[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 26.013044] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 29.393282] random: sshd: uninitialized urandom read (32 bytes read) [ 29.688155] random: sshd: uninitialized urandom read (32 bytes read) [ 30.454996] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.60' (ECDSA) to the list of known hosts. [ 36.187861] random: sshd: uninitialized urandom read (32 bytes read) 2018/09/14 11:54:35 fuzzer started [ 37.573058] random: cc1: uninitialized urandom read (8 bytes read) 2018/09/14 11:54:38 dialing manager at 10.128.0.26:42293 2018/09/14 11:54:42 syscalls: 1 2018/09/14 11:54:42 code coverage: enabled 2018/09/14 11:54:42 comparison tracing: enabled 2018/09/14 11:54:42 setuid sandbox: enabled 2018/09/14 11:54:42 namespace sandbox: enabled 2018/09/14 11:54:42 fault injection: enabled 2018/09/14 11:54:42 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/09/14 11:54:42 net packed injection: enabled 2018/09/14 11:54:42 net device setup: enabled [ 44.646925] random: crng init done 11:56:05 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:05 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) 11:56:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) getsockopt$inet_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0xfffffe19) 11:56:05 executing program 4: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000040)={0x28}, 0x28) 11:56:05 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:05 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000000)=""/1, &(0x7f0000000040)=0x1) [ 126.082995] IPVS: ftp: loaded support on port[0] = 21 [ 126.110318] IPVS: ftp: loaded support on port[0] = 21 [ 126.151471] IPVS: ftp: loaded support on port[0] = 21 [ 126.163087] IPVS: ftp: loaded support on port[0] = 21 [ 126.164460] IPVS: ftp: loaded support on port[0] = 21 [ 126.217614] IPVS: ftp: loaded support on port[0] = 21 [ 128.387742] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.407607] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.427535] device bridge_slave_0 entered promiscuous mode [ 128.445164] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.455018] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.463020] device bridge_slave_0 entered promiscuous mode [ 128.500914] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.517242] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.534814] device bridge_slave_0 entered promiscuous mode [ 128.542113] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.557937] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.572874] device bridge_slave_0 entered promiscuous mode [ 128.582812] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.591671] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.599957] device bridge_slave_1 entered promiscuous mode [ 128.609822] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.618849] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.638620] device bridge_slave_0 entered promiscuous mode [ 128.648731] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.664495] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.697337] device bridge_slave_1 entered promiscuous mode [ 128.703762] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.710121] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.719973] device bridge_slave_0 entered promiscuous mode [ 128.728357] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.743490] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.751096] device bridge_slave_1 entered promiscuous mode [ 128.772516] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.783900] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.791358] device bridge_slave_1 entered promiscuous mode [ 128.809764] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 128.830322] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.838783] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.846421] device bridge_slave_1 entered promiscuous mode [ 128.865701] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.872074] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.884260] device bridge_slave_1 entered promiscuous mode [ 128.893833] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 128.902172] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 128.947846] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 128.980625] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 129.008330] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.027103] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 129.042259] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.059848] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.109965] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.130783] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.172336] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.359586] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.428002] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.464494] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.497093] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.539442] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.558686] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.572902] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.590623] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.637373] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.691609] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.721610] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.759208] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.890894] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 129.907684] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 129.935250] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 129.944243] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 129.952964] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 130.012069] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.026670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.035271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.056048] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 130.067087] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.085263] team0: Port device team_slave_0 added [ 130.124909] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.206208] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.215110] team0: Port device team_slave_1 added [ 130.253076] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.276858] team0: Port device team_slave_0 added [ 130.349705] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 130.363843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.382004] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.392764] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.400435] team0: Port device team_slave_0 added [ 130.409595] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.417877] team0: Port device team_slave_0 added [ 130.427052] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.442818] team0: Port device team_slave_0 added [ 130.457759] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.475903] team0: Port device team_slave_1 added [ 130.487354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.529456] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.551939] team0: Port device team_slave_1 added [ 130.572639] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.580402] team0: Port device team_slave_1 added [ 130.589721] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 130.604960] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.612323] team0: Port device team_slave_1 added [ 130.626236] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.634843] team0: Port device team_slave_0 added [ 130.648717] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.664317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.693709] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.734084] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.742141] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.778019] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.795887] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 130.811069] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.826815] team0: Port device team_slave_1 added [ 130.832317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.852725] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.874049] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.882003] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 130.889250] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 130.898790] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 130.937641] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 130.952034] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.966768] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.975837] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.984506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.992222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.000874] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.010017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.018743] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.027740] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 131.038414] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 131.049976] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 131.073717] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.081001] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.094185] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.101994] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.148595] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.161330] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.169360] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.177318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.185342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.193626] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 131.200702] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.208791] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.221002] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 131.230307] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.242103] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.264796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.294322] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.322350] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.350778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.359408] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.367650] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.378683] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.413940] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.434086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.463966] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 131.476231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.505723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.558637] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.583978] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.598646] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 132.538279] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.544841] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.551825] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.558291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.581001] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.590960] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.597378] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.604111] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.610499] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.618818] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.746240] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.752640] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.759383] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.765802] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.774424] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.786512] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.792891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.799636] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.806056] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.848681] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.924898] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.943818] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.981525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.989049] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 133.003942] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.010328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.017092] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.023515] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.032886] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 133.046715] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.053100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.059838] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.066249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.078754] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 134.003733] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.023727] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 137.696683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.889583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.945238] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.983827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.991801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.228726] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 138.304842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.373680] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 138.392017] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 138.415239] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 138.473974] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 138.689224] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 138.702970] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 138.712286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 138.737015] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 138.858439] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 138.893672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 138.900900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 138.924118] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 138.937399] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 138.946645] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 138.965204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 138.972275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 138.994736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 139.005083] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 139.037521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 139.069152] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 139.216762] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.316012] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 139.322816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 139.341386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 139.424343] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.434409] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.462365] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.490629] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.838757] 8021q: adding VLAN 0 to HW filter on device team0 11:56:21 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000000)=""/1, &(0x7f0000000040)=0x1) [ 142.243997] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 11:56:21 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000000)=""/1, &(0x7f0000000040)=0x1) [ 142.320035] hrtimer: interrupt took 34110 ns 11:56:21 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) 11:56:21 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:22 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000000)=""/1, &(0x7f0000000040)=0x1) 11:56:22 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) [ 142.846555] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 11:56:22 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:22 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) 11:56:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) getsockopt$inet_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0xfffffe19) 11:56:22 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:22 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:22 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:22 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) [ 143.344077] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 11:56:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) getsockopt$inet_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0xfffffe19) 11:56:22 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:22 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:22 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:23 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:23 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:23 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) 11:56:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) getsockopt$inet_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0xfffffe19) 11:56:23 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:23 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0x1, 0x4, 0xed}) dup(0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000000), &(0x7f0000000140)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000001140), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) getsockopt$inet_tcp_buf(r1, 0x6, 0x1e, &(0x7f0000000300)=""/94, &(0x7f0000000380)=0x5e) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) 11:56:23 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:23 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) 11:56:23 executing program 5: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000140)="1f0000000104ff08fd4a54c007110000f305210008000100010423dcffdf6a", 0x1f) r1 = socket(0x10, 0x2, 0xc) write(r1, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f3e9000008000100010423dcffdf00", 0x1f) dup3(r1, r0, 0x0) [ 144.312514] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. [ 144.351685] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. 11:56:23 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000200)=[@in6]}, &(0x7f0000000340)=0x3) 11:56:23 executing program 2: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_proto_private(r0, 0x0, &(0x7f0000000280)='\fs$') clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) mount(&(0x7f0000000000)=@loop={'/dev/loop'}, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x800, &(0x7f0000000240)='proc\x00') [ 144.379247] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. 11:56:23 executing program 5: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000140)="1f0000000104ff08fd4a54c007110000f305210008000100010423dcffdf6a", 0x1f) r1 = socket(0x10, 0x2, 0xc) write(r1, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f3e9000008000100010423dcffdf00", 0x1f) dup3(r1, r0, 0x0) 11:56:23 executing program 2: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_proto_private(r0, 0x0, &(0x7f0000000280)='\fs$') clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) mount(&(0x7f0000000000)=@loop={'/dev/loop'}, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x800, &(0x7f0000000240)='proc\x00') [ 144.664821] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. [ 144.714286] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. 11:56:24 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:24 executing program 1: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) 11:56:24 executing program 2: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_proto_private(r0, 0x0, &(0x7f0000000280)='\fs$') clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) mount(&(0x7f0000000000)=@loop={'/dev/loop'}, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x800, &(0x7f0000000240)='proc\x00') 11:56:24 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:24 executing program 5: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000140)="1f0000000104ff08fd4a54c007110000f305210008000100010423dcffdf6a", 0x1f) r1 = socket(0x10, 0x2, 0xc) write(r1, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f3e9000008000100010423dcffdf00", 0x1f) dup3(r1, r0, 0x0) [ 145.103736] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. [ 145.148166] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. 11:56:24 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, r1) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f0000000240)={0x4, 0x0, [{}, {}, {}, {}]}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000020c0)={0x77359400}, 0x10) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, 0x0, 0x820, 0x70bd2d, 0x0, {}, [@FOU_ATTR_PORT={0x8}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3a}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) getuid() bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0xffffffffffbffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x0, 0xe603000000000000]}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) 11:56:24 executing program 2: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_proto_private(r0, 0x0, &(0x7f0000000280)='\fs$') clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) mount(&(0x7f0000000000)=@loop={'/dev/loop'}, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x800, &(0x7f0000000240)='proc\x00') 11:56:24 executing program 1: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) 11:56:24 executing program 5: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000140)="1f0000000104ff08fd4a54c007110000f305210008000100010423dcffdf6a", 0x1f) r1 = socket(0x10, 0x2, 0xc) write(r1, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f3e9000008000100010423dcffdf00", 0x1f) dup3(r1, r0, 0x0) 11:56:24 executing program 2: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) [ 145.330700] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. [ 145.453672] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. 11:56:25 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:25 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:25 executing program 1: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) 11:56:25 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) bind(r0, &(0x7f0000000000)=@alg={0x2, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x68) 11:56:25 executing program 2: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) 11:56:25 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) bind(r0, &(0x7f0000000000)=@alg={0x2, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x68) 11:56:25 executing program 1: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) 11:56:25 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) bind(r0, &(0x7f0000000000)=@alg={0x2, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x68) 11:56:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) getpgid(0xffffffffffffffff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100), 0x0) sendto$unix(r1, &(0x7f0000000400), 0xff26, 0x0, 0x0, 0x22) recvmsg$kcm(r1, &(0x7f0000000640)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000001840)=""/4096, 0xd006}], 0xe}, 0x0) 11:56:25 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) bind(r0, &(0x7f0000000000)=@alg={0x2, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x68) 11:56:25 executing program 2: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter6\x00') ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="d32d9215098631bd99c4e7b8737bdf780d385b465167e9169951eb51e8a9a7b9cc411daeadaf48e4be2b0a3dc0c508934e46e86b84fde9c29a022d32401f7faab28a4504e300d54119889fe4dfd82492da7863b20f8888f6e9040c1abf9958ca8d2834d510dff8f57b64") openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x80002, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000001c0)=0x100400) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x0, 0x4, 0x83}) preadv(r1, &(0x7f0000000480), 0x1000000000000073, 0x0) 11:56:25 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:26 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) getpgid(0xffffffffffffffff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100), 0x0) sendto$unix(r1, &(0x7f0000000400), 0xff26, 0x0, 0x0, 0x22) recvmsg$kcm(r1, &(0x7f0000000640)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000001840)=""/4096, 0xd006}], 0xe}, 0x0) 11:56:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000065fc8)={&(0x7f0000791000), 0xc, &(0x7f0000df6000)={&(0x7f0000948000)={0x14, 0x10, 0xa, 0xfffffffffffffffd}, 0x14}}, 0x0) 11:56:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000065fc8)={&(0x7f0000791000), 0xc, &(0x7f0000df6000)={&(0x7f0000948000)={0x14, 0x10, 0xa, 0xfffffffffffffffd}, 0x14}}, 0x0) 11:56:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) getpgid(0xffffffffffffffff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100), 0x0) sendto$unix(r1, &(0x7f0000000400), 0xff26, 0x0, 0x0, 0x22) recvmsg$kcm(r1, &(0x7f0000000640)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000001840)=""/4096, 0xd006}], 0xe}, 0x0) 11:56:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000065fc8)={&(0x7f0000791000), 0xc, &(0x7f0000df6000)={&(0x7f0000948000)={0x14, 0x10, 0xa, 0xfffffffffffffffd}, 0x14}}, 0x0) 11:56:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202]}, 0x45c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000180)) 11:56:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000065fc8)={&(0x7f0000791000), 0xc, &(0x7f0000df6000)={&(0x7f0000948000)={0x14, 0x10, 0xa, 0xfffffffffffffffd}, 0x14}}, 0x0) 11:56:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) getpgid(0xffffffffffffffff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100), 0x0) sendto$unix(r1, &(0x7f0000000400), 0xff26, 0x0, 0x0, 0x22) recvmsg$kcm(r1, &(0x7f0000000640)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000001840)=""/4096, 0xd006}], 0xe}, 0x0) 11:56:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@loopback, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) dup(0xffffffffffffffff) bind$alg(r0, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="7026f2c5", 0x4) 11:56:26 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) ioctl$EVIOCGREP(r0, 0x40047440, &(0x7f0000d1df52)=""/174) 11:56:26 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGREP(r0, 0x4008744b, &(0x7f0000003000)=""/174) 11:56:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents(r0, &(0x7f0000000100)=""/49, 0x31) 11:56:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, &(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000400)=0x80) 11:56:27 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGREP(r0, 0x4008744b, &(0x7f0000003000)=""/174) 11:56:27 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) ioctl$EVIOCGREP(r0, 0x40047440, &(0x7f0000d1df52)=""/174) 11:56:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, &(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000400)=0x80) 11:56:27 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) ioctl$EVIOCGREP(r0, 0x40047440, &(0x7f0000d1df52)=""/174) 11:56:27 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000500)=0x400000019) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000280)) 11:56:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, &(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000400)=0x80) 11:56:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents(r0, &(0x7f0000000100)=""/49, 0x31) 11:56:27 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGREP(r0, 0x4008744b, &(0x7f0000003000)=""/174) 11:56:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, &(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000400)=0x80) 11:56:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents(r0, &(0x7f0000000100)=""/49, 0x31) 11:56:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:27 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000500)=0x400000019) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000280)) 11:56:27 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) ioctl$EVIOCGREP(r0, 0x40047440, &(0x7f0000d1df52)=""/174) [ 148.326698] syz-executor1 (7227) used greatest stack depth: 16184 bytes left 11:56:27 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGREP(r0, 0x4008744b, &(0x7f0000003000)=""/174) 11:56:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents(r0, &(0x7f0000000100)=""/49, 0x31) 11:56:27 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000500)=0x400000019) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000280)) 11:56:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000500)=0x400000019) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000280)) 11:56:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:28 executing program 5: r0 = socket$packet(0x11, 0x808000000002, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$packet_int(r0, 0x107, 0x15, &(0x7f0000000100), &(0x7f0000000140)=0x4) 11:56:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:28 executing program 5: r0 = socket$packet(0x11, 0x808000000002, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$packet_int(r0, 0x107, 0x15, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 149.380535] input:  as /devices/virtual/input/input5 11:56:28 executing program 5: r0 = socket$packet(0x11, 0x808000000002, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$packet_int(r0, 0x107, 0x15, &(0x7f0000000100), &(0x7f0000000140)=0x4) 11:56:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:29 executing program 5: r0 = socket$packet(0x11, 0x808000000002, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$packet_int(r0, 0x107, 0x15, &(0x7f0000000100), &(0x7f0000000140)=0x4) 11:56:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) [ 150.037284] input:  as /devices/virtual/input/input6 11:56:29 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x17, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000080)=0x78) 11:56:29 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:29 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x17, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000080)=0x78) 11:56:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:30 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x17, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000080)=0x78) [ 150.798939] input:  as /devices/virtual/input/input7 11:56:30 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x17, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000080)=0x78) 11:56:30 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace(0x420f, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000100)=r0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x7, 0x4, 0x68, 0x6, 0x3e, 0xffffffffffffffff, 0x8}, 0x2c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2, 0x7d49000000000000, @empty, [0x4]}, 0x6) 11:56:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:30 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) [ 151.707621] input:  as /devices/virtual/input/input9 [ 151.827169] input:  as /devices/virtual/input/input10 [ 152.077929] input:  as /devices/virtual/input/input8 11:56:31 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f0000016000)={0x10, 0x6563}, 0xc, &(0x7f000000b000)={&(0x7f0000000a00)=@setlink={0x3c, 0x13, 0x409, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x14, 0x2b, [@nested={0x10, 0x3, [@typed={0xc, 0x0, @fd}]}]}]}, 0x3c}}, 0x0) 11:56:31 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) 11:56:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) 11:56:31 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 152.279420] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 152.292861] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 152.311242] netlink: 'syz-executor0': attribute type 3 has an invalid length. 11:56:31 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 152.323004] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 152.537839] input:  as /devices/virtual/input/input11 [ 152.704433] input:  as /devices/virtual/input/input12 [ 152.893753] input:  as /devices/virtual/input/input13 11:56:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f0000016000)={0x10, 0x6563}, 0xc, &(0x7f000000b000)={&(0x7f0000000a00)=@setlink={0x3c, 0x13, 0x409, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x14, 0x2b, [@nested={0x10, 0x3, [@typed={0xc, 0x0, @fd}]}]}]}, 0x3c}}, 0x0) [ 153.023350] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 153.059943] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. 11:56:32 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 11:56:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) 11:56:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f0000016000)={0x10, 0x6563}, 0xc, &(0x7f000000b000)={&(0x7f0000000a00)=@setlink={0x3c, 0x13, 0x409, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x14, 0x2b, [@nested={0x10, 0x3, [@typed={0xc, 0x0, @fd}]}]}]}, 0x3c}}, 0x0) 11:56:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) [ 153.242702] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 153.274534] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. 11:56:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f0000016000)={0x10, 0x6563}, 0xc, &(0x7f000000b000)={&(0x7f0000000a00)=@setlink={0x3c, 0x13, 0x409, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x14, 0x2b, [@nested={0x10, 0x3, [@typed={0xc, 0x0, @fd}]}]}]}, 0x3c}}, 0x0) 11:56:32 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$TIOCGLCKTRMIOS(r0, 0x405c5503, &(0x7f0000000000)={0x0, 0x0, 0x2}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0xc0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000001c0)=0x4) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r3, r2, &(0x7f0000000180), 0x10013c93e) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x18ba, {{0x2, 0x4e23, @rand_addr}}}, 0x88) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast1}, 0x20) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r5, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000240)="79616d30030300") getsockname(r5, &(0x7f0000002840)=@hci, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x0, 0x0, 0x6, 0x2, 0x1, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0x2, 0xa86, 0x8, 0x1, 0x2f1, 0xec, 0x7ff, 0x7, 0xd53d, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x0, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r6, 0x7, r4, 0x1) syz_open_dev$admmidi(&(0x7f0000000280)='/dev/admmidi#\x00', 0x27f6, 0x202) sendmmsg(r5, &(0x7f0000005900), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 153.575528] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 153.592471] input:  as /devices/virtual/input/input14 [ 153.646263] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. 11:56:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) 11:56:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x6, @multicast2}]}}}]}, 0x38}}, 0x0) [ 153.994726] input:  as /devices/virtual/input/input15 11:56:33 executing program 0: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) 11:56:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x400) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x4c000000) 11:56:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x6, @multicast2}]}}}]}, 0x38}}, 0x0) 11:56:33 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 11:56:34 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x6, @multicast2}]}}}]}, 0x38}}, 0x0) 11:56:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f00000001c0)=[@increfs, @release], 0x0, 0x0, &(0x7f0000000280)}) 11:56:34 executing program 2: syz_emit_ethernet(0x419, &(0x7f0000000700)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x15, 0x2c, 0x0, @dev, @local, {[], @dccp={{0x2c00, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000000040)) 11:56:34 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 11:56:34 executing program 0: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) [ 154.689766] binder: tried to use weak ref as strong ref 11:56:34 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x6, @multicast2}]}}}]}, 0x38}}, 0x0) 11:56:34 executing program 2: syz_emit_ethernet(0x419, &(0x7f0000000700)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x15, 0x2c, 0x0, @dev, @local, {[], @dccp={{0x2c00, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000000040)) [ 154.735231] binder: 7444:7446 Release 1 refcount change on invalid ref 0 ret -22 [ 154.776983] binder: BINDER_SET_CONTEXT_MGR already set [ 154.793520] binder: 7444:7450 ioctl 40046207 0 returned -16 [ 154.821482] binder: 7444:7446 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 154.854109] binder: 7444:7446 Release 1 refcount change on invalid ref 0 ret -22 11:56:34 executing program 1: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) 11:56:34 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 11:56:34 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 11:56:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f00000001c0)=[@increfs, @release], 0x0, 0x0, &(0x7f0000000280)}) 11:56:34 executing program 2: syz_emit_ethernet(0x419, &(0x7f0000000700)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x15, 0x2c, 0x0, @dev, @local, {[], @dccp={{0x2c00, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000000040)) 11:56:34 executing program 1: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) 11:56:34 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) [ 155.087427] binder: tried to use weak ref as strong ref [ 155.127101] binder: 7473:7474 Release 1 refcount change on invalid ref 0 ret -22 11:56:34 executing program 2: syz_emit_ethernet(0x419, &(0x7f0000000700)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x15, 0x2c, 0x0, @dev, @local, {[], @dccp={{0x2c00, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000000040)) 11:56:34 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 11:56:34 executing program 0: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) 11:56:34 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000480)='user\x00', &(0x7f00000004c0), &(0x7f0000000500)="656d30af00", 0xfffffffffffffffb) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x100082) r2 = memfd_create(&(0x7f00000003c0)=' ', 0x2) r3 = memfd_create(&(0x7f0000000c80)='[trusted$\x00', 0x0) pwritev(r3, &(0x7f00000000c0)=[{&(0x7f00000005c0)='\'', 0x1}], 0x1, 0x81806) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000740)={@mcast2, 0x0}, &(0x7f0000000780)=0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000007c0)={@empty, 0x0, r4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r3) sendfile(r1, r3, &(0x7f0000000240), 0x20000102000007) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) getpgid(0xffffffffffffffff) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000600)=""/247) 11:56:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f00000001c0)=[@increfs, @release], 0x0, 0x0, &(0x7f0000000280)}) 11:56:34 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000000480), 0x1000) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="2900000004000000000000000000000001000000000000000000000081c00000010000000000000000"], 0x29) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x8c83}}, 0x30) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 11:56:34 executing program 1: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) 11:56:34 executing program 3: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000400)='stack\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000198, 0x0) memfd_create(&(0x7f0000000000)='%-wlan1{ppp0\x00', 0x1) [ 155.487755] binder: tried to use weak ref as strong ref [ 155.542707] binder: 7501:7502 Release 1 refcount change on invalid ref 0 ret -22 11:56:35 executing program 4: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file1\x00', 0x2) faccessat(r0, &(0x7f0000000040)='./file1\x00', 0x5, 0x0) 11:56:35 executing program 0: getpgid(0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="9688143d732305b8a3e606f9edaa84ef8ab3ee94e9980ad1b4d1a4a757ab2a7ee68d44f14c81cb4fe86683fd602ca26fd21f47876ce54ef3a8cf90b563a3b37c70e12248850600e1bef7bf9dd7ec3f72bd8fc09877fa14720400000000000000fcd6487eec3ea011fbec33dec3ad55efcc26ef5effbf7cf0d3ba59"], 0x7b) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0)={0x0, 0x7fffffff}, 0x8) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000740)={0x3, 0x4}) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x1) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000780)={0x40000, 0x0, [0x25658e4a, 0x0, 0xf9b6, 0x9, 0xffff, 0x7, 0x6, 0xfff]}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='cpuset.mems\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) io_setup(0x8, &(0x7f00000001c0)=0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000880)={0x7f, 0x80, 0xfffffffffffffffd}) io_submit(r3, 0x1, &(0x7f0000000700)=[&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f0000000600)="b529bfd07ffeb350e6d781bea24b8d332db9a4a5c0655a9d64b7644f57f4585a8776eef465d044a901b9d3a5eac144f67f0994180c5dc46b22d9b67bbbde7b9b5b3766dc403df36b9d378aefb337dd27c97dd60d610068ff55ac44ad1af85722f60051204c594ea71e920a8e0ec50b340563f1c2d7f4b2ebc7743914590f8b965a99aeca7ac47ff0de10f62c9878ce56011211692397d3095b28ce73c6fb6604338bb32a91308caeb6d669a7e335458ba47d29087d6626016a2df51b7b95552bf07ce5a03497c32ff714afef540316eb853456d5f5fe58093bd7f0a990ca333385d6e048fac49d2f9c1801847f7c0b500678800e6e2184a1c01ebfd236c4f2", 0xff, 0xf81, 0x0, 0x0, r2}]) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x100000000}) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) 11:56:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f00000001c0)=[@increfs, @release], 0x0, 0x0, &(0x7f0000000280)}) [ 155.843482] binder: tried to use weak ref as strong ref [ 155.848906] binder: 7523:7529 Release 1 refcount change on invalid ref 0 ret -22 11:56:35 executing program 4: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file1\x00', 0x2) faccessat(r0, &(0x7f0000000040)='./file1\x00', 0x5, 0x0) 11:56:35 executing program 3: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000400)='stack\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000198, 0x0) memfd_create(&(0x7f0000000000)='%-wlan1{ppp0\x00', 0x1) 11:56:35 executing program 4: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file1\x00', 0x2) faccessat(r0, &(0x7f0000000040)='./file1\x00', 0x5, 0x0) 11:56:35 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$notify(r1, 0x402, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x1, &(0x7f0000000240)={0xffffffff}, &(0x7f0000000280), 0x8) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x1) unshare(0x40000000) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x0) fcntl$setflags(r1, 0x2, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000200)) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000002c0)={0x0, 0x6}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000380)={r3, @in={{0x2, 0x4e22, @multicast2}}, 0x3ff, 0x9}, &(0x7f0000000440)=0x88) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000340)={0x80, 0x0, 0x3f, 0x3, 0x6, 0xfffffffffffffffc, 0x3, 0x3ff, 0x1f, 0x2}) 11:56:35 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000480)='user\x00', &(0x7f00000004c0), &(0x7f0000000500)="656d30af00", 0xfffffffffffffffb) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x100082) r2 = memfd_create(&(0x7f00000003c0)=' ', 0x2) r3 = memfd_create(&(0x7f0000000c80)='[trusted$\x00', 0x0) pwritev(r3, &(0x7f00000000c0)=[{&(0x7f00000005c0)='\'', 0x1}], 0x1, 0x81806) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000740)={@mcast2, 0x0}, &(0x7f0000000780)=0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000007c0)={@empty, 0x0, r4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r3) sendfile(r1, r3, &(0x7f0000000240), 0x20000102000007) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) getpgid(0xffffffffffffffff) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000600)=""/247) 11:56:35 executing program 5: creat(&(0x7f00000003c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f00000000c0)='./bus\x00', 0x0) 11:56:35 executing program 1: socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00007b1000), 0x4) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000080)) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x2bd, 0x0, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f00007f2000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r0, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x1}], 0x1, 0x0) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, &(0x7f0000000080), 0x1, 0x3) 11:56:35 executing program 4: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file1\x00', 0x2) faccessat(r0, &(0x7f0000000040)='./file1\x00', 0x5, 0x0) 11:56:35 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000480)='user\x00', &(0x7f00000004c0), &(0x7f0000000500)="656d30af00", 0xfffffffffffffffb) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x100082) r2 = memfd_create(&(0x7f00000003c0)=' ', 0x2) r3 = memfd_create(&(0x7f0000000c80)='[trusted$\x00', 0x0) pwritev(r3, &(0x7f00000000c0)=[{&(0x7f00000005c0)='\'', 0x1}], 0x1, 0x81806) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000740)={@mcast2, 0x0}, &(0x7f0000000780)=0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000007c0)={@empty, 0x0, r4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r3) sendfile(r1, r3, &(0x7f0000000240), 0x20000102000007) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) getpgid(0xffffffffffffffff) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000600)=""/247) 11:56:35 executing program 5: creat(&(0x7f00000003c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f00000000c0)='./bus\x00', 0x0) [ 156.602257] IPVS: ftp: loaded support on port[0] = 21 11:56:36 executing program 3: readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/122, 0x7a}], 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000400)='stack\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000198, 0x0) memfd_create(&(0x7f0000000000)='%-wlan1{ppp0\x00', 0x1) 11:56:36 executing program 5: creat(&(0x7f00000003c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f00000000c0)='./bus\x00', 0x0) 11:56:36 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000480)='user\x00', &(0x7f00000004c0), &(0x7f0000000500)="656d30af00", 0xfffffffffffffffb) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x100082) r2 = memfd_create(&(0x7f00000003c0)=' ', 0x2) r3 = memfd_create(&(0x7f0000000c80)='[trusted$\x00', 0x0) pwritev(r3, &(0x7f00000000c0)=[{&(0x7f00000005c0)='\'', 0x1}], 0x1, 0x81806) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000740)={@mcast2, 0x0}, &(0x7f0000000780)=0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000007c0)={@empty, 0x0, r4}) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r3) sendfile(r1, r3, &(0x7f0000000240), 0x20000102000007) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) getpgid(0xffffffffffffffff) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000600)=""/247) 11:56:36 executing program 1: socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00007b1000), 0x4) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000080)) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x2bd, 0x0, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f00007f2000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r0, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x1}], 0x1, 0x0) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, &(0x7f0000000080), 0x1, 0x3) 11:56:36 executing program 5: creat(&(0x7f00000003c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f00000000c0)='./bus\x00', 0x0) [ 157.056824] ================================================================== [ 157.064380] BUG: KASAN: stack-out-of-bounds in update_stack_state+0x5db/0x690 [ 157.071661] Read of size 8 at addr ffff880194a2fa80 by task syz-executor3/7575 [ 157.079017] [ 157.080659] CPU: 0 PID: 7575 Comm: syz-executor3 Not tainted 4.19.0-rc3+ #139 [ 157.087934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 157.097292] Call Trace: [ 157.099886] dump_stack+0x1c4/0x2b4 [ 157.103525] ? dump_stack_print_info.cold.2+0x52/0x52 [ 157.108720] ? printk+0xa7/0xcf [ 157.112006] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 157.116786] print_address_description.cold.8+0x9/0x1ff [ 157.122163] kasan_report.cold.9+0x242/0x309 [ 157.126579] ? update_stack_state+0x5db/0x690 [ 157.131086] __asan_report_load8_noabort+0x14/0x20 [ 157.136022] update_stack_state+0x5db/0x690 [ 157.140349] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 157.145120] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 157.151021] ? retint_kernel+0x2d/0x2d [ 157.154926] ? apic_timer_interrupt+0xa/0x20 [ 157.159346] unwind_next_frame.part.7+0x1ae/0x9e0 [ 157.164191] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 157.170083] ? unwind_dump+0x190/0x190 [ 157.173980] ? __schedule+0x874/0x1ed0 [ 157.177876] ? lock_downgrade+0x900/0x900 [ 157.182049] unwind_next_frame+0x3e/0x50 [ 157.186120] __save_stack_trace+0x7d/0xf0 [ 157.190296] ? apic_timer_interrupt+0xa/0x20 [ 157.194718] save_stack_trace_tsk+0x9c/0xd0 [ 157.199049] proc_pid_stack+0x217/0x3b0 [ 157.203030] ? rcu_bh_qs+0xc0/0xc0 [ 157.206578] ? dname_to_vma_addr.isra.18+0x410/0x410 [ 157.211699] proc_single_show+0x101/0x190 [ 157.215859] seq_read+0x4af/0x1150 [ 157.219522] do_iter_read+0x4a3/0x650 [ 157.223348] compat_readv+0x1b4/0x260 [ 157.227162] ? kasan_check_write+0x14/0x20 [ 157.231419] ? vfs_iter_read+0xb0/0xb0 [ 157.235321] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 157.240880] ? fget_raw+0x20/0x20 [ 157.244349] ? retint_kernel+0x2d/0x2d [ 157.248255] ? do_compat_preadv64+0x91/0x1c0 [ 157.252682] do_compat_preadv64+0x190/0x1c0 [ 157.257014] ? do_compat_readv+0x250/0x250 [ 157.261256] ? trace_hardirqs_on+0xbd/0x310 [ 157.265584] ? entry_SYSENTER_compat+0x70/0x7f [ 157.270263] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 157.275727] __ia32_compat_sys_preadv+0xc7/0x140 [ 157.280499] do_fast_syscall_32+0x34d/0xfb2 [ 157.284831] ? do_int80_syscall_32+0x890/0x890 [ 157.289430] ? entry_SYSENTER_compat+0x68/0x7f [ 157.294021] ? trace_hardirqs_off_caller+0xbb/0x310 [ 157.299042] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 157.303894] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 157.308742] ? trace_hardirqs_on_caller+0x310/0x310 [ 157.313770] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 157.318794] ? prepare_exit_to_usermode+0x291/0x3b0 [ 157.323823] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 157.328681] entry_SYSENTER_compat+0x70/0x7f [ 157.333090] RIP: 0023:0xf7fd8ca9 [ 157.336463] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 157.355365] RSP: 002b:00000000f5fd40cc EFLAGS: 00000296 ORIG_RAX: 000000000000014d [ 157.363083] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000480 [ 157.370355] RDX: 0000000000000198 RSI: 0000000000000000 RDI: 0000000000000000 [ 157.377623] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 157.384909] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 157.392183] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 157.399474] [ 157.401106] The buggy address belongs to the page: [ 157.406044] page:ffffea0006528bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 157.414194] flags: 0x2fffc0000000000() [ 157.418087] raw: 02fffc0000000000 0000000000000000 ffffea0006528bc8 0000000000000000 [ 157.425977] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 157.433850] page dumped because: kasan: bad access detected [ 157.439553] [ 157.441176] Memory state around the buggy address: [ 157.446122] ffff880194a2f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 157.453492] ffff880194a2fa00: f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 [ 157.460852] >ffff880194a2fa80: f2 f2 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 [ 157.468422] ^ [ 157.471798] ffff880194a2fb00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 [ 157.479165] ffff880194a2fb80: f2 f2 f2 f2 00 00 f2 f2 f2 f2 f2 f2 04 f2 f2 f2 [ 157.486522] ================================================================== [ 157.493876] Disabling lock debugging due to kernel taint [ 157.559806] IPVS: ftp: loaded support on port[0] = 21 [ 157.691535] Kernel panic - not syncing: panic_on_warn set ... [ 157.691535] [ 157.698932] CPU: 0 PID: 7575 Comm: syz-executor3 Tainted: G B 4.19.0-rc3+ #139 [ 157.707596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 157.716941] Call Trace: [ 157.719530] dump_stack+0x1c4/0x2b4 [ 157.723161] ? dump_stack_print_info.cold.2+0x52/0x52 [ 157.728358] panic+0x238/0x4e7 [ 157.731546] ? add_taint.cold.5+0x16/0x16 [ 157.735697] ? preempt_schedule+0x4d/0x60 [ 157.739844] ? ___preempt_schedule+0x16/0x18 [ 157.744251] ? trace_hardirqs_on+0xb4/0x310 [ 157.748580] kasan_end_report+0x47/0x4f [ 157.752549] kasan_report.cold.9+0x76/0x309 [ 157.756868] ? update_stack_state+0x5db/0x690 [ 157.761363] __asan_report_load8_noabort+0x14/0x20 [ 157.766290] update_stack_state+0x5db/0x690 [ 157.770611] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 157.775368] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 157.781254] ? retint_kernel+0x2d/0x2d [ 157.785156] ? apic_timer_interrupt+0xa/0x20 [ 157.789567] unwind_next_frame.part.7+0x1ae/0x9e0 [ 157.794409] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 157.800296] ? unwind_dump+0x190/0x190 [ 157.804185] ? __schedule+0x874/0x1ed0 [ 157.808080] ? lock_downgrade+0x900/0x900 [ 157.812232] unwind_next_frame+0x3e/0x50 [ 157.816294] __save_stack_trace+0x7d/0xf0 [ 157.820450] ? apic_timer_interrupt+0xa/0x20 [ 157.824861] save_stack_trace_tsk+0x9c/0xd0 [ 157.829182] proc_pid_stack+0x217/0x3b0 [ 157.833161] ? rcu_bh_qs+0xc0/0xc0 [ 157.836701] ? dname_to_vma_addr.isra.18+0x410/0x410 [ 157.841808] proc_single_show+0x101/0x190 [ 157.845955] seq_read+0x4af/0x1150 [ 157.849507] do_iter_read+0x4a3/0x650 [ 157.853313] compat_readv+0x1b4/0x260 [ 157.857111] ? kasan_check_write+0x14/0x20 [ 157.861353] ? vfs_iter_read+0xb0/0xb0 [ 157.865243] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 157.870786] ? fget_raw+0x20/0x20 [ 157.874242] ? retint_kernel+0x2d/0x2d [ 157.878139] ? do_compat_preadv64+0x91/0x1c0 [ 157.882559] do_compat_preadv64+0x190/0x1c0 [ 157.886878] ? do_compat_readv+0x250/0x250 [ 157.891113] ? trace_hardirqs_on+0xbd/0x310 [ 157.895445] ? entry_SYSENTER_compat+0x70/0x7f [ 157.900025] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 157.905477] __ia32_compat_sys_preadv+0xc7/0x140 [ 157.910237] do_fast_syscall_32+0x34d/0xfb2 [ 157.914561] ? do_int80_syscall_32+0x890/0x890 [ 157.919151] ? entry_SYSENTER_compat+0x68/0x7f [ 157.923733] ? trace_hardirqs_off_caller+0xbb/0x310 [ 157.928745] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 157.933589] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 157.938436] ? trace_hardirqs_on_caller+0x310/0x310 [ 157.943456] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 157.948470] ? prepare_exit_to_usermode+0x291/0x3b0 [ 157.953489] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 157.958332] entry_SYSENTER_compat+0x70/0x7f [ 157.962735] RIP: 0023:0xf7fd8ca9 [ 157.966103] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 157.985007] RSP: 002b:00000000f5fd40cc EFLAGS: 00000296 ORIG_RAX: 000000000000014d [ 157.992711] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000480 [ 157.999972] RDX: 0000000000000198 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.007238] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 158.014502] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 158.021766] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 158.029989] Kernel Offset: disabled [ 158.033610] Rebooting in 86400 seconds..