04:11 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x9000000}, 0x48) 01:04:11 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x801) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r5, 0x100}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8046000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r5, 0x200, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x2, 0xa190, 0xb9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:11 executing program 1: sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf25030000000c0016000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4040) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf25030000000c0016000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4040) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl0\x00', &(0x7f0000000300)={'ip6tnl0\x00', r0, 0x2f, 0x5, 0x20, 0x2, 0x18, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x40, 0x40, 0x1ff, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6tnl0\x00', r0, 0x2f, 0xf0, 0x8, 0x4, 0x41, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8000, 0x40, 0x2, 0x6}}) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f00000001c0)) (async) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f00000001c0)) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) accept$nfc_llcp(r0, &(0x7f0000000200), &(0x7f0000000280)=0x60) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x100, 0xfffff145, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xffff}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x2600d051}, 0x4081) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:12 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:12 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x801) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r5, 0x100}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r5, 0x100}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8046000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r5, 0x200, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000100)={0x2, 0xa190, 0xb9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x1, 0x2, 0x1, 0x4, 0xffffffffffffffff, 0x2, '\x00', r1, r2, 0x2, 0x2, 0x4dae, 0x5}, 0x48) 01:04:12 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xa000000}, 0x48) 01:04:12 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) accept$nfc_llcp(r0, &(0x7f0000000200), &(0x7f0000000280)=0x60) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x100, 0xfffff145, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xffff}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x2600d051}, 0x4081) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) accept$nfc_llcp(r0, &(0x7f0000000200), &(0x7f0000000280)=0x60) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x100, 0xfffff145, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xffff}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x2600d051}, 0x4081) (async) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x4) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x4) (async) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:12 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x1, 0x2, 0x1, 0x4, 0xffffffffffffffff, 0x2, '\x00', r1, r2, 0x2, 0x2, 0x4dae, 0x5}, 0x48) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x1, 0x2, 0x1, 0x4, 0xffffffffffffffff, 0x2, '\x00', r1, r2, 0x2, 0x2, 0x4dae, 0x5}, 0x48) (async) 01:04:12 executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) accept$nfc_llcp(r0, &(0x7f0000000200), &(0x7f0000000280)=0x60) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x100, 0xfffff145, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xffff}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x2600d051}, 0x4081) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x4) (async) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) 01:04:12 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xb000000}, 0x48) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$dri(&(0x7f0000000080), 0x4, 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) 01:04:12 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) 01:04:12 executing program 1: ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)={'veth1\x00'}) write$tun(0xffffffffffffffff, &(0x7f0000000340)={@val={0x0, 0xdada}, @void, @eth={@random="72ffdd773f90", @broadcast, @val, {@x25={0x805, {0x0, 0x1, 0xf, "acd5c2841f7395ceb0bc97db80bb4ad34823a9e339b5d14858cb77c9b6c11e06fb26f35f5ccad0a9b2cccd4a5f2056aa58a7bdc573fcf6b06603f45130a4fa8d64fcd8d4689354416940af38f9a974be3250ec763fa8857a2f875e5e8cedf62abbc60b201ca22e7e8ed83414e467845cff2c1e6cb29b6163452c2ae6adb785739ed54df62e266b3ada8c4dc4cb575b154936beafe29635006a7a9d5a06dcfddeeac9f68958715c7a7414616f52d2c34710a55594efb88b54150b0d3b72f0528adb0c8a10f90ceddb62d58f0bbd486791436d26cfb2e91c0402758f2849022b192942a43c25db5d4f04cc5cd5"}}}}}, 0x109) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x4000, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000002c0)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0x20001000, 0x3, 0x8, 0xbde, r1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000100)=0x1) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) 01:04:12 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) syz_open_dev$dri(&(0x7f0000000080), 0x4, 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x4, 0x2) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) (async) 01:04:12 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}]}, &(0x7f0000000040)='syzkaller\x00', 0x7, 0x76, &(0x7f0000000100)=""/118, 0x40f00, 0x11, '\x00', 0x0, 0x11, r2, 0x8, &(0x7f0000000180)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x7fffffff, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000200)=[r3, r1]}, 0x80) 01:04:12 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xc000000}, 0x48) 01:04:12 executing program 1: ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)={'veth1\x00'}) write$tun(0xffffffffffffffff, &(0x7f0000000340)={@val={0x0, 0xdada}, @void, @eth={@random="72ffdd773f90", @broadcast, @val, {@x25={0x805, {0x0, 0x1, 0xf, "acd5c2841f7395ceb0bc97db80bb4ad34823a9e339b5d14858cb77c9b6c11e06fb26f35f5ccad0a9b2cccd4a5f2056aa58a7bdc573fcf6b06603f45130a4fa8d64fcd8d4689354416940af38f9a974be3250ec763fa8857a2f875e5e8cedf62abbc60b201ca22e7e8ed83414e467845cff2c1e6cb29b6163452c2ae6adb785739ed54df62e266b3ada8c4dc4cb575b154936beafe29635006a7a9d5a06dcfddeeac9f68958715c7a7414616f52d2c34710a55594efb88b54150b0d3b72f0528adb0c8a10f90ceddb62d58f0bbd486791436d26cfb2e91c0402758f2849022b192942a43c25db5d4f04cc5cd5"}}}}}, 0x109) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x4000, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000002c0)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0x20001000, 0x3, 0x8, 0xbde, r1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000100)=0x1) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)={'veth1\x00'}) (async) write$tun(0xffffffffffffffff, &(0x7f0000000340)={@val={0x0, 0xdada}, @void, @eth={@random="72ffdd773f90", @broadcast, @val, {@x25={0x805, {0x0, 0x1, 0xf, "acd5c2841f7395ceb0bc97db80bb4ad34823a9e339b5d14858cb77c9b6c11e06fb26f35f5ccad0a9b2cccd4a5f2056aa58a7bdc573fcf6b06603f45130a4fa8d64fcd8d4689354416940af38f9a974be3250ec763fa8857a2f875e5e8cedf62abbc60b201ca22e7e8ed83414e467845cff2c1e6cb29b6163452c2ae6adb785739ed54df62e266b3ada8c4dc4cb575b154936beafe29635006a7a9d5a06dcfddeeac9f68958715c7a7414616f52d2c34710a55594efb88b54150b0d3b72f0528adb0c8a10f90ceddb62d58f0bbd486791436d26cfb2e91c0402758f2849022b192942a43c25db5d4f04cc5cd5"}}}}}, 0x109) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x4000, 0x0) (async) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000002c0)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000240), 0x80) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0x20001000, 0x3, 0x8, 0xbde, r1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000100)=0x1) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) (async) 01:04:12 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 2: ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)) 01:04:12 executing program 4: openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}]}, &(0x7f0000000040)='syzkaller\x00', 0x7, 0x76, &(0x7f0000000100)=""/118, 0x40f00, 0x11, '\x00', 0x0, 0x11, r2, 0x8, &(0x7f0000000180)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x7fffffff, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000200)=[r3, r1]}, 0x80) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x4, 0x2) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) 01:04:12 executing program 5: r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=0x0, @ANYBLOB="04002cbd7000fcdbdf2504000000"], 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x40000) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x518480) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x40000009, 0x93, 0x1, 0x0, 0x0}) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r7, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r7, 0x81b, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8050) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r4, 0x54a3) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r5, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_bridge\x00'}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x3e7eadb030a899c2}, 0x91) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r8) accept$nfc_llcp(r4, &(0x7f0000000280), &(0x7f0000000340)=0x60) ioctl$PPPIOCGUNIT(r8, 0x80047456, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:12 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xd000000}, 0x48) 01:04:12 executing program 1: ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)={'veth1\x00'}) write$tun(0xffffffffffffffff, &(0x7f0000000340)={@val={0x0, 0xdada}, @void, @eth={@random="72ffdd773f90", @broadcast, @val, {@x25={0x805, {0x0, 0x1, 0xf, "acd5c2841f7395ceb0bc97db80bb4ad34823a9e339b5d14858cb77c9b6c11e06fb26f35f5ccad0a9b2cccd4a5f2056aa58a7bdc573fcf6b06603f45130a4fa8d64fcd8d4689354416940af38f9a974be3250ec763fa8857a2f875e5e8cedf62abbc60b201ca22e7e8ed83414e467845cff2c1e6cb29b6163452c2ae6adb785739ed54df62e266b3ada8c4dc4cb575b154936beafe29635006a7a9d5a06dcfddeeac9f68958715c7a7414616f52d2c34710a55594efb88b54150b0d3b72f0528adb0c8a10f90ceddb62d58f0bbd486791436d26cfb2e91c0402758f2849022b192942a43c25db5d4f04cc5cd5"}}}}}, 0x109) (async) write$tun(0xffffffffffffffff, &(0x7f0000000340)={@val={0x0, 0xdada}, @void, @eth={@random="72ffdd773f90", @broadcast, @val, {@x25={0x805, {0x0, 0x1, 0xf, "acd5c2841f7395ceb0bc97db80bb4ad34823a9e339b5d14858cb77c9b6c11e06fb26f35f5ccad0a9b2cccd4a5f2056aa58a7bdc573fcf6b06603f45130a4fa8d64fcd8d4689354416940af38f9a974be3250ec763fa8857a2f875e5e8cedf62abbc60b201ca22e7e8ed83414e467845cff2c1e6cb29b6163452c2ae6adb785739ed54df62e266b3ada8c4dc4cb575b154936beafe29635006a7a9d5a06dcfddeeac9f68958715c7a7414616f52d2c34710a55594efb88b54150b0d3b72f0528adb0c8a10f90ceddb62d58f0bbd486791436d26cfb2e91c0402758f2849022b192942a43c25db5d4f04cc5cd5"}}}}}, 0x109) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x4000, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000002c0)) (async) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000002c0)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0x20001000, 0x3, 0x8, 0xbde, r1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000100)=0x1) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) 01:04:12 executing program 2: ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)) 01:04:12 executing program 4: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x0, 0x1}, 0x48) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r3) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}]}, &(0x7f0000000040)='syzkaller\x00', 0x7, 0x76, &(0x7f0000000100)=""/118, 0x40f00, 0x11, '\x00', 0x0, 0x11, r2, 0x8, &(0x7f0000000180)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x7fffffff, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000200)=[r3, r1]}, 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}]}, &(0x7f0000000040)='syzkaller\x00', 0x7, 0x76, &(0x7f0000000100)=""/118, 0x40f00, 0x11, '\x00', 0x0, 0x11, r2, 0x8, &(0x7f0000000180)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x7fffffff, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000200)=[r3, r1]}, 0x80) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8000800, 0x5}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x7ff, 0xff, 0x5, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x5787, 0x101, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:12 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xe000000}, 0x48) 01:04:12 executing program 5: r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) (async) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=0x0, @ANYBLOB="04002cbd7000fcdbdf2504000000"], 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x40000) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x518480) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x40000009, 0x93, 0x1, 0x0, 0x0}) (async, rerun: 64) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r7, 0x1}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r7, 0x81b, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8050) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r4, 0x54a3) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r5, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_bridge\x00'}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x3e7eadb030a899c2}, 0x91) (rerun: 64) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r8) (async, rerun: 64) accept$nfc_llcp(r4, &(0x7f0000000280), &(0x7f0000000340)=0x60) (async, rerun: 64) ioctl$PPPIOCGUNIT(r8, 0x80047456, &(0x7f0000000080)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:12 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)={&(0x7f00000002c0)='./file0\x00', 0x0, 0x8}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1d, 0x1, &(0x7f0000000040)=@raw=[@ldst={0x1, 0x2, 0x6, 0x9, 0x7, 0x18}], &(0x7f0000000100)='GPL\x00', 0x3, 0x31, &(0x7f0000000140)=""/49, 0x41100, 0x4, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x8, 0x1000}, 0x10, 0xffffffffffffffff, r0}, 0x80) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000280)=r1) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000000)) 01:04:12 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x8000800, 0x5}) (async, rerun: 64) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async, rerun: 64) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x7ff, 0xff, 0x5, 0x0, 0x0}) (async, rerun: 32) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x5787, 0x101, 0x0, 0x0}) (rerun: 32) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r3}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) (rerun: 64) 01:04:12 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0xf000000}, 0x48) 01:04:12 executing program 2: ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)) 01:04:12 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x3f, 0x0, 0x900, 0x1, 0xfffffffb, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x0, 0x8}, 0x48) 01:04:12 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) (async) r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)={&(0x7f00000002c0)='./file0\x00', 0x0, 0x8}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1d, 0x1, &(0x7f0000000040)=@raw=[@ldst={0x1, 0x2, 0x6, 0x9, 0x7, 0x18}], &(0x7f0000000100)='GPL\x00', 0x3, 0x31, &(0x7f0000000140)=""/49, 0x41100, 0x4, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x8, 0x1000}, 0x10, 0xffffffffffffffff, r0}, 0x80) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000280)=r1) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000000)) 01:04:12 executing program 5: r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) (async) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=0x0, @ANYBLOB="04002cbd7000fcdbdf2504000000"], 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x40000) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x518480) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x40000009, 0x93, 0x1, 0x0, 0x0}) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) (rerun: 32) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r4) (async, rerun: 64) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r7, 0x1}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r7, 0x81b, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8050) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r4, 0x54a3) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r5, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_bridge\x00'}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x3e7eadb030a899c2}, 0x91) (async, rerun: 64) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r8) (async) accept$nfc_llcp(r4, &(0x7f0000000280), &(0x7f0000000340)=0x60) (async, rerun: 64) ioctl$PPPIOCGUNIT(r8, 0x80047456, &(0x7f0000000080)) (rerun: 64) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000000c0)={r3}) 01:04:12 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) setsockopt$packet_add_memb(r2, 0x107, 0x1, 0xffffffffffffffff, 0x0) [ 3478.156689] ================================================================== [ 3478.164319] BUG: KASAN: use-after-free in vgem_gem_dumb_create+0x22c/0x240 [ 3478.171348] Read of size 8 at addr ffff8880901d9440 by task syz-executor.3/2158 [ 3478.178792] [ 3478.180426] CPU: 0 PID: 2158 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 [ 3478.188219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 3478.197578] Call Trace: [ 3478.200176] dump_stack+0x1fc/0x2ef [ 3478.203824] print_address_description.cold+0x54/0x219 [ 3478.209114] kasan_report_error.cold+0x8a/0x1b9 [ 3478.213801] ? vgem_gem_dumb_create+0x22c/0x240 [ 3478.218483] __asan_report_load8_noabort+0x88/0x90 [ 3478.223446] ? drm_gem_object_put_unlocked+0xa0/0x180 [ 3478.228639] ? vgem_gem_dumb_create+0x22c/0x240 [ 3478.233299] vgem_gem_dumb_create+0x22c/0x240 [ 3478.237783] drm_mode_create_dumb+0x27c/0x300 [ 3478.242281] drm_ioctl_kernel+0x208/0x2a0 [ 3478.246417] ? drm_mode_create_dumb+0x300/0x300 [ 3478.251090] ? drm_ioctl_permit+0x210/0x210 [ 3478.255404] ? __might_fault+0x192/0x1d0 [ 3478.259461] drm_ioctl+0x5a0/0x9e0 [ 3478.263017] ? drm_mode_create_dumb+0x300/0x300 [ 3478.267671] ? drm_getstats+0x20/0x20 [ 3478.271464] ? __lock_acquire+0x6de/0x3ff0 [ 3478.275691] ? __lock_acquire+0x6de/0x3ff0 [ 3478.279908] ? drm_getstats+0x20/0x20 [ 3478.283692] do_vfs_ioctl+0xcdb/0x12e0 [ 3478.287568] ? lock_downgrade+0x720/0x720 [ 3478.291701] ? check_preemption_disabled+0x41/0x280 [ 3478.296700] ? ioctl_preallocate+0x200/0x200 [ 3478.301096] ? __fget+0x356/0x510 [ 3478.304536] ? do_dup2+0x450/0x450 [ 3478.308062] ? lock_acquire+0x170/0x3c0 [ 3478.312050] ? finish_task_switch+0x118/0x760 [ 3478.316530] ksys_ioctl+0x9b/0xc0 [ 3478.319981] __x64_sys_ioctl+0x6f/0xb0 [ 3478.323871] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 3478.328439] do_syscall_64+0xf9/0x620 [ 3478.332248] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3478.337542] RIP: 0033:0x7fb97c4d50f9 [ 3478.341335] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3478.360225] RSP: 002b:00007fb97aa26168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3478.367936] RAX: ffffffffffffffda RBX: 00007fb97c5f5050 RCX: 00007fb97c4d50f9 [ 3478.375198] RDX: 0000000020000100 RSI: 00000000c02064b2 RDI: 0000000000000003 [ 3478.382558] RBP: 00007fb97c530ae9 R08: 0000000000000000 R09: 0000000000000000 [ 3478.389818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3478.397089] R13: 00007ffe34cf13ef R14: 00007fb97aa26300 R15: 0000000000022000 [ 3478.404350] [ 3478.405963] Allocated by task 2158: [ 3478.409588] kmem_cache_alloc_trace+0x12f/0x380 [ 3478.414256] __vgem_gem_create+0x44/0xf0 [ 3478.418403] vgem_gem_dumb_create+0xcf/0x240 [ 3478.422800] drm_mode_create_dumb+0x27c/0x300 [ 3478.427302] drm_ioctl_kernel+0x208/0x2a0 [ 3478.431440] drm_ioctl+0x5a0/0x9e0 [ 3478.434990] do_vfs_ioctl+0xcdb/0x12e0 [ 3478.438867] ksys_ioctl+0x9b/0xc0 [ 3478.442400] __x64_sys_ioctl+0x6f/0xb0 [ 3478.446315] do_syscall_64+0xf9/0x620 [ 3478.450116] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3478.455285] [ 3478.456912] Freed by task 2158: [ 3478.460200] kfree+0xcc/0x210 [ 3478.463305] drm_gem_object_free+0x91/0x1c0 [ 3478.467616] drm_gem_object_put_unlocked+0xd1/0x180 [ 3478.472620] vgem_gem_dumb_create+0x10c/0x240 [ 3478.477121] drm_mode_create_dumb+0x27c/0x300 [ 3478.481605] drm_ioctl_kernel+0x208/0x2a0 [ 3478.485879] drm_ioctl+0x5a0/0x9e0 [ 3478.489438] do_vfs_ioctl+0xcdb/0x12e0 [ 3478.493320] ksys_ioctl+0x9b/0xc0 [ 3478.496780] __x64_sys_ioctl+0x6f/0xb0 [ 3478.500661] do_syscall_64+0xf9/0x620 [ 3478.504460] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3478.509642] [ 3478.511259] The buggy address belongs to the object at ffff8880901d9340 [ 3478.511259] which belongs to the cache kmalloc-512 of size 512 [ 3478.523908] The buggy address is located 256 bytes inside of [ 3478.523908] 512-byte region [ffff8880901d9340, ffff8880901d9540) [ 3478.535763] The buggy address belongs to the page: [ 3478.540682] page:ffffea0002407640 count:1 mapcount:0 mapping:ffff88813bff0940 index:0xffff8880901d9840 [ 3478.550202] flags: 0xfff00000000100(slab) [ 3478.554346] raw: 00fff00000000100 ffffea0001ecb348 ffffea00024ac7c8 ffff88813bff0940 [ 3478.562216] raw: ffff8880901d9840 ffff8880901d90c0 0000000100000005 0000000000000000 [ 3478.570178] page dumped because: kasan: bad access detected [ 3478.575973] [ 3478.577586] Memory state around the buggy address: [ 3478.582502] ffff8880901d9300: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 3478.589844] ffff8880901d9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3478.597191] >ffff8880901d9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 01:04:13 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x97, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x800, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x800, 0x7ff, 0xf0e, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r1}) 01:04:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x2, 0x3f, 0x0, 0x900, 0x1, 0xfffffffb, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x0, 0x8}, 0x48) 01:04:13 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x0, 0x5, 0x10000000}, 0x48) 01:04:13 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x80000000, 0x2, 0x1}, 0x48) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) (rerun: 32) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'syztnl2\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="84ceaf1265669d0b857e332294d3b66e300000800020000000000000000000b581c0801fcb1d600ef4b56067806784c0c91172f9dfae6622f4039a9b0e1bfaaf27a12e0d1e1d809730aecaeebff38502a4d2b68bda65f3dd8493efaf1b1376b3e95a8f87c2569df4ee5d794b027cc6d622c3b6f0c1512880f587a80907a5364d653e3ae7baf6b53d56e34a70300628fe12ef22d813725d656a0ae0ad7c827e97ba911955ee57831820fb9031344bf7", @ANYRES32=r1, @ANYBLOB="80000001000000030000d4d9430d004c00640000060490780a010100ffffffff4410180000000009000000030000001f94040000442405037f00000100000006ac1414aa00000001ac1414aa00000007ac14143f000069ad"]}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', r1, 0x29, 0x0, 0x40, 0x7f, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x1, 0x0, 0x7, 0x6}}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) (async) setsockopt$packet_add_memb(r2, 0x107, 0x1, 0xffffffffffffffff, 0x0) 01:04:13 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x0, 0x0, 0x5}, 0x48) r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)={&(0x7f00000002c0)='./file0\x00', 0x0, 0x8}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1d, 0x1, &(0x7f0000000040)=@raw=[@ldst={0x1, 0x2, 0x6, 0x9, 0x7, 0x18}], &(0x7f0000000100)='GPL\x00', 0x3, 0x31, &(0x7f0000000140)=""/49, 0x41100, 0x4, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x8, 0x1000}, 0x10, 0xffffffffffffffff, r0}, 0x80) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1d, 0x1, &(0x7f0000000040)=@raw=[@ldst={0x1, 0x2, 0x6, 0x9, 0x7, 0x18}], &(0x7f0000000100)='GPL\x00', 0x3, 0x31, &(0x7f0000000140)=""/49, 0x41100, 0x4, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0xf, 0x8, 0x1000}, 0x10, 0xffffffffffffffff, r0}, 0x80) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000280)=r1) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000000)) [ 3478.604535] ^ [ 3478.610058] ffff8880901d9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3478.617431] ffff8880901d9500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3478.624799] ================================================================== [ 3478.632141] Disabling lock debugging due to kernel taint [ 3478.654583] Kernel panic - not syncing: panic_on_warn set ... [ 3478.654583] [ 3478.661987] CPU: 0 PID: 2158 Comm: syz-executor.3 Tainted: G B 4.19.211-syzkaller #0 [ 3478.671253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 3478.680911] Call Trace: [ 3478.683505] dump_stack+0x1fc/0x2ef [ 3478.687166] panic+0x26a/0x50e [ 3478.690364] ? __warn_printk+0xf3/0xf3 [ 3478.694261] ? preempt_schedule_common+0x45/0xc0 [ 3478.699033] ? ___preempt_schedule+0x16/0x18 [ 3478.703449] ? trace_hardirqs_on+0x55/0x210 [ 3478.707779] kasan_end_report+0x43/0x49 [ 3478.711759] kasan_report_error.cold+0xa7/0x1b9 [ 3478.716438] ? vgem_gem_dumb_create+0x22c/0x240 [ 3478.721114] __asan_report_load8_noabort+0x88/0x90 [ 3478.726050] ? drm_gem_object_put_unlocked+0xa0/0x180 [ 3478.731260] ? vgem_gem_dumb_create+0x22c/0x240 [ 3478.735935] vgem_gem_dumb_create+0x22c/0x240 [ 3478.740467] drm_mode_create_dumb+0x27c/0x300 [ 3478.744984] drm_ioctl_kernel+0x208/0x2a0 [ 3478.749142] ? drm_mode_create_dumb+0x300/0x300 [ 3478.753819] ? drm_ioctl_permit+0x210/0x210 [ 3478.758149] ? __might_fault+0x192/0x1d0 [ 3478.762219] drm_ioctl+0x5a0/0x9e0 [ 3478.765771] ? drm_mode_create_dumb+0x300/0x300 [ 3478.770440] ? drm_getstats+0x20/0x20 [ 3478.774233] ? __lock_acquire+0x6de/0x3ff0 [ 3478.778455] ? __lock_acquire+0x6de/0x3ff0 [ 3478.782696] ? drm_getstats+0x20/0x20 [ 3478.786490] do_vfs_ioctl+0xcdb/0x12e0 [ 3478.790367] ? lock_downgrade+0x720/0x720 [ 3478.794501] ? check_preemption_disabled+0x41/0x280 [ 3478.799506] ? ioctl_preallocate+0x200/0x200 [ 3478.803903] ? __fget+0x356/0x510 [ 3478.807356] ? do_dup2+0x450/0x450 [ 3478.810881] ? lock_acquire+0x170/0x3c0 [ 3478.814850] ? finish_task_switch+0x118/0x760 [ 3478.819330] ksys_ioctl+0x9b/0xc0 [ 3478.822770] __x64_sys_ioctl+0x6f/0xb0 [ 3478.826645] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 3478.831472] do_syscall_64+0xf9/0x620 [ 3478.835264] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3478.840445] RIP: 0033:0x7fb97c4d50f9 [ 3478.844154] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3478.863045] RSP: 002b:00007fb97aa26168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3478.870746] RAX: ffffffffffffffda RBX: 00007fb97c5f5050 RCX: 00007fb97c4d50f9 [ 3478.878024] RDX: 0000000020000100 RSI: 00000000c02064b2 RDI: 0000000000000003 [ 3478.885285] RBP: 00007fb97c530ae9 R08: 0000000000000000 R09: 0000000000000000 [ 3478.892549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3478.899804] R13: 00007ffe34cf13ef R14: 00007fb97aa26300 R15: 0000000000022000 [ 3478.907399] Kernel Offset: disabled [ 3478.911016] Rebooting in 86400 seconds..