[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 40.784641][ T27] audit: type=1800 audit(1554301011.522:25): pid=7694 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 40.822175][ T27] audit: type=1800 audit(1554301011.522:26): pid=7694 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 40.851539][ T27] audit: type=1800 audit(1554301011.522:27): pid=7694 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.64' (ECDSA) to the list of known hosts. 2019/04/03 14:17:01 fuzzer started 2019/04/03 14:17:04 dialing manager at 10.128.0.26:44045 2019/04/03 14:17:09 syscalls: 2408 2019/04/03 14:17:09 code coverage: enabled 2019/04/03 14:17:09 comparison tracing: enabled 2019/04/03 14:17:09 extra coverage: extra coverage is not supported by the kernel 2019/04/03 14:17:09 setuid sandbox: enabled 2019/04/03 14:17:09 namespace sandbox: enabled 2019/04/03 14:17:09 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/03 14:17:09 fault injection: enabled 2019/04/03 14:17:09 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/03 14:17:09 net packet injection: enabled 2019/04/03 14:17:09 net device setup: enabled 14:18:50 executing program 0: r0 = socket(0x840000000002, 0x3, 0xff) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @remote}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000580)='net/raw\x00\x00\x00\x01\x00\x8e\xc2\xb6\xc0\xaa\xa2$\x92\a\xe5\x9c\x9135bG\x95\x1dXb\xd7\xbf=\x15xE\"\xbd\x84\x14`\xea.\xf1$\xbc-\xa09\xd2\xdd\xbf\x9e\x8d\xa9\x7f\x81\xde\xf4\xc1\x01w\xaf\x1d\x00\xa4,\xe6:C\xdc\xce\x807\xef=\xe6\xa680\x9e\xd8\xc4\xaa\xce\x83G\r\xd8\xd1\x12g\t\xcc+\xbb\xbb\xed\xd6\x92\xeb\x02\x1dJ\xe4\\\xb0\x92\xd1\x1f.P\xec\xb2\x9a\xea\x81\xa2h\x7fq\x8e\xb3\x9c\xbb\xd0\xe4\x02\x01,s\xe5\xca\xcfe\xf9\xa0@#\r\xfc\x0f\xcbB^\x19\xda\x15k\x8bx\xe7\x0fFM\xe2\x91\xf1\xa3Ec\xfe=%@,%\xe7\xd3\x1d\xb0\'\xc4\xbc\x03\xa7\v=\x9en\x1d\x16\xb3V.\xb3\xd8\xfd_\xe1j\xbfL\xbf\"p\x8d\xce!\'\x0ew\xc4opE\x87W\xb97\xbb\xae\x1d|\xfc\xbe#W\x8c\xb9\xbe\xdf\xee\xee\x91\x80\x8c\xf8;\xec\x87\xb0J\xa3-+\xbe\x03X\xc4\xc0q\x0e\xbd)\x00'/257) sendfile(r0, r1, 0x0, 0x100000001) syzkaller login: [ 159.439739][ T7861] IPVS: ftp: loaded support on port[0] = 21 14:18:50 executing program 1: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 159.553473][ T7861] chnl_net:caif_netlink_parms(): no params data found [ 159.613490][ T7861] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.632142][ T7861] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.642647][ T7861] device bridge_slave_0 entered promiscuous mode [ 159.663059][ T7861] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.670186][ T7861] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.692241][ T7861] device bridge_slave_1 entered promiscuous mode [ 159.742709][ T7861] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 159.758850][ T7864] IPVS: ftp: loaded support on port[0] = 21 [ 159.765035][ T7861] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 159.803301][ T7861] team0: Port device team_slave_0 added [ 159.826274][ T7861] team0: Port device team_slave_1 added 14:18:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) [ 159.924038][ T7861] device hsr_slave_0 entered promiscuous mode 14:18:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0184908, &(0x7f0000000180)) [ 160.051598][ T7861] device hsr_slave_1 entered promiscuous mode [ 160.156022][ T7866] IPVS: ftp: loaded support on port[0] = 21 [ 160.158736][ T7861] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.169143][ T7861] bridge0: port 2(bridge_slave_1) entered forwarding state [ 160.176851][ T7861] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.183959][ T7861] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.268476][ T7864] chnl_net:caif_netlink_parms(): no params data found [ 160.318717][ T7869] IPVS: ftp: loaded support on port[0] = 21 [ 160.372870][ T7861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 160.433103][ T7864] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.440185][ T7864] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.448480][ T7864] device bridge_slave_0 entered promiscuous mode [ 160.462522][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 14:18:51 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) [ 160.482195][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.505555][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.520264][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 160.597106][ T7864] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.611690][ T7864] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.631277][ T7864] device bridge_slave_1 entered promiscuous mode [ 160.642078][ T7861] 8021q: adding VLAN 0 to HW filter on device team0 [ 160.713869][ T7864] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 160.726759][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 160.735789][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 160.744340][ T3483] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.751445][ T3483] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.759363][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 160.769411][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 160.779890][ T3483] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.787000][ T3483] bridge0: port 2(bridge_slave_1) entered forwarding state [ 160.796639][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 14:18:51 executing program 5: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cgroup.controllers\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x0, &(0x7f0000000080)}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) io_setup(0x7, &(0x7f0000000240)=0x0) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x12f}]) [ 160.811838][ T7864] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 160.841560][ T7866] chnl_net:caif_netlink_parms(): no params data found [ 160.852987][ T7874] IPVS: ftp: loaded support on port[0] = 21 [ 160.867632][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 160.912123][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 160.920858][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 160.966055][ T7864] team0: Port device team_slave_0 added [ 160.985455][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 161.016125][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 161.025107][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 161.035334][ T7864] team0: Port device team_slave_1 added [ 161.047574][ T7869] chnl_net:caif_netlink_parms(): no params data found [ 161.057622][ T7866] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.064759][ T7866] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.074014][ T7866] device bridge_slave_0 entered promiscuous mode [ 161.082444][ T7866] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.089501][ T7866] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.097513][ T7866] device bridge_slave_1 entered promiscuous mode [ 161.152016][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 161.160243][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 161.186577][ T7877] IPVS: ftp: loaded support on port[0] = 21 [ 161.224105][ T7864] device hsr_slave_0 entered promiscuous mode [ 161.281755][ T7864] device hsr_slave_1 entered promiscuous mode [ 161.339586][ T7866] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.348456][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 161.357259][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 161.366584][ T7861] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 161.392491][ T7866] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.440412][ T7869] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.448648][ T7869] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.456448][ T7869] device bridge_slave_0 entered promiscuous mode [ 161.470205][ T7866] team0: Port device team_slave_0 added [ 161.478205][ T7866] team0: Port device team_slave_1 added [ 161.495883][ T7869] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.503051][ T7869] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.510603][ T7869] device bridge_slave_1 entered promiscuous mode [ 161.559435][ T7874] chnl_net:caif_netlink_parms(): no params data found [ 161.574580][ T7861] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 161.605728][ T7869] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.638793][ T7869] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.714405][ T7866] device hsr_slave_0 entered promiscuous mode [ 161.781563][ T7866] device hsr_slave_1 entered promiscuous mode [ 161.843778][ T7869] team0: Port device team_slave_0 added [ 161.866816][ T7874] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.876639][ T7874] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.885255][ T7874] device bridge_slave_0 entered promiscuous mode [ 161.896692][ T7874] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.904256][ T7874] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.914279][ T7874] device bridge_slave_1 entered promiscuous mode [ 161.941913][ T7869] team0: Port device team_slave_1 added 14:18:52 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x11}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xff}, 0x1c) [ 161.988242][ T7874] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 162.003795][ T7874] bond0: Enslaving bond_slave_1 as an active interface with an up link 14:18:52 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x11}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xff}, 0x1c) 14:18:52 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x11}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xff}, 0x1c) [ 162.054617][ T7869] device hsr_slave_0 entered promiscuous mode [ 162.091582][ T7869] device hsr_slave_1 entered promiscuous mode 14:18:52 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x11}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xff}, 0x1c) 14:18:52 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 162.190594][ T7864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.199599][ T7874] team0: Port device team_slave_0 added [ 162.274087][ T7874] team0: Port device team_slave_1 added [ 162.282609][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.290237][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.309661][ C0] hrtimer: interrupt took 43455 ns [ 162.321884][ T7864] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.339375][ T7877] chnl_net:caif_netlink_parms(): no params data found [ 162.354516][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.363755][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.372302][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.379355][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.405339][ T7866] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.448010][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 162.456583][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.465394][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 162.473932][ T2886] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.480990][ T2886] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.490194][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 162.499106][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 162.569671][ T7874] device hsr_slave_0 entered promiscuous mode [ 162.621820][ T7874] device hsr_slave_1 entered promiscuous mode [ 162.671693][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 162.680406][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 162.700233][ T7869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.714919][ T7866] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.770075][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 162.778809][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.792943][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.805180][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 162.815097][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 162.840810][ T7869] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.890474][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.907086][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.917194][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.930718][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.941241][ T7878] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.948340][ T7878] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.963680][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.977180][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 162.986936][ T7878] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.994067][ T7878] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.007578][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.016532][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.031050][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.039722][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.054387][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 163.077173][ T7877] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.089443][ T7877] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.100986][ T7877] device bridge_slave_0 entered promiscuous mode [ 163.127860][ T7864] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 163.146044][ T7864] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.173802][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 163.186584][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 163.199764][ T7903] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.206884][ T7903] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.222356][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.231045][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.246108][ T7903] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.253218][ T7903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.267169][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.275822][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.290152][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.299265][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.313381][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.326299][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.336996][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.349278][ T7903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.378313][ T7877] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.386399][ T7877] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.412850][ T7877] device bridge_slave_1 entered promiscuous mode [ 163.437917][ T7866] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 163.450474][ T7866] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 14:18:54 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 163.474569][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 163.499801][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.508340][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.517497][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.526998][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.535686][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.544219][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.552851][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.561107][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.569726][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.578165][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.599871][ T7877] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 163.617204][ T7877] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 163.653724][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.667756][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.689135][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.699567][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.727581][ T7869] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.748695][ T7874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 163.760260][ T7866] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.782959][ T7864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.792574][ T7877] team0: Port device team_slave_0 added [ 163.820838][ T7877] team0: Port device team_slave_1 added [ 163.838649][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 163.857815][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 163.872921][ T7874] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.930689][ T7869] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.036248][ T7877] device hsr_slave_0 entered promiscuous mode 14:18:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) [ 164.101877][ T7877] device hsr_slave_1 entered promiscuous mode [ 164.210331][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 164.226463][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 164.256465][ T3483] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.263634][ T3483] bridge0: port 1(bridge_slave_0) entered forwarding state [ 164.282080][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 164.311508][ T7920] hfs: can't find a HFS filesystem on dev loop1 [ 164.315872][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 164.362564][ T3483] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.369679][ T3483] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.408940][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 164.416823][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 164.489650][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 164.542857][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 164.567333][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 164.577356][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 164.599806][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 164.629674][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 164.638333][ T7870] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 164.659876][ T7874] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 164.688016][ T7874] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 164.714819][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 164.730540][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 164.745059][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 164.766707][ T7938] hfs: can't find a HFS filesystem on dev loop1 [ 164.792587][ T7877] 8021q: adding VLAN 0 to HW filter on device bond0 14:18:55 executing program 1: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) 14:18:55 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 164.815883][ T7874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.845304][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 164.856303][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 164.910155][ T7877] 8021q: adding VLAN 0 to HW filter on device team0 [ 164.933681][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 164.948385][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 164.957302][ T2886] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.964429][ T2886] bridge0: port 1(bridge_slave_0) entered forwarding state 14:18:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) [ 165.100910][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 165.110320][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 165.132235][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 165.188391][ T2886] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.195516][ T2886] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.268279][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 165.292655][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 165.339936][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 165.373978][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 165.404525][ T7971] hfs: can't find a HFS filesystem on dev loop1 [ 165.432128][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 165.440739][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 165.449691][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 165.458094][ T2886] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 165.470781][ T7877] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 165.484165][ T7877] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 165.496909][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 165.512031][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 165.520305][ T7878] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 165.554105][ T7877] 8021q: adding VLAN 0 to HW filter on device batadv0 14:18:56 executing program 5: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) 14:18:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) 14:18:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) 14:18:56 executing program 1: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:56 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 14:18:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) 14:18:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) 14:18:56 executing program 2: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:57 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 14:18:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000680)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e21}}}, 0x90) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000bc0)={@sco, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) r1 = getpid() capset(&(0x7f0000000200)={0x200f1526, r1}, &(0x7f00000002c0)={0x2, 0x0, 0xc3, 0x400, 0x0, 0x7}) mknod(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x0) 14:18:57 executing program 1: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:57 executing program 5: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:57 executing program 3: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x90020000) [ 167.147104][ T8042] futex_wake_op: syz-executor.3 tries to shift op by 32; fix this program 14:18:58 executing program 2: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 167.252291][ T8042] futex_wake_op: syz-executor.3 tries to shift op by 32; fix this program 14:18:58 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0xd, 0x44}}, &(0x7f0000000480)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) 14:18:58 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000600)='0AW0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pwritev(r1, &(0x7f0000000440)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0xfffffffd) 14:18:58 executing program 3: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) [ 167.851339][ C0] sched: DL replenish lagged too much 14:18:58 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 14:18:58 executing program 3: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:18:58 executing program 1: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:18:58 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00{\x00', &(0x7f0000000000)=@ethtool_cmd={0x11}}) 14:18:58 executing program 1: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:18:59 executing program 5: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:59 executing program 2: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, 0x0) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) symlinkat(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x75, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0x8, 0x10}, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x2, 0x94, 0x2, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000340)=0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) r3 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x7, 0x80001) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900070035000c00060000001900150002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000480)={0x5, 0x2, 0x0, [{0x7, 0x7fff, 0x1, 0x5, 0x101, 0x8000, 0x5}, {0x5b, 0x7, 0x3707dd19, 0x7f, 0x8, 0x81, 0x298}]}) r5 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x957, 0x80000) listen(r0, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000380)={'ah\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x10) ioctl$TCSETAW(r5, 0x5407, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) dup(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f0000001380)='./file0\x00', 0x7, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32]]) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:59 executing program 3: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:18:59 executing program 0: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:18:59 executing program 1: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:18:59 executing program 3: socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[]}}, 0x800) ioprio_set$pid(0x3, 0x0, 0x0) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:18:59 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:18:59 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2c00) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000540)=""/250, 0x446a6e69) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 14:18:59 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x202, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) dup3(r1, r0, 0x0) 14:18:59 executing program 0: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x202, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) dup3(r1, r0, 0x0) 14:19:00 executing program 5: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:00 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:00 executing program 0: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x202, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) dup3(r1, r0, 0x0) 14:19:00 executing program 2: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x202, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) dup3(r1, r0, 0x0) 14:19:00 executing program 0: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:00 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 2: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 4: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 5: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:01 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 3: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:01 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x14, 0x4000040003001, 0x8, 0x40001}, 0x14}}, 0x0) 14:19:01 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x8011, r0, 0x0) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8003, &(0x7f00000001c0)=0x6, 0xff, 0x1) 14:19:01 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 4: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 2: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:01 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x8011, r0, 0x0) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8003, &(0x7f00000001c0)=0x6, 0xff, 0x1) 14:19:02 executing program 5: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:02 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x8011, r0, 0x0) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8003, &(0x7f00000001c0)=0x6, 0xff, 0x1) 14:19:02 executing program 3: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:02 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x8011, r0, 0x0) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8003, &(0x7f00000001c0)=0x6, 0xff, 0x1) 14:19:02 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) 14:19:03 executing program 4: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fce18423737ae8617edf7b8a2d1d"], 0x34) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) syz_genetlink_get_family_id$tipc2(0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0xfff, 0x20}, {0x0, 0x10000}], r4}, 0x18, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$SIOCAX25GETINFOOLD(r5, 0x89e9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000780)={{0x117002, 0x0, 0x0, 0x5d88, 0x7, 0x100, 0x10001, 0x7bf700000000, 0x5, 0x8000, 0x120000}, {0x2000, 0x10000, 0xc, 0x81, 0x7be50d50, 0xfff, 0x80, 0x5, 0x9, 0x0, 0x7, 0x7ff}, {0x6000, 0x10f000, 0x0, 0x9, 0xe64b, 0xff, 0x8, 0x7ff, 0x2, 0x5, 0x0, 0x1}, {0x5000, 0x3001, 0xe, 0x0, 0x7fffffff, 0x80000000, 0xff, 0xf37, 0x2, 0x100000001}, {0x0, 0x10000, 0xe, 0x28, 0x9, 0x0, 0xd4, 0x6, 0x6, 0x4d, 0x0, 0x8b}, {0x10001, 0x107000, 0x1f, 0x8, 0x6, 0x8, 0x0, 0x0, 0xffffffff, 0x8, 0x5, 0x6ec5}, {0x1, 0x5000, 0xf, 0x0, 0x3, 0x0, 0x2, 0x0, 0x8, 0x280000000, 0xffff, 0x4fe}, {0x0, 0xf000, 0xe, 0x3, 0x1000, 0xffffffffffffffc0, 0x9, 0x5, 0x4, 0x7, 0x100000000, 0x8}, {0x6000, 0x2000}, {0xd000}, 0x20, 0x0, 0x7006, 0x8, 0xd, 0x0, 0xf004, [0x3, 0x0, 0x4, 0x5915]}) write$FUSE_CREATE_OPEN(r5, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0xfff, {0x0, 0x80000001, 0x0, 0x6}}}}, 0xa0) 14:19:03 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0xf0b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0xc, 0x2, [@IFLA_GRE_LOCAL={0x8, 0xf}]}}}]}, 0x38}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100), 0xf}], 0x492492492492805, 0x0) 14:19:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x4004556e) 14:19:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000240)={0xa}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=@ipmr_getroute={0x1c, 0x1a, 0x525, 0x0, 0x0, {0xa000000, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x1c}}, 0x0) [ 172.418963][ T8304] netlink: 'syz-executor.2': attribute type 15 has an invalid length. 14:19:03 executing program 0: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000280)=0x400, 0x4) bind$xdp(r2, &(0x7f0000000300)={0x2c, 0x5, r1}, 0x10) 14:19:03 executing program 0: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000280)=0x400, 0x4) bind$xdp(r2, &(0x7f0000000300)={0x2c, 0x5, r1}, 0x10) 14:19:03 executing program 5: keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'new '}, 0x1a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 14:19:03 executing program 0: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000280)=0x400, 0x4) bind$xdp(r2, &(0x7f0000000300)={0x2c, 0x5, r1}, 0x10) [ 172.651296][ T8324] encrypted_key: keyword 'update' not allowed when called from .instantiate method [ 172.671796][ T8325] netlink: 'syz-executor.2': attribute type 15 has an invalid length. 14:19:03 executing program 5: syz_emit_ethernet(0x2a, &(0x7f00000000c0)={@link_local={0x1, 0x80, 0xc2, 0x3}, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0xffffff89, 0x0, @remote={0xac, 0x1c}, @local}, @igmp={0x0, 0x0, 0x0, @broadcast}}}}}, &(0x7f0000000000)) [ 172.719834][ T8324] encrypted_key: keyword 'update' not allowed when called from .instantiate method 14:19:03 executing program 3: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.type\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) open(0x0, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="ffc0a421ffffffff000000000f9186782872f53c35c17a58c5ce563a98c95e233e523d13a0e6fc"], 0x27) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) 14:19:03 executing program 0: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000280)=0x400, 0x4) bind$xdp(r2, &(0x7f0000000300)={0x2c, 0x5, r1}, 0x10) 14:19:03 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) 14:19:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="8000000000000000000040"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0xc0185879, 0x20000000) 14:19:03 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes-aesni)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) io_setup(0x800000100000009, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:19:03 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0xf0b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0xc, 0x2, [@IFLA_GRE_LOCAL={0x8, 0xf}]}}}]}, 0x38}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100), 0xf}], 0x492492492492805, 0x0) 14:19:03 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RLERRORu(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="ffc0"], 0x2) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) [ 173.262583][ T8351] netlink: 'syz-executor.2': attribute type 15 has an invalid length. 14:19:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="8000000000000000000040"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0xc0185879, 0x20000000) 14:19:04 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes-aesni)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) io_setup(0x800000100000009, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:19:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="8000000000000000000040"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0xc0185879, 0x20000000) 14:19:04 executing program 3: r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000d36ff4)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) 14:19:04 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RLERRORu(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="ffc0"], 0x2) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) 14:19:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="8000000000000000000040"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0xc0185879, 0x20000000) 14:19:04 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes-aesni)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) io_setup(0x800000100000009, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:19:04 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) 14:19:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) 14:19:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4000000000000009) setsockopt(r0, 0x10e, 0xb, &(0x7f0000f67000)="9adc01ce", 0x4) write(r0, &(0x7f0000000140)="22000000ed037c4e47d7b1ccff652186979f580700f417e512b87cba48c1cb65d145", 0x22) 14:19:04 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0xf0b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0xc, 0x2, [@IFLA_GRE_LOCAL={0x8, 0xf}]}}}]}, 0x38}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100), 0xf}], 0x492492492492805, 0x0) 14:19:04 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes-aesni)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) io_setup(0x800000100000009, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:19:04 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000180)={0x48e}) [ 174.040723][ T8394] netlink: 'syz-executor.2': attribute type 15 has an invalid length. [ 174.055850][ T8400] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 14:19:04 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000001c00)=@in={0x2, 0x4e22}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1c00000000000000000000000800"/28], 0x1c}}], 0x1, 0x0) 14:19:04 executing program 5: socketpair$unix(0x1, 0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) r1 = syz_open_dev$vcsa(&(0x7f0000003400)='/dev/vcsa#\x00', 0x0, 0xa040) mq_timedsend(r1, 0x0, 0x0, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) pipe(0x0) r2 = memfd_create(&(0x7f0000000080)='\x00', 0x0) clone(0x12102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = shmget(0x1, 0xc000, 0x78000803, &(0x7f0000ff4000/0xc000)=nil) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000100)=""/47) fcntl$setlease(r2, 0x400, 0x1) fcntl$setown(r2, 0x8, 0x0) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) unshare(0x40000000) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x9, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000140)='syzkaller\x00', 0x6f1a, 0xfb, &(0x7f00000003c0)=""/251, 0x0, 0x0, [], 0x0, 0xd}, 0x48) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)={r5, r4, 0xd, 0x8000000000}, 0x10) close(r4) 14:19:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000001c00)=@in={0x2, 0x4e22}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1c00000000000000000000000800"/28], 0x1c}}], 0x1, 0x0) 14:19:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setuid(r1) 14:19:05 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RLERRORu(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="ffc0"], 0x2) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) 14:19:05 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RLERRORu(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="ffc0"], 0x2) sendfile(r0, r2, &(0x7f0000d83ff8), 0x2) 14:19:05 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) 14:19:05 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0xf0b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0xc, 0x2, [@IFLA_GRE_LOCAL={0x8, 0xf}]}}}]}, 0x38}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100), 0xf}], 0x492492492492805, 0x0) 14:19:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000001c00)=@in={0x2, 0x4e22}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1c00000000000000000000000800"/28], 0x1c}}], 0x1, 0x0) 14:19:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setuid(r1) 14:19:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) 14:19:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000001c00)=@in={0x2, 0x4e22}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1c00000000000000000000000800"/28], 0x1c}}], 0x1, 0x0) [ 174.901160][ T8449] netlink: 'syz-executor.2': attribute type 15 has an invalid length. 14:19:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setuid(r1) [ 175.092866][ T8447] ================================================================== [ 175.101251][ T8447] BUG: KASAN: use-after-free in cma_check_port+0x8ce/0x8f0 [ 175.108465][ T8447] Read of size 8 at addr ffff888099cb3b48 by task syz-executor.3/8447 [ 175.116612][ T8447] [ 175.118962][ T8447] CPU: 0 PID: 8447 Comm: syz-executor.3 Not tainted 5.1.0-rc3-next-20190403 #17 [ 175.127986][ T8447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 175.138055][ T8447] Call Trace: [ 175.141405][ T8447] dump_stack+0x172/0x1f0 [ 175.145745][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.150644][ T8447] print_address_description.cold+0x7c/0x20d [ 175.156633][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.161499][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.166358][ T8447] kasan_report.cold+0x1b/0x40 [ 175.171138][ T8447] ? __xa_insert+0x1d0/0x2a0 [ 175.175737][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.180615][ T8447] __asan_report_load8_noabort+0x14/0x20 [ 175.186261][ T8447] cma_check_port+0x8ce/0x8f0 [ 175.190957][ T8447] rdma_bind_addr+0x19c3/0x1f80 [ 175.195826][ T8447] ? cma_ndev_work_handler+0x1c0/0x1c0 [ 175.195892][ T8447] ? lock_downgrade+0x880/0x880 [ 175.195911][ T8447] rdma_resolve_addr+0x437/0x21f0 [ 175.195937][ T8447] ? kasan_check_write+0x14/0x20 [ 175.216313][ T8447] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 175.221892][ T8447] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 175.221913][ T8447] ? rdma_bind_addr+0x1f80/0x1f80 [ 175.221947][ T8447] ucma_resolve_ip+0x153/0x210 [ 175.221961][ T8447] ? ucma_resolve_ip+0x153/0x210 [ 175.221976][ T8447] ? ucma_query+0x820/0x820 [ 175.221999][ T8447] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 175.222046][ T8447] ? _copy_from_user+0xdd/0x150 [ 175.222066][ T8447] ucma_write+0x2da/0x3c0 [ 175.262863][ T8447] ? ucma_query+0x820/0x820 [ 175.267371][ T8447] ? ucma_open+0x290/0x290 [ 175.271824][ T8447] ? apparmor_file_permission+0x25/0x30 [ 175.277388][ T8447] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 175.283644][ T8447] ? security_file_permission+0x94/0x380 [ 175.289303][ T8447] __vfs_write+0x8d/0x110 [ 175.293640][ T8447] ? ucma_open+0x290/0x290 [ 175.298074][ T8447] vfs_write+0x20c/0x580 [ 175.302336][ T8447] ksys_write+0xea/0x1f0 [ 175.306589][ T8447] ? __ia32_sys_read+0xb0/0xb0 [ 175.311390][ T8447] ? do_syscall_64+0x26/0x610 [ 175.316099][ T8447] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 175.322174][ T8447] ? do_syscall_64+0x26/0x610 [ 175.326872][ T8447] __x64_sys_write+0x73/0xb0 [ 175.331473][ T8447] do_syscall_64+0x103/0x610 [ 175.336082][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 175.341976][ T8447] RIP: 0033:0x4582b9 [ 175.345879][ T8447] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 175.365483][ T8447] RSP: 002b:00007f6451bbbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 175.373894][ T8447] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 175.373904][ T8447] RDX: 0000000000000048 RSI: 00000000200001c0 RDI: 000000000000000a [ 175.373913][ T8447] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 175.373923][ T8447] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6451bbc6d4 [ 175.373932][ T8447] R13: 00000000004ce188 R14: 00000000004dd8c8 R15: 00000000ffffffff [ 175.373954][ T8447] [ 175.373962][ T8447] Allocated by task 8402: [ 175.373981][ T8447] save_stack+0x45/0xd0 [ 175.373997][ T8447] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 175.374012][ T8447] kasan_kmalloc+0x9/0x10 [ 175.374027][ T8447] kmem_cache_alloc_trace+0x151/0x760 [ 175.374081][ T8447] cma_alloc_port+0x4f/0x1a0 14:19:06 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) 14:19:06 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setuid(r1) 14:19:06 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) [ 175.420517][ T8447] rdma_bind_addr+0x1bc0/0x1f80 [ 175.420534][ T8447] rdma_resolve_addr+0x437/0x21f0 [ 175.420547][ T8447] ucma_resolve_ip+0x153/0x210 [ 175.420559][ T8447] ucma_write+0x2da/0x3c0 [ 175.420574][ T8447] __vfs_write+0x8d/0x110 [ 175.420589][ T8447] vfs_write+0x20c/0x580 [ 175.420603][ T8447] ksys_write+0xea/0x1f0 [ 175.420617][ T8447] __x64_sys_write+0x73/0xb0 [ 175.420634][ T8447] do_syscall_64+0x103/0x610 [ 175.420655][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 175.434723][ T8447] [ 175.434732][ T8447] Freed by task 8389: [ 175.434751][ T8447] save_stack+0x45/0xd0 [ 175.434776][ T8447] __kasan_slab_free+0x102/0x150 [ 175.434792][ T8447] kasan_slab_free+0xe/0x10 [ 175.434806][ T8447] kfree+0xcf/0x230 [ 175.434828][ T8447] rdma_destroy_id+0x7fc/0xaa0 [ 175.449614][ T8447] ucma_close+0x115/0x320 [ 175.449627][ T8447] __fput+0x2e5/0x8d0 [ 175.449639][ T8447] ____fput+0x16/0x20 [ 175.449656][ T8447] task_work_run+0x14a/0x1c0 [ 175.449685][ T8447] exit_to_usermode_loop+0x273/0x2c0 [ 175.481118][ T8447] do_syscall_64+0x52d/0x610 [ 175.481135][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 175.481140][ T8447] [ 175.481152][ T8447] The buggy address belongs to the object at ffff888099cb3b40 [ 175.481152][ T8447] which belongs to the cache kmalloc-32 of size 32 [ 175.481165][ T8447] The buggy address is located 8 bytes inside of [ 175.481165][ T8447] 32-byte region [ffff888099cb3b40, ffff888099cb3b60) [ 175.481171][ T8447] The buggy address belongs to the page: [ 175.481194][ T8447] page:ffffea0002672cc0 count:1 mapcount:0 mapping:ffff88812c3f01c0 index:0xffff888099cb3fc1 [ 175.481207][ T8447] flags: 0x1fffc0000000200(slab) [ 175.481227][ T8447] raw: 01fffc0000000200 ffffea000262b508 ffffea00029fcb48 ffff88812c3f01c0 [ 175.481244][ T8447] raw: ffff888099cb3fc1 ffff888099cb3000 000000010000003f 0000000000000000 [ 175.481251][ T8447] page dumped because: kasan: bad access detected [ 175.481255][ T8447] [ 175.481259][ T8447] Memory state around the buggy address: [ 175.481272][ T8447] ffff888099cb3a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 175.481283][ T8447] ffff888099cb3a80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 175.481298][ T8447] >ffff888099cb3b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 175.502194][ T8447] ^ [ 175.502208][ T8447] ffff888099cb3b80: 00 00 03 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 175.502220][ T8447] ffff888099cb3c00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 175.502226][ T8447] ================================================================== [ 175.502231][ T8447] Disabling lock debugging due to kernel taint [ 175.558380][ T8471] kobject: 'kvm' (000000000df1bdbe): kobject_uevent_env [ 175.580839][ T8439] kobject: 'rfkill32': free name [ 175.584429][ T8470] kobject: 'kvm' (000000000df1bdbe): kobject_uevent_env [ 175.589083][ T8439] kobject: 'hci0' (000000007123cdb9): kobject_uevent_env [ 175.633528][ T8471] kobject: 'kvm' (000000000df1bdbe): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 175.637177][ T8439] kobject: 'hci0' (000000007123cdb9): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0' [ 175.643660][ T8470] kobject: 'kvm' (000000000df1bdbe): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 175.655656][ T8439] kobject: 'bluetooth' (00000000425f3e25): kobject_cleanup, parent (null) [ 175.690334][ T8447] Kernel panic - not syncing: panic_on_warn set ... [ 175.691368][ T8439] kobject: 'bluetooth' (00000000425f3e25): calling ktype release [ 175.696695][ T8447] CPU: 0 PID: 8447 Comm: syz-executor.3 Tainted: G B 5.1.0-rc3-next-20190403 #17 [ 175.696704][ T8447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 175.696716][ T8447] Call Trace: [ 175.703706][ T8439] kobject: 'bluetooth': free name [ 175.708568][ T8447] dump_stack+0x172/0x1f0 [ 175.708593][ T8447] panic+0x2cb/0x65c [ 175.715668][ T8439] kobject: 'hci0' (000000007123cdb9): kobject_cleanup, parent (null) [ 175.722507][ T8447] ? __warn_printk+0xf3/0xf3 [ 175.722526][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.722541][ T8447] ? preempt_schedule+0x4b/0x60 [ 175.722558][ T8447] ? ___preempt_schedule+0x16/0x18 [ 175.722592][ T8447] ? trace_hardirqs_on+0x5e/0x230 [ 175.751389][ T8439] kobject: 'hci0' (000000007123cdb9): calling ktype release [ 175.752285][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.771142][ T8439] kobject: 'hci0': free name [ 175.775993][ T8447] end_report+0x47/0x4f [ 175.776009][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.776021][ T8447] kasan_report.cold+0xe/0x40 [ 175.776035][ T8447] ? __xa_insert+0x1d0/0x2a0 [ 175.776056][ T8447] ? cma_check_port+0x8ce/0x8f0 [ 175.886144][ T8447] __asan_report_load8_noabort+0x14/0x20 [ 175.891759][ T8447] cma_check_port+0x8ce/0x8f0 [ 175.896427][ T8447] rdma_bind_addr+0x19c3/0x1f80 [ 175.901271][ T8447] ? cma_ndev_work_handler+0x1c0/0x1c0 [ 175.906733][ T8447] ? lock_downgrade+0x880/0x880 [ 175.911587][ T8447] rdma_resolve_addr+0x437/0x21f0 [ 175.916596][ T8447] ? kasan_check_write+0x14/0x20 [ 175.921529][ T8447] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 175.927090][ T8447] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 175.933317][ T8447] ? rdma_bind_addr+0x1f80/0x1f80 [ 175.938345][ T8447] ucma_resolve_ip+0x153/0x210 [ 175.943104][ T8447] ? ucma_resolve_ip+0x153/0x210 [ 175.948034][ T8447] ? ucma_query+0x820/0x820 [ 175.952526][ T8447] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 175.958746][ T8447] ? _copy_from_user+0xdd/0x150 [ 175.963595][ T8447] ucma_write+0x2da/0x3c0 [ 175.967918][ T8447] ? ucma_query+0x820/0x820 [ 175.972398][ T8447] ? ucma_open+0x290/0x290 [ 175.976801][ T8447] ? apparmor_file_permission+0x25/0x30 [ 175.982343][ T8447] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 175.988587][ T8447] ? security_file_permission+0x94/0x380 [ 175.994214][ T8447] __vfs_write+0x8d/0x110 [ 175.998529][ T8447] ? ucma_open+0x290/0x290 [ 176.002943][ T8447] vfs_write+0x20c/0x580 [ 176.007181][ T8447] ksys_write+0xea/0x1f0 [ 176.011405][ T8447] ? __ia32_sys_read+0xb0/0xb0 [ 176.016150][ T8447] ? do_syscall_64+0x26/0x610 [ 176.020831][ T8447] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 176.026879][ T8447] ? do_syscall_64+0x26/0x610 [ 176.031555][ T8447] __x64_sys_write+0x73/0xb0 [ 176.036128][ T8447] do_syscall_64+0x103/0x610 [ 176.040701][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 176.046573][ T8447] RIP: 0033:0x4582b9 [ 176.050464][ T8447] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 176.070051][ T8447] RSP: 002b:00007f6451bbbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 176.078439][ T8447] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 176.086390][ T8447] RDX: 0000000000000048 RSI: 00000000200001c0 RDI: 000000000000000a [ 176.094339][ T8447] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 176.102297][ T8447] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6451bbc6d4 [ 176.110261][ T8447] R13: 00000000004ce188 R14: 00000000004dd8c8 R15: 00000000ffffffff [ 176.120037][ T8447] Kernel Offset: disabled [ 176.124364][ T8447] Rebooting in 86400 seconds..