Extracting prog: 1h32m20.220477569s Minimizing prog: 1h34m37.186700456s Simplifying prog options: 0s Extracting C: 3m49.971224782s Simplifying C: 1h4m7.939124564s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-vmsplice-mkdirat-prlimit64-sched_setscheduler-getpid-sched_setaffinity-munlockall-sched_setscheduler-socketpair$unix-sendmmsg$unix-recvmmsg-creat-mkdirat-mount-openat-read-write$binfmt_elf32-close-mount-mkdirat-socket$key-sendmsg$key-mkdirat-mkdirat-mkdirat-mount detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-setsockopt$SO_TIMESTAMPING-bind$can_j1939-setsockopt$SO_J1939_ERRQUEUE-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$can_j1939-bind$can_j1939-sendmsg$can_j1939-sendmsg$nl_route_sched detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) bind$can_j1939(r0, &(0x7f0000000680)={0x1d, r1}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f00000006c0)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000001700)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000001740)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000001780)={&(0x7f00000017c0), 0x18, &(0x7f0000001800)={&(0x7f0000001840)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r2, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-mkdirat-openat$sequencer2-bpf$MAP_CREATE-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-syz_open_dev$sndmidi-writev-ioctl$FS_IOC_ADD_ENCRYPTION_KEY-connect$inet6-setsockopt$inet_IP_XFRM_POLICY-syz_genetlink_get_family_id$ieee802154-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_REMOVE-syz_io_uring_setup-io_uring_register$IORING_REGISTER_NAPI-io_uring_enter-syz_open_procfs-read$eventfd-ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION detailed listing: executing program 0: r0 = openat$sndseq(0xffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r3 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r3, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r3, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r4, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mmap$IORING_OFF_SQ_RING-socket-prlimit64-getpid-sched_setscheduler-mmap-socketpair$unix-mremap-connect$unix-sendmmsg$unix-recvmmsg-fsopen-sched_setscheduler-madvise-madvise-set_mempolicy-prlimit64-syz_mount_image$msdos-unlinkat-prlimit64-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000004, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x2, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0xf7ff, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000004c0)='pipefs\x00', 0x1) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) set_mempolicy(0x3, &(0x7f0000000240)=0x7, 0x0) prlimit64(r0, 0x4, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000600), &(0x7f0000000640)='./bus\x00', 0x8100c4, &(0x7f0000000680)=ANY=[@ANYBLOB="666c7573682c6e6f646f74732c646973636172642c646d61736b3d30303030303030303030303030303030303030303030322c646d61736b3d30303030303030303030303030303030303030303137372c646f74732c6e6f646f74732c71756965742c646f74732c0023c3cb4d2e3cbf18508098fe0de2af38db67d42d1bc4ab714d52f019082433fc9ca2d7174b2c4ece31c9f4c7a4d53914e100"/167], 0x1, 0x159, &(0x7f0000000740)="$eJzs27+q03AUB/DTf1p16SwOARenoj6BIhXEgKJ00EmhurRSsEt06qP4Or6BLyFIp+LyE4209/a2wx3ShNvPZ+mBLw3nDMnhF8i7O5+mk/ni4/zlKvqtVnQfRRbrVgyiHZ0oLQMAuErWKcWvlFK6vowb3yKlVHdHAEDV7H8AOD32PwCcngv7v113RwBA1V6/efv8cZ6PXmVZP+LnshgX4/K3zJ8+y0f3s38G23+timLc2eQPyjw7n/fi5v/84d78Wty7W+Z/sycv8p38VkyqHx8AAABOwjDb2Hu+Hw4P5WV15v3Azvm9G7e7RxsDALiExZev0/ez2YfPzSl+p0a0oWhy8eN7RAPaaETRiyquXPeTCaja9qavuxMAAAAAAAAAAAAAAOCQY3yfVPeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOtPAAAA///Eo1Fo") unlinkat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x200) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x100008b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x6, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000effd0010000000004000700070100000807f30075"], &(0x7f0000000b00)='GPL\x00', 0x3, 0x109, &(0x7f0000000b40)=""/265, 0x41000}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./proc\x00', 0x1ff) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_read_part_table-open-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_clone-exit-sync-sync-sync-mmap$IORING_OFF_SQ_RING-setfsuid-openat-socket$xdp-bpf$MAP_CREATE-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH detailed listing: executing program 0: socket(0x10, 0x803, 0x0) syz_read_part_table(0x1051, &(0x7f00000005c0)="$eJzsz7utAjEUBNB5eou1KwIktD2QkBJTBCKnEkQLtEFEgwhkzKcDtME5gcfXGgc3TMK5xeqaTY7j8vP+/8rbdyrbrl773JPMM2uFLkONv/ecvh67MTk8f5Z1ktOQLLqU1ijZX36zHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM2yMAAP//2qsHZg==") open(0x0, 0x121342, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001640)={0x1, &(0x7f0000001680)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0x6) sync() sync() sync() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setfsuid(0x0) openat(0xffffffffffffff9c, &(0x7f00000016c0)='./file1\x00', 0x101042, 0x65) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00007c2000/0x4000)=nil, &(0x7f00009dc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000726000/0x13000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ttyS3-prlimit64-sched_setscheduler-getpid-sched_setaffinity-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat$urandom-add_key-mmap$IORING_OFF_SQ_RING-ioctl$TIOCSETD-ioctl$TIOCVHANGUP-openat$ttyS3 detailed listing: executing program 0: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000400), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000440), 0x4000087, 0x2, 0x0) openat$urandom(0xffffffffffffff9c, 0x0, 0x101402, 0x0) add_key(&(0x7f0000000a80)='keyring\x00', &(0x7f0000000ac0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000b40)=0x1b) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000b80), 0xca00, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ttyS3-prlimit64-sched_setscheduler-getpid-sched_setaffinity-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat$urandom-add_key-mmap$IORING_OFF_SQ_RING-ioctl$TIOCSETD-ioctl$TIOCVHANGUP-openat$ttyS3 detailed listing: executing program 0: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000400), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000440), 0x4000087, 0x2, 0x0) openat$urandom(0xffffffffffffff9c, 0x0, 0x101402, 0x0) add_key(&(0x7f0000000a80)='keyring\x00', &(0x7f0000000ac0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000b40)=0x1b) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000b80), 0xca00, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 37 programs with base timeout 6m0s testing program (duration=6m9s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 21, 14, 21, 5, 15, 15, 2, 21, 7, 19, 25, 9, 27, 24, 14, 6, 26, 28, 20, 24, 16, 21, 9, 27, 8, 6, 4, 24, 6, 9, 23, 14, 3, 21, 12, 27] detailed listing: executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="44000000100001040000020000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e00000400028008000500", @ANYRESOCT], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000200)=ANY=[@ANYBLOB="aa0100"], 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc, &(0x7f0000000300)=[{&(0x7f0000000240)=ANY=[], 0x14}], 0x1}, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000001c0), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1b0000000000000000000000008000000000", @ANYRES32, @ANYBLOB="ffff00000000000000f8ff000000000000000000", @ANYRES32=0x0, @ANYRES32], 0x50) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000580)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000005c0)={0x0, 0x1}, 0x1}, 0x94) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000600), 0x0) close(r6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_ext={0x1a, 0xf, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r5, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000007c0)={0x1, &(0x7f0000000800)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x2000000000000) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, 0x0}, 0x0) executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x815, &(0x7f0000000180)={[{@data_err_ignore}, {@resgid}, {@abort}, {@barrier_val={'barrier', 0x3d, 0x1}}, {@nobarrier}]}, 0x9, 0x624, &(0x7f0000001340)="$eJzs3ctvVNUfAPDvvZ0+aH8/W4hB2UgTYyBRWlrAEGMixC0h+Ni5qrQQpFBCa7RIQklwozFuXJi4ciH+F0ri1oVbF25cGEPSGMNCDMqYO71TZjqddvqYmT4+n+S299G553vbfHvOnDnn3gB2rcHsSxpxICKuJRH9FccKkR8cXPi5B3/ePJ8tSRSLb/2RxM1byVzluZL8e1/+4n/7I/kpjdjXUVvu9OyNy2OTkxPX8+3hmSvXhqdnbxy5dGXs4sTFiaujL4+ePHH8xMmRoxu6vkLF+pk7733Q/8nZd7756lEy8u0vZ5M4FY/z2LLrWvra7g2VnP3OBqO44OGTvWnp68kNnnur+Ku/+necSZbuYMu6EBH7I6IzIp6J/uio+Gv2x8dvtDU4oKmKSZTrKGDXSVbP/87aXT3NCQZooXI7oPzefrn3wbXSJrdKgFaYP73QSbaQ+50RUc7/wkLfYPSU+gZ6HyRV/TxJRGysZ25BVsaPP5y9ky1Rpx8OaI652+Ve7qX1f1LKzYHoKW31Pkir8j+tWLL9b66z/MEl2/IfWmfudkQ8m9f/XbHu/H93neXLfwAAAAAAANg8905HxEvLjf9LF8f/dC0z/qcvIk5tQvmrf/6X3s9Xkk0oDqgwfzri1Zrxv/9Ujg4e6Mg/5/9/aTxAZ3rh0uTE0Yh4KiIOR2d3tj1SfdqqAcJHPtv3Zb3yK8f/ZUtWfnksYH6q+4UlE3HHx2bGNufqYXebvx3xsDT+92C+p3r8T1b/JzX1/6evZwl+rcEy9r1w91zVjt+e/HtYPf+BZil+HXFo2fk/T5rbycr35xgutQeGy62CWs999Pl39cqX/9A+Wf3fu3L+dyeV9+uZXtv5uyLi2GyhWO/4etv/XcnbHeXzZz4cm5m5PhLRlZyp3T+6tphhpyrnQzlfsvw//PzK/X+L7f+KPNwTEXMNlrn/cd+v9Y6p/6F9svwfX7n+H6iu/9e60hOjdwe+z28xVuNcQ/X/8VKdfjjfo/8PKtXej6PRBG1LuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwzaUR8b9I0qHF9TQdGoroi4inozednJqeefHC1PtXx7Nj1c//71/YTsrP/x+o2B5dsn0sIvZGxBcde0rbQ+enJsfbffEAAAAAAAAAAAAAAAAAAACwRfSV5vwXu5fO/8/83tHu6ICmK+Tf5TvsPoV1v7LYvamBAC23/vwHtrvG87+zqXEArVc//x8+Kpa0NByghbT/YfdaZ/77uAB2APU/7FYN9un1NDsOoB0arv/nmxsHAAAAAACwKfYevPdzEhFzr+wpLZmu/JjB/rCzpe0OAGgbY3hh9ypMtTsCoF28xweSxbW/l53sX3/0f9KcgAAAAAAAAAAAAACAGocOrH3+/5xJg7AjpBErPMLb2H7YyVaoypdLfjU/7CD1H/3RSN2faCHANmb+P7BaPb7x+f/FW2sKCAAAAAAAAAAAAACo1XPj8tjk5MT16dntt/La1ghjbStzY1sijE1debzaz5QfM7+2M3dGxNa4wFavlG/B0cYw2vg/CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqPJfAAAA//8MwS/R") socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x39b3) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) executing program 4: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x1, 0x1, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x16, 0xc, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000000000000007a0af8ff0200000018110000", @ANYRES32=r0, @ANYBLOB="00000000000000001501020000000020181100", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000100000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000840)='\x00\x00\b[\x00'/14, 0x0, 0xd6f6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000400), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000440), 0x4000087, 0x2, 0x0) openat$urandom(0xffffffffffffff9c, 0x0, 0x101402, 0x0) add_key(&(0x7f0000000a80)='keyring\x00', &(0x7f0000000ac0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000b40)=0x1b) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000b80), 0xca00, 0x0) executing program 32: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000400), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000440), 0x4000087, 0x2, 0x0) openat$urandom(0xffffffffffffff9c, 0x0, 0x101402, 0x0) add_key(&(0x7f0000000a80)='keyring\x00', &(0x7f0000000ac0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000b40)=0x1b) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000b80), 0xca00, 0x0) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r2, &(0x7f0000000180)=""/102392, 0x18ff8) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019240)={0x1, &(0x7f0000019280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000019300)) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') syz_ublk_setup_io_uring(0x20, &(0x7f0000019340)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r4, &(0x7f0000019480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000019500)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000019540)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000019580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ddc, 0x80, 0x2, 0x33d, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x20, 0x0, 0x142}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0x9, 0x135}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x800, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000c40)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000c80)={'pim6reg0\x00', 0x400}) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x2c0800, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000e80)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000000ec0)={'syzkaller0\x00'}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000004, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x2, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0xf7ff, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000004c0)='pipefs\x00', 0x1) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x6) set_mempolicy(0x3, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000600), &(0x7f0000000640)='./bus\x00', 0x8100c4, &(0x7f0000000680)=ANY=[@ANYBLOB="666c7573682c6e6f646f74732c646973636172642c646d61736b3d30303030303030303030303030303030303030303030322c646d61736b3d30303030303030303030303030303030303030303137372c646f74732c6e6f646f74732c71756965742c646f74732c0023c3cb4d2e3cbf18508098fe0de2af38db67d42d1bc4ab714d52f019082433fc9ca2d7174b2c4ece31c9f4c7a4d53914e100"/167], 0x1, 0x159, &(0x7f0000000740)="$eJzs27+q03AUB/DTf1p16SwOARenoj6BIhXEgKJ00EmhurRSsEt06qP4Or6BLyFIp+LyE4209/a2wx3ShNvPZ+mBLw3nDMnhF8i7O5+mk/ni4/zlKvqtVnQfRRbrVgyiHZ0oLQMAuErWKcWvlFK6vowb3yKlVHdHAEDV7H8AOD32PwCcngv7v113RwBA1V6/efv8cZ6PXmVZP+LnshgX4/K3zJ8+y0f3s38G23+timLc2eQPyjw7n/fi5v/84d78Wty7W+Z/sycv8p38VkyqHx8AAABOwjDb2Hu+Hw4P5WV15v3Azvm9G7e7RxsDALiExZev0/ez2YfPzSl+p0a0oWhy8eN7RAPaaETRiyquXPeTCaja9qavuxMAAAAAAAAAAAAAAOCQY3yfVPeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOtPAAAA///Eo1Fo") bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x6, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000effd0010000000004000700070100000807f3007500fcff0003000095"], &(0x7f0000000b00)='GPL\x00', 0x3, 0x109, &(0x7f0000000b40)=""/265, 0x41000}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./proc\x00', 0x1ff) executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, r0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000001c0), 0x2, 0x141102) writev(r1, &(0x7f0000000340)=[{&(0x7f00000003c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x63) readlinkat(0xffffffffffffffff, &(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000500)=""/188, 0xbc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000880)=@mangle={'mangle\x00', 0x2, 0x6, 0x620, 0x168, 0x248, 0x168, 0x390, 0x248, 0x550, 0x550, 0x550, 0x550, 0x550, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [0xffffffff, 0xff000000, 0xffffff00], 'veth1_to_hsr\x00', 'macvtap0\x00', {}, {}, 0x84, 0x0, 0x0, 0x2}, 0x0, 0x120, 0x168, 0x0, {0x7a00000010000000}, [@inet=@rpfilter={{0x28}, {0x1}}, @common=@inet=@multiport={{0x50}, {0x0, 0x0, [0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e22], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@private=0xa000000, @ipv4=@empty, 0xa, 0x30, 0x1}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, [0xffffff00, 0xff000000, 0x0, 0xff000000], [0xff, 0xff, 0xffffff00, 0x71b681034600913a], 'macsec0\x00', 'veth1_to_batadv\x00', {0xff}, {0xff}, 0x3b, 0x6, 0x4, 0x20}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x100, 0x148, 0x48000000, {}, [@common=@ah={{0x30}, {[0x4d2, 0x4d3], 0xa000000, 0x5, 0x4}}, @inet=@rpfilter={{0x28}, {0x1eef34d1141a4022}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3, 'syz0\x00', {0x9b80000000}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback, 0x0, 0xfe}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x680) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./file1\x00', 0x2) mkdir(&(0x7f0000000f40)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000f80)='./bus\x00', &(0x7f0000000fc0), 0xa28000, &(0x7f0000001000)) socket$nl_rdma(0x10, 0x3, 0x14) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000010c0)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c3a436ede9461518614000000", @ANYRES16=r3, @ANYBLOB="000301000000fcdbdf25040000000500220000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8882}, 0x4004004) r4 = syz_open_dev$dvb_frontend(&(0x7f00000011c0), 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xf, 0xa, 0x1, 0x0, 0x4000, 0xffffffffffffffff, 0x8000, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x5}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x7, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xbf, 0x0, 0x0, 0x0, 0xfffffffd}, [@map_idx_val={0x18, 0x1, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x10001}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x10}]}, &(0x7f00000013c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback=0x25, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001400)={r6, r5}, 0xc) ioctl$FE_SET_PROPERTY(r4, 0x40086f52, &(0x7f0000001440)={0x2b, &(0x7f0000001480)=[{0x11, '\x00', @data=0x6, 0xf}]}) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000c40)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000c80)={'pim6reg0\x00', 0x400}) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x20702, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000d00)={'syzkaller0\x00', 0xca58c30f81b6079f}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e40), 0x2c0800, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000e80)) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000000ec0)={'syzkaller0\x00'}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 5: socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0xf7) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') sendfile(r3, r3, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) pread64(r4, &(0x7f00000002c0)=""/267, 0x10b, 0x304) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee", 0x1d}], 0x1}, 0x0) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 5: fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000600)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000019640)='./sys\x00', 0x1ff) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) request_key(0x0, &(0x7f00000197c0)={'syz', 0x3}, 0x0, 0xfffffffffffffffe) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019840)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000019880)={0x2020}, 0x2020) mount(0x0, &(0x7f000001b8c0)='./sys\x00', 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r5, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574"], 0x60}}, 0x0) executing program 0: io_uring_setup(0x4fa, &(0x7f0000000680)={0x0, 0x7fdd, 0x200, 0x1, 0x17c}) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000019700)={0x40000000, 0x0, &(0x7f0000019740)={&(0x7f0000019780)=ANY=[@ANYBLOB="020700"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000197c0)={0x2, 0x0, @local}, 0x16) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='smaps_rollup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f00009ca000/0x3000)=nil, 0x3000, 0x2, &(0x7f0000000200)=0x4, 0x8, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r6, &(0x7f0000019940)={0x2020}, 0x2020) connect$inet(r4, &(0x7f0000019800)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r4, 0x0, 0x0, 0x1c) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000500)={0x1f, 0xffff, 0x3}, 0x6) write(r7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./trace\x00', 0x1ff) executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r2 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r2, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r2, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r3, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r1, &(0x7f00000002c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$get_persistent(0x16, 0x0, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x180080e, &(0x7f0000000400)={[{@utf8}, {@allow_utime={'allow_utime', 0x3d, 0xb1}}, {}, {@errors_continue}, {@namecase}, {@zero_size_dir}, {@fmask={'fmask', 0x3d, 0x5}}, {@iocharset={'iocharset', 0x3d, 'iso8859-14'}}, {@discard}, {@namecase}]}, 0x1, 0x1543, &(0x7f0000000800)="$eJzs3AucjdX6OPDnWWu9Y0zSbpLLsNZ6Xja5LJIklyS5VJIkSXJLSJIcSUgMuSUNSUguQ3IZQnKZmDTu9/slIUnOJElIbsn6fybmOJ06v87vdyrnfzzfz2d/Zj177We9693P7Pey5vJ15yE1GtasWp+I4N+CF74kAkAsAAwAgGsAIACAsvFl4zP7s0tM/Pc2wn5fD6Vc7hmwy4nrf2Xj+l/ZuP5XNq7/lY3rf2Xj+l/ZuP5XNq4/Y1eyTdPyXcuPK/fxh63/X4x5/f8/GZ///4tklBzzxZqS13cBiPlXU7j+///DfyOX6/9fK/hXXsT1v7Jx/a9UsZd7Auw/AH/+rwTZ/mkP1//KxvVn7Er292vBsXD516P/7AdE/sifgfieF97lf/qajhfLcPn2nzHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY+xOc9pcoAMhqX+55McYYY4wxxhhj7Pfjs13uGTDGGGOMMcYYY+yPhyBAgoIAYiAbxEJ2iAMBEJPVfy3Ew3WQC66H3JAH8kI+SID8UAA0GLBAEEJBKARRKAxF4AYoCsWgOJQAByWhFNwIpeEmKAM3Q1m4BcrBrVAeKkBFqAS3QWW4HarAHVAV7oRqUB1qQE24C+6Ge6AW3Au14T6oA/dDXXgA6sGDUB8eggbwMDSER6ARPAqNoQk0hWbQ/P+U/wJ0hxehB/SEROgFveEl6AN9oR/0hwHwMgyEV2AQvApJMBiGwGswFF6HYfAGDIcRMBLehFHwFoyGMTAWxkEyjIcJ8DZMhHdgEkyGKTAVUmAaTId3YQbMhFnwHsyG92EOzIV5MB9S4QNYAAshDT6ERfARpMNiWAJLYRkshxWwElbBalgDa2EdrIcNsBE2wWbYAlthG2yHHfAx7IRPYBfshj3wKeyFz/6X+af+Ib8LAgIKFKhQYQzGYCzGYhzGYQ7MgTkxJ0YwgvEYj7kwF+bG3JgX82ICJmABLIAGDRISFsSCGMUoFsEiWBSLYnEsjg4dlsJSWBpvwjJYBstiWSyH5bA8VsAKWAkrYWWsjFWwClbFqlgNq2ENrIF34V3YC2thLayNtbEO1slansL6WB8bYANsiA2xETbCxtgYm2JTbI7NsQW2wJbYEltja2yDbbAttsV22A7bY3vsgB2wI3bETtgJO2Nn7IJdsWvGC9kAX8QXsSdWE72wN/bGPpiUrR/2x/74Mg7EV/AVfBWTcDAOwdfwNXwdh+FJHH5+BI7EkVhZvIWjcQySGIfJmIwTcAJOxIk4CSfjZJyKKTgNp+N0nIEzcSa+h7PxfXwf5+JcnI+pmIoLcCGmYRouwlOYjotxCS7FZbgcl+FKXIUrcQ2uxTW4HtfjRtyIm3EzbsWtuB2348eoAPAT3I27MQn34l7ch/twP+7HA3gAMzADD+JBPISH8DAexiN4BI/iMTyOx/AEnsCTeApP42k8i2fxHD6X8GWDj4utTgKRSQklYkSMiBWxIk7EiRwih8gpcoqIiIh4ES9yiVwit8gt8oq8IkEkiAKigDDCCBJh5pFCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGLKCduFeVFBdHKVRKVRGXR2lURd4iqoqqoJqqLGqKmqCnuFneLWqKWqC1qizqijqgrHhD1RC/shw+JzMo0FIOxkRiCjUUTIS8eoVqIYdhStBKtxRNiBA7HtqKFayeeFu3FaOwg/iLG4LOikxiHncXzoovoKrqJF0R30dL1ED3FJOwleoup2Ef0Ff1EfzEDq4v3cHb2GuJVkSQGiyHiNTEfXxfDxBtiuBghRoo3xSjxlhgtxoixYpxIFuPFBPG2mCjeEZPEZDFFTBUpYpqYLt4VM8RMMUu8J2aL98UcMVfME/NFqvhALBALRZr4UCwSH4l0sVgsEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQH4ud4hOxS+wWe8SnYq/4TOwTn4v94gtxQPxVZIgvxUHxlTgkvhaHxTfiiPhWHBXHxHHxnTghvhcnxSlxWpwRZ8UP4pz4UZwXXoBEKaSUSgYyRmaTsTK7jJNXyRwyyDr+y3h5ncwlr5e5ZR6ZV+aTCTK/LCC1NNJKkqEsKAvJqCwsi8gbZFFZTBaXJaSTJWUpeaMsLW+SZeTNsqy8RZaTt8rysoKsKCvJ22RlebuEyIVtVJPVZQ1ZU94lE+EeWUveK2vL+2Qdeb+sKx+Q9eSDsr58SDaQD8uG8hHZSD4qG8smsqlsJpvLx2QL+bhsKVvJ1vIJ2UY+KdvKp2Q7+bRsL/3Fb5FnZSf5nOwsn5ddZFfZTf4oz0sve8ieEnqB7C1fkn1kX9lP9pcD5MtyoHxFDpKvyiQ5WA6Rr8mh8nU5TL4hh8sRcqR8U46Sb8nRcowcK8fJZDleTpBvy4nyHTlJTpZT5FSZIqfJfhdHmiXlb+a//Sv5g37a+ka5SW6WW+RWuU1ulzvkx3Kn3Cl3yV1yj9wj98q9cp/cJ/fL/fKAPCAzZIY8KA/KQ/KQPCwPyyPyiDwqj8kz8jt5Qn4vT8pT8pQ8I8/Ks/LcxfcAFCqhpFIqUDEqm4pV2VWcukrlUFernOoaFVHXqnh1ncqlrle5VR6VV+VTCSq/KqC0Msoq8tdceItVYbz4DaOKqxLKqZKqlLrxt/NVqAqqQiqqCqsi6gZVVBX7WX7W/BL/yfyaq+aqhWqhWqqWqrVqrdqoNqqtaqvaqXaqvWqvOqgOqqPqqDqpTqqz6qy6qC6qm+qmuqvuqofqoRJVouqtXlJ9VF/VT/VXA9TLInMfBqlBKkklqSFqiBqqhqphapgaroarkWqkGqVGqdFqtBqrxqpklawmqAlKqolqkpqkpqgpKkWlqOlqupqhZqhZapaarWarOWqOmqfmqVSVqhaoBSpNpalFapFKV4vVYrVULVXL1XK1Uq1Uq9VqtVatVevVepWuNqlNaovaorapbWqH2qF2qp1ql9ql9qg9aq/aq/apfWq/2q8OqAMqQ2Wog+qgOqQOqcPqsDqijqij6qg6ro6rE+qEOqlOqtPqtDqrzqpz6pw6r85nXvYFIhCBClQQE8QEsUFsEBfEBTmCHEHOIGcQCSJBfBAf5AquD3IHeYK8Qb4gIcgfFAh0YAIbiItFjwaFgyLBDUHRoFhQPCgRuKBkUCq4MSgd3BSUCW4Oyga3BOWCW4PyQYWgYlApuC2oHNweVAnuCKoGdwbVgupBjaBmcFdwd3BPUCu4N6gd3BfUCe4P6gYPBPWCB4P6wUNBg+DhoGHwSNAoeDRoHDQJmgbNgua/6/jen8zzuOuhe+pE3Uv31i/pPrqv7qf76wH6ZT1Qv6IH6Vd1kh6sh+jX9FD9uh6m39DD9Qg9Ur+pR+m39Gg9Ro/V43SyHq8n6Lf1RP2OnqQn6yl6qk7R0/R0/a6eoWfqWfo9PVu/r+fouXqenq9T9Qd6gV6o0/SHepH+SKfrxXqJXqqX6eV6hV6pV+nVeo1eq9fp9XqD3qg36c16i96qt+nteof+WO/Un+hderfeoz/Ve/Vnep/+XO/XX+gD+q86Q3+pD+qv9CH9tT6sv9FH9Lf6qD6my+jv9An9vT6pT+nT+ow+q3/Q5/SP+rz2mRf3mad3o4wyMSbGxJpYE2fiTA6Tw+Q0OU3EREy8iTe5TC6T2+Q2eU1ek2ASTAFTwGQiQ6agKWiiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5jZzm7nd3G7uMHeYO82dprqpbrLORLVMLVPb1DZ1TB1T19Q19Uw9U9/UNw1MA9PQNDSNTCPT2DQ2TU1T09w0Ny1MC9PStDStTWvTxrQxbU1b0860M+1Ne9PBdDAdTUfTyXQynU1n08V0Md1MN9PddDc9TA+TaBJNb9Pb9DF9TD/TzwwwA8xAM9AMMoNMkkkyQ8wQM9QMNcPMMDPcjDAjMy9UzVtmtBljxppxJtkkmwlmgploJppJZpKZYqaYFJNippvpZoaZYWaZWWa2mW3mmDlmnplnUk2qWWAWmDSTZhaZRSbdpJslZolZZpaZFWaFWWVWmTVmjVkH68wGs8FsMpvMFrPFbDPbzA6zw+w0O80us8vsMXvMXrPX7DP7zH6z3xwwB0yGyTAHzUFzyBwyh81hc8QcMUfNUXPcHDcnzAlz0pw0p81pc9bkuXi+9CbWZrdx9iqbw15tc9pr7D/GeW0+m2Dz2wJW29w2z89iY60taovZ4raEdbakLWVv/EVc3lawFW0le5utbG+3VX4R323vsbXsvba2vc/WtHf9LK5j77d17SO2HiKAbWIb2Ga2oX3ENrKP2sa2iW1qm9k29knb1j5l29mnbXv7zC/iBXahXWVX2zV2rd1ld9vT9ow9ZL+2Z+0PtoftaQfYl+1A+4odZF+1SXbwL+KR9k07yr5lR9sxdqwd94t4ip1qU+w0O92+a2fYmb+IU+0HdrZNs3PsXDvPzv8pzpxTmv3QLrIf2XQbwBK71C6zy+0Ku/Jvc11q19sNdqPdaT+xW+xWu81utzuyLoTtbrvHfmr32s/sQfuV3W+/sAfsYZthv/wpzty/w/Ybe8R+a4/aY/a4/c6esN+rrOzMff/O/mjPW2+BkIAkKQoohrJRLGWnOLqKctDVlJOuoQhdS/F0HeWi6yk35aG8lI8SKD8VIE2GLBGFVJAKUZQKU9ZKQnEqQY5KUim6kUrTTVSGbqaydAuVo1upPFWgilSJbqPKdDtVoTuoKt1J1ag61aCadBfdTfdQLbqXatN9VIfup7r0ANWjB6k+PUQN6GFqSI9QI3qUGlMTakrNqDk9Ri3ocWpJrag1PUFt6ElqS09RO3qa2tMz1IH+Qh3pWepEz1Fnep66UFfqRi9Qd3qRelBPSqRe1Jteoj7Ul/pRfxpAL9NAeoUG0auURINpCL1GQ+l1GkZv0HAaQSPpTRpFb9FoGkNjaRwl03iaQG/TRHqHJtFkmkJTKYWm0XR6l2bQTJpF79Fsep/m0FyaR/MplT6gBbSQ0uhDWkQfUTotpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF22kEf0076hHbRbtpDn9Je+oz20ee0n76gA/RXyqAv6SB9RYfoazpM3/ie9C0dpWN0nL6jE/Q9naRTdJrO0Fn6gc7Rj3SePEGIoQhlqMIgjAmzhbFh9jAuvCrMEV4d5gyvCSPhtWF8eF2YK7w+zB3mCfOG+cKEMH9YINShCW1IYRgWDAuF0bBwWCS8ISwaFguLhyVCF5YMS4U3hqXDm8Iy4c1h2fCWsFx4a1g+rBA+cl+l8Lawcnh7WCW8I6wa3hlWC6uHNcKa4V3h3eE9Ya3w3rB2eF9YJrw/rBs+ENYLHwzrhw+FDcKHw4bhI2Gj8NGwcdgkbBo2C5uHj4UtwsfDlmGrsHV4VdgmfDJsGz4VtgufDtuHz/zUf//CrP4nftGfGPYKe4cvhS+F3t8r50XnR1OjH0QXRBdG06IfRhdFP4qmRxdHl0SXRpdFl0dXRFdGV0VXR9dE10bXRddHN0Q3Rr2vmQ0cOuGkUy5wMS6bi3XZXZy7yuVwV7uc7hoXcde6eHedy+Wud7ldHpfX5XMJLr8r4LQzzjpyoSvoCrmoK+yKuBtcUVfMFXclnHMlXSnXzDV3zV0L97hr6Vq51u4J94R70j3pnnJPuadde/eM6+D+4jq6Z10n95x7zj3vuriurpt7wXV343Ne+Ewmut6ut+vj+rh+rp8b4Aa4gW6gG+QGuSSX5Ia4IW6oG+qGuWFuuBvuRrqRbpQb5Ua70W6sG+uSXbKb4Ca4iW6im+QmuSluiktxKW66m+5muBmu8swLW5nj5rh5bp5Ldalugcu8Zkxzi9wil+7S3RK3xC1zy9wKt8KtcqvcGrfGrXPr3Aa3wW1ym9wWt8Vtc9vcDrfD7XQ73a6sOw631+1z+9x+t98dcH91Ge5Ld9B95Q65r91h94074r51R90xd9x95064791Jd8qddmfcWfeDO+d+dOedd8mR8ZEJkbcjEyPvRCZFJkemRKZGUiLTItMj70ZmRGZGZkXei8yOvB+ZE5kbmReZH0mNfBBZEFkYSYt8GFkU+SiSHlkcWRJZGlkWWR7xPv+W0Bf0hXzUF/ZF/A2+qC/mi/sS3vmSvpS/0Ze+MO9072/x5fytvryv4Cv6R31j38Q39c18c/+Yb+Ef9y19K9/aP+Hb+Cd9W/+Ub+ef9u39M76D/4vv6J/1nfxzvrN/3nfxXX03/4Lv7l/0PXxPn+h7+d7+Jd/H9/X9fH8/wL/sB/pX/CD/qk/yg/0Q/5of6l/3w/wbfrgf4UfGvOlHZd0iwzif7Mf7Cf5tP9G/4yf5yX6Kn+pT/DQ/3b/rZ/iZfpZ/z8/27/s5fq6f5+f7VP+BX+AX+jT/oV/kP/LpfnHWod6v8Cv9Kr/ar/Fr/Tq/3m/wG/0mv9lv8Vv9Nr/d7/Af+53+E7/L7/Z7/Kd+r//M7/Of+/3ns/4C7Ut/0H/lD/mv/WH/jT/iv/VH/TF/3H/nT/jv/Ul/yp/2Z/xZ/4M/53/05/lv1hhjjDHG/iXjLzXFz3suLOf3+pUc8Xcv7g0AV2/Nl/H3/ZlXlOtyX2j3FQmxmV+f7tn5oaxHtWqJiYkXX5suISg0FyDrJ0GZfvrVg4vxYmgNT0I7aAWlf3X+fUXXs/Qb40dvAYj7u5zMCWXFl8b/HAATf2X8x54YuaBceDr+fxh/LkDRQpdyssOleDG0/ml9pRWU+Sfzz9PiN+af/YtkgJZ/G/mClr+Yfyl4HJ6Bdn/rYYwxxhhjjDHGLukrKnbMuv/M+j2bX7s/T1CXcrLBpfi37s8ZY4wxxhhjjDF2+T3btdtTj7Vr16rj/75R5f+U9S83GsEfNTI3frXhPUDWMwoAOj5bc+KlZ/6n9Lhf6wLIbMg/cy82/ynbSrr40fnHrmVnfAD/GaX8PRqX+cDEGGOMMcYY+91duuj/+fPqck2IMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi7Av0Z/07scu8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrn9vwAAAP//RgL1kg==") r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f80)={&(0x7f0000001fc0)=@newtaction={0x80, 0x30, 0xffff, 0x0, 0x25dfdbff, {}, [{0x6c, 0x1, [@m_ife={0x68, 0x1, 0x0, 0x0, {{0x8}, {0x40, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @local}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x4, 0x5, 0x1}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x45b9}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000002040), 0x0, 0x0) ioctl$OCFS2_IOC_UNRESVSP64(r6, 0x4030582b, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r9, @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r8], 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$NL80211_CMD_SET_BSS(r7, &(0x7f0000001f00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10040}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e80)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x5}]}, 0x1c}}, 0x800) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000740)={0x0, 0x6000, &(0x7f0000000780)=[{&(0x7f00000007c0)='U', 0xa00120}], 0x1}, 0x3) executing program 5: socket(0x10, 0x803, 0x0) syz_read_part_table(0x1051, &(0x7f00000005c0)="$eJzsz7utAjEUBNB5eou1KwIktD2QkBJTBCKnEkQLtEFEgwhkzKcDtME5gcfXGgc3TMK5xeqaTY7j8vP+/8rbdyrbrl773JPMM2uFLkONv/ecvh67MTk8f5Z1ktOQLLqU1ijZX36zHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM2yMAAP//2qsHZg==") open(0x0, 0x121342, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001640)={0x1, &(0x7f0000001680)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0x6) sync() sync() sync() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setfsuid(0x0) openat(0xffffffffffffff9c, &(0x7f00000016c0)='./file1\x00', 0x101042, 0x65) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00007c2000/0x4000)=nil, &(0x7f00009dc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000726000/0x13000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000180)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019240)={0x1, &(0x7f0000019280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000019300)) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/uts\x00') syz_ublk_setup_io_uring(0x20, &(0x7f0000019340)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r5, &(0x7f0000019480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000019500)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000019540)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000019580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ddc, 0x80, 0x2, 0x33d, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x20, 0x0, 0x142}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0x9, 0x135}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x800, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, 0x0, 0xfdef) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f00000002c0)=ANY=[@ANYRESHEX], 0x10) write$9p(r0, &(0x7f0000000300)="d5", 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000440)='GPL\x00', 0x8, 0x0, 0x0, 0x100, 0xf8, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x0, 0x0, 0x0, 0x1}}, 0x40) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000001000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./proc_mnt/kcore\x00', 0x0, 0x0) readv(r0, &(0x7f0000002240)=[{0x0}], 0x1) executing program 0: socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0xf7) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') sendfile(r3, r3, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) pread64(r4, &(0x7f00000002c0)=""/267, 0x10b, 0x304) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000600)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000640)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000680), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000006c0)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000700)=@ccm_128={{0x303}, "0e57b3d487e2db32", "a9df7ccffde8899f914d4f2c3e263509", "3c36a51c", "6775c975b6b15e11"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000740)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28) writev(r0, &(0x7f00000007c0)=[{&(0x7f0000000800)="bdc99118158ffb3222a77dce29e913c7fa56753b708da3c283982b260ce5abd73c63ebd0b452b90f91943532f9d9b862c0ea33a403e4296db241fea24984873479c48ab65e8a04715da0a09b9100da082e1ef81b1b2e9c09b2cdf5c8b51d073cb8d0b31622fbdfa82a7f4098302d956b7b9603b9119bd83b0ae863bf29bfb5ff0fdec352e751f2002915b9a97ccb11880df592aa6e77c60a33", 0x99}], 0x1) readv(r0, &(0x7f00000008c0)=[{&(0x7f0000000900)=""/153, 0x99}, {&(0x7f00000010c0)=""/4115, 0x1013}], 0x2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000004, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x2, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0xf7ff, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000004c0)='pipefs\x00', 0x1) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) set_mempolicy(0x3, &(0x7f0000000240)=0x7, 0x0) prlimit64(r0, 0x4, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000600), &(0x7f0000000640)='./bus\x00', 0x8100c4, &(0x7f0000000680)=ANY=[@ANYBLOB="666c7573682c6e6f646f74732c646973636172642c646d61736b3d30303030303030303030303030303030303030303030322c646d61736b3d30303030303030303030303030303030303030303137372c646f74732c6e6f646f74732c71756965742c646f74732c0023c3cb4d2e3cbf18508098fe0de2af38db67d42d1bc4ab714d52f019082433fc9ca2d7174b2c4ece31c9f4c7a4d53914e100"/167], 0x1, 0x159, &(0x7f0000000740)="$eJzs27+q03AUB/DTf1p16SwOARenoj6BIhXEgKJ00EmhurRSsEt06qP4Or6BLyFIp+LyE4209/a2wx3ShNvPZ+mBLw3nDMnhF8i7O5+mk/ni4/zlKvqtVnQfRRbrVgyiHZ0oLQMAuErWKcWvlFK6vowb3yKlVHdHAEDV7H8AOD32PwCcngv7v113RwBA1V6/efv8cZ6PXmVZP+LnshgX4/K3zJ8+y0f3s38G23+timLc2eQPyjw7n/fi5v/84d78Wty7W+Z/sycv8p38VkyqHx8AAABOwjDb2Hu+Hw4P5WV15v3Azvm9G7e7RxsDALiExZev0/ez2YfPzSl+p0a0oWhy8eN7RAPaaETRiyquXPeTCaja9qavuxMAAAAAAAAAAAAAAOCQY3yfVPeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOtPAAAA///Eo1Fo") unlinkat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x200) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x100008b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x6, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000effd0010000000004000700070100000807f30075"], &(0x7f0000000b00)='GPL\x00', 0x3, 0x109, &(0x7f0000000b40)=""/265, 0x41000}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./proc\x00', 0x1ff) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee", 0x1d}], 0x1}, 0x0) executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000840)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r0, 0x5, 0xb, 0x0, &(0x7f0000000900)="259a53f271a76d2688634c", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) executing program 3: r0 = openat$sndseq(0xffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r3 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r3, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r3, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r4, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) executing program 1: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) bind$can_j1939(r0, &(0x7f0000000680)={0x1d, r1}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f00000006c0)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000001700)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000001740)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000001780)={&(0x7f00000017c0), 0x18, &(0x7f0000001800)={&(0x7f0000001840)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r2, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) program crashed: INFO: task hung in do_get_write_access bisect: bisecting 37 programs bisect: split chunks (needed=false): <37> bisect: split chunk #0 of len 37 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 24, 14, 6, 26, 28, 20, 24, 16, 21, 9, 27, 8, 6, 4, 24, 6, 9, 23, 14, 3, 21, 12, 27] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 5: socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0xf7) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') sendfile(r3, r3, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) pread64(r4, &(0x7f00000002c0)=""/267, 0x10b, 0x304) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee", 0x1d}], 0x1}, 0x0) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 5: fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000600)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000019640)='./sys\x00', 0x1ff) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) request_key(0x0, &(0x7f00000197c0)={'syz', 0x3}, 0x0, 0xfffffffffffffffe) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019840)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000019880)={0x2020}, 0x2020) mount(0x0, &(0x7f000001b8c0)='./sys\x00', 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r5, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574"], 0x60}}, 0x0) executing program 0: io_uring_setup(0x4fa, &(0x7f0000000680)={0x0, 0x7fdd, 0x200, 0x1, 0x17c}) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000019700)={0x40000000, 0x0, &(0x7f0000019740)={&(0x7f0000019780)=ANY=[@ANYBLOB="020700"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000197c0)={0x2, 0x0, @local}, 0x16) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='smaps_rollup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f00009ca000/0x3000)=nil, 0x3000, 0x2, &(0x7f0000000200)=0x4, 0x8, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r6, &(0x7f0000019940)={0x2020}, 0x2020) connect$inet(r4, &(0x7f0000019800)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r4, 0x0, 0x0, 0x1c) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000500)={0x1f, 0xffff, 0x3}, 0x6) write(r7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./trace\x00', 0x1ff) executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r2 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r2, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r2, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r3, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r1, &(0x7f00000002c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$get_persistent(0x16, 0x0, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x180080e, &(0x7f0000000400)={[{@utf8}, {@allow_utime={'allow_utime', 0x3d, 0xb1}}, {}, {@errors_continue}, {@namecase}, {@zero_size_dir}, {@fmask={'fmask', 0x3d, 0x5}}, {@iocharset={'iocharset', 0x3d, 'iso8859-14'}}, {@discard}, {@namecase}]}, 0x1, 0x1543, &(0x7f0000000800)="$eJzs3AucjdX6OPDnWWu9Y0zSbpLLsNZ6Xja5LJIklyS5VJIkSXJLSJIcSUgMuSUNSUguQ3IZQnKZmDTu9/slIUnOJElIbsn6fybmOJ06v87vdyrnfzzfz2d/Zj177We9693P7Pey5vJ15yE1GtasWp+I4N+CF74kAkAsAAwAgGsAIACAsvFl4zP7s0tM/Pc2wn5fD6Vc7hmwy4nrf2Xj+l/ZuP5XNq7/lY3rf2Xj+l/ZuP5XNq4/Y1eyTdPyXcuPK/fxh63/X4x5/f8/GZ///4tklBzzxZqS13cBiPlXU7j+///DfyOX6/9fK/hXXsT1v7Jx/a9UsZd7Auw/AH/+rwTZ/mkP1//KxvVn7Er292vBsXD516P/7AdE/sifgfieF97lf/qajhfLcPn2nzHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY+xOc9pcoAMhqX+55McYYY4wxxhhj7Pfjs13uGTDGGGOMMcYYY+yPhyBAgoIAYiAbxEJ2iAMBEJPVfy3Ew3WQC66H3JAH8kI+SID8UAA0GLBAEEJBKARRKAxF4AYoCsWgOJQAByWhFNwIpeEmKAM3Q1m4BcrBrVAeKkBFqAS3QWW4HarAHVAV7oRqUB1qQE24C+6Ge6AW3Au14T6oA/dDXXgA6sGDUB8eggbwMDSER6ARPAqNoQk0hWbQ/P+U/wJ0hxehB/SEROgFveEl6AN9oR/0hwHwMgyEV2AQvApJMBiGwGswFF6HYfAGDIcRMBLehFHwFoyGMTAWxkEyjIcJ8DZMhHdgEkyGKTAVUmAaTId3YQbMhFnwHsyG92EOzIV5MB9S4QNYAAshDT6ERfARpMNiWAJLYRkshxWwElbBalgDa2EdrIcNsBE2wWbYAlthG2yHHfAx7IRPYBfshj3wKeyFz/6X+af+Ib8LAgIKFKhQYQzGYCzGYhzGYQ7MgTkxJ0YwgvEYj7kwF+bG3JgX82ICJmABLIAGDRISFsSCGMUoFsEiWBSLYnEsjg4dlsJSWBpvwjJYBstiWSyH5bA8VsAKWAkrYWWsjFWwClbFqlgNq2ENrIF34V3YC2thLayNtbEO1slansL6WB8bYANsiA2xETbCxtgYm2JTbI7NsQW2wJbYEltja2yDbbAttsV22A7bY3vsgB2wI3bETtgJO2Nn7IJdsWvGC9kAX8QXsSdWE72wN/bGPpiUrR/2x/74Mg7EV/AVfBWTcDAOwdfwNXwdh+FJHH5+BI7EkVhZvIWjcQySGIfJmIwTcAJOxIk4CSfjZJyKKTgNp+N0nIEzcSa+h7PxfXwf5+JcnI+pmIoLcCGmYRouwlOYjotxCS7FZbgcl+FKXIUrcQ2uxTW4HtfjRtyIm3EzbsWtuB2348eoAPAT3I27MQn34l7ch/twP+7HA3gAMzADD+JBPISH8DAexiN4BI/iMTyOx/AEnsCTeApP42k8i2fxHD6X8GWDj4utTgKRSQklYkSMiBWxIk7EiRwih8gpcoqIiIh4ES9yiVwit8gt8oq8IkEkiAKigDDCCBJh5pFCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGLKCduFeVFBdHKVRKVRGXR2lURd4iqoqqoJqqLGqKmqCnuFneLWqKWqC1qizqijqgrHhD1RC/shw+JzMo0FIOxkRiCjUUTIS8eoVqIYdhStBKtxRNiBA7HtqKFayeeFu3FaOwg/iLG4LOikxiHncXzoovoKrqJF0R30dL1ED3FJOwleoup2Ef0Ff1EfzEDq4v3cHb2GuJVkSQGiyHiNTEfXxfDxBtiuBghRoo3xSjxlhgtxoixYpxIFuPFBPG2mCjeEZPEZDFFTBUpYpqYLt4VM8RMMUu8J2aL98UcMVfME/NFqvhALBALRZr4UCwSH4l0sVgsEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQH4ud4hOxS+wWe8SnYq/4TOwTn4v94gtxQPxVZIgvxUHxlTgkvhaHxTfiiPhWHBXHxHHxnTghvhcnxSlxWpwRZ8UP4pz4UZwXXoBEKaSUSgYyRmaTsTK7jJNXyRwyyDr+y3h5ncwlr5e5ZR6ZV+aTCTK/LCC1NNJKkqEsKAvJqCwsi8gbZFFZTBaXJaSTJWUpeaMsLW+SZeTNsqy8RZaTt8rysoKsKCvJ22RlebuEyIVtVJPVZQ1ZU94lE+EeWUveK2vL+2Qdeb+sKx+Q9eSDsr58SDaQD8uG8hHZSD4qG8smsqlsJpvLx2QL+bhsKVvJ1vIJ2UY+KdvKp2Q7+bRsL/3Fb5FnZSf5nOwsn5ddZFfZTf4oz0sve8ieEnqB7C1fkn1kX9lP9pcD5MtyoHxFDpKvyiQ5WA6Rr8mh8nU5TL4hh8sRcqR8U46Sb8nRcowcK8fJZDleTpBvy4nyHTlJTpZT5FSZIqfJfhdHmiXlb+a//Sv5g37a+ka5SW6WW+RWuU1ulzvkx3Kn3Cl3yV1yj9wj98q9cp/cJ/fL/fKAPCAzZIY8KA/KQ/KQPCwPyyPyiDwqj8kz8jt5Qn4vT8pT8pQ8I8/Ks/LcxfcAFCqhpFIqUDEqm4pV2VWcukrlUFernOoaFVHXqnh1ncqlrle5VR6VV+VTCSq/KqC0Msoq8tdceItVYbz4DaOKqxLKqZKqlLrxt/NVqAqqQiqqCqsi6gZVVBX7WX7W/BL/yfyaq+aqhWqhWqqWqrVqrdqoNqqtaqvaqXaqvWqvOqgOqqPqqDqpTqqz6qy6qC6qm+qmuqvuqofqoRJVouqtXlJ9VF/VT/VXA9TLInMfBqlBKkklqSFqiBqqhqphapgaroarkWqkGqVGqdFqtBqrxqpklawmqAlKqolqkpqkpqgpKkWlqOlqupqhZqhZapaarWarOWqOmqfmqVSVqhaoBSpNpalFapFKV4vVYrVULVXL1XK1Uq1Uq9VqtVatVevVepWuNqlNaovaorapbWqH2qF2qp1ql9ql9qg9aq/aq/apfWq/2q8OqAMqQ2Wog+qgOqQOqcPqsDqijqij6qg6ro6rE+qEOqlOqtPqtDqrzqpz6pw6r85nXvYFIhCBClQQE8QEsUFsEBfEBTmCHEHOIGcQCSJBfBAf5AquD3IHeYK8Qb4gIcgfFAh0YAIbiItFjwaFgyLBDUHRoFhQPCgRuKBkUCq4MSgd3BSUCW4Oyga3BOWCW4PyQYWgYlApuC2oHNweVAnuCKoGdwbVgupBjaBmcFdwd3BPUCu4N6gd3BfUCe4P6gYPBPWCB4P6wUNBg+DhoGHwSNAoeDRoHDQJmgbNgua/6/jen8zzuOuhe+pE3Uv31i/pPrqv7qf76wH6ZT1Qv6IH6Vd1kh6sh+jX9FD9uh6m39DD9Qg9Ur+pR+m39Gg9Ro/V43SyHq8n6Lf1RP2OnqQn6yl6qk7R0/R0/a6eoWfqWfo9PVu/r+fouXqenq9T9Qd6gV6o0/SHepH+SKfrxXqJXqqX6eV6hV6pV+nVeo1eq9fp9XqD3qg36c16i96qt+nteof+WO/Un+hderfeoz/Ve/Vnep/+XO/XX+gD+q86Q3+pD+qv9CH9tT6sv9FH9Lf6qD6my+jv9An9vT6pT+nT+ow+q3/Q5/SP+rz2mRf3mad3o4wyMSbGxJpYE2fiTA6Tw+Q0OU3EREy8iTe5TC6T2+Q2eU1ek2ASTAFTwGQiQ6agKWiiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5jZzm7nd3G7uMHeYO82dprqpbrLORLVMLVPb1DZ1TB1T19Q19Uw9U9/UNw1MA9PQNDSNTCPT2DQ2TU1T09w0Ny1MC9PStDStTWvTxrQxbU1b0860M+1Ne9PBdDAdTUfTyXQynU1n08V0Md1MN9PddDc9TA+TaBJNb9Pb9DF9TD/TzwwwA8xAM9AMMoNMkkkyQ8wQM9QMNcPMMDPcjDAjMy9UzVtmtBljxppxJtkkmwlmgploJppJZpKZYqaYFJNippvpZoaZYWaZWWa2mW3mmDlmnplnUk2qWWAWmDSTZhaZRSbdpJslZolZZpaZFWaFWWVWmTVmjVkH68wGs8FsMpvMFrPFbDPbzA6zw+w0O80us8vsMXvMXrPX7DP7zH6z3xwwB0yGyTAHzUFzyBwyh81hc8QcMUfNUXPcHDcnzAlz0pw0p81pc9bkuXi+9CbWZrdx9iqbw15tc9pr7D/GeW0+m2Dz2wJW29w2z89iY60taovZ4raEdbakLWVv/EVc3lawFW0le5utbG+3VX4R323vsbXsvba2vc/WtHf9LK5j77d17SO2HiKAbWIb2Ga2oX3ENrKP2sa2iW1qm9k29knb1j5l29mnbXv7zC/iBXahXWVX2zV2rd1ld9vT9ow9ZL+2Z+0PtoftaQfYl+1A+4odZF+1SXbwL+KR9k07yr5lR9sxdqwd94t4ip1qU+w0O92+a2fYmb+IU+0HdrZNs3PsXDvPzv8pzpxTmv3QLrIf2XQbwBK71C6zy+0Ku/Jvc11q19sNdqPdaT+xW+xWu81utzuyLoTtbrvHfmr32s/sQfuV3W+/sAfsYZthv/wpzty/w/Ybe8R+a4/aY/a4/c6esN+rrOzMff/O/mjPW2+BkIAkKQoohrJRLGWnOLqKctDVlJOuoQhdS/F0HeWi6yk35aG8lI8SKD8VIE2GLBGFVJAKUZQKU9ZKQnEqQY5KUim6kUrTTVSGbqaydAuVo1upPFWgilSJbqPKdDtVoTuoKt1J1ag61aCadBfdTfdQLbqXatN9VIfup7r0ANWjB6k+PUQN6GFqSI9QI3qUGlMTakrNqDk9Ri3ocWpJrag1PUFt6ElqS09RO3qa2tMz1IH+Qh3pWepEz1Fnep66UFfqRi9Qd3qRelBPSqRe1Jteoj7Ul/pRfxpAL9NAeoUG0auURINpCL1GQ+l1GkZv0HAaQSPpTRpFb9FoGkNjaRwl03iaQG/TRHqHJtFkmkJTKYWm0XR6l2bQTJpF79Fsep/m0FyaR/MplT6gBbSQ0uhDWkQfUTotpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF22kEf0076hHbRbtpDn9Je+oz20ee0n76gA/RXyqAv6SB9RYfoazpM3/ie9C0dpWN0nL6jE/Q9naRTdJrO0Fn6gc7Rj3SePEGIoQhlqMIgjAmzhbFh9jAuvCrMEV4d5gyvCSPhtWF8eF2YK7w+zB3mCfOG+cKEMH9YINShCW1IYRgWDAuF0bBwWCS8ISwaFguLhyVCF5YMS4U3hqXDm8Iy4c1h2fCWsFx4a1g+rBA+cl+l8Lawcnh7WCW8I6wa3hlWC6uHNcKa4V3h3eE9Ya3w3rB2eF9YJrw/rBs+ENYLHwzrhw+FDcKHw4bhI2Gj8NGwcdgkbBo2C5uHj4UtwsfDlmGrsHV4VdgmfDJsGz4VtgufDtuHz/zUf//CrP4nftGfGPYKe4cvhS+F3t8r50XnR1OjH0QXRBdG06IfRhdFP4qmRxdHl0SXRpdFl0dXRFdGV0VXR9dE10bXRddHN0Q3Rr2vmQ0cOuGkUy5wMS6bi3XZXZy7yuVwV7uc7hoXcde6eHedy+Wud7ldHpfX5XMJLr8r4LQzzjpyoSvoCrmoK+yKuBtcUVfMFXclnHMlXSnXzDV3zV0L97hr6Vq51u4J94R70j3pnnJPuadde/eM6+D+4jq6Z10n95x7zj3vuriurpt7wXV343Ne+Ewmut6ut+vj+rh+rp8b4Aa4gW6gG+QGuSSX5Ia4IW6oG+qGuWFuuBvuRrqRbpQb5Ua70W6sG+uSXbKb4Ca4iW6im+QmuSluiktxKW66m+5muBmu8swLW5nj5rh5bp5Ldalugcu8Zkxzi9wil+7S3RK3xC1zy9wKt8KtcqvcGrfGrXPr3Aa3wW1ym9wWt8Vtc9vcDrfD7XQ73a6sOw631+1z+9x+t98dcH91Ge5Ld9B95Q65r91h94074r51R90xd9x95064791Jd8qddmfcWfeDO+d+dOedd8mR8ZEJkbcjEyPvRCZFJkemRKZGUiLTItMj70ZmRGZGZkXei8yOvB+ZE5kbmReZH0mNfBBZEFkYSYt8GFkU+SiSHlkcWRJZGlkWWR7xPv+W0Bf0hXzUF/ZF/A2+qC/mi/sS3vmSvpS/0Ze+MO9072/x5fytvryv4Cv6R31j38Q39c18c/+Yb+Ef9y19K9/aP+Hb+Cd9W/+Ub+ef9u39M76D/4vv6J/1nfxzvrN/3nfxXX03/4Lv7l/0PXxPn+h7+d7+Jd/H9/X9fH8/wL/sB/pX/CD/qk/yg/0Q/5of6l/3w/wbfrgf4UfGvOlHZd0iwzif7Mf7Cf5tP9G/4yf5yX6Kn+pT/DQ/3b/rZ/iZfpZ/z8/27/s5fq6f5+f7VP+BX+AX+jT/oV/kP/LpfnHWod6v8Cv9Kr/ar/Fr/Tq/3m/wG/0mv9lv8Vv9Nr/d7/Af+53+E7/L7/Z7/Kd+r//M7/Of+/3ns/4C7Ut/0H/lD/mv/WH/jT/iv/VH/TF/3H/nT/jv/Ul/yp/2Z/xZ/4M/53/05/lv1hhjjDHG/iXjLzXFz3suLOf3+pUc8Xcv7g0AV2/Nl/H3/ZlXlOtyX2j3FQmxmV+f7tn5oaxHtWqJiYkXX5suISg0FyDrJ0GZfvrVg4vxYmgNT0I7aAWlf3X+fUXXs/Qb40dvAYj7u5zMCWXFl8b/HAATf2X8x54YuaBceDr+fxh/LkDRQpdyssOleDG0/ml9pRWU+Sfzz9PiN+af/YtkgJZ/G/mClr+Yfyl4HJ6Bdn/rYYwxxhhjjDHGLukrKnbMuv/M+j2bX7s/T1CXcrLBpfi37s8ZY4wxxhhjjDF2+T3btdtTj7Vr16rj/75R5f+U9S83GsEfNTI3frXhPUDWMwoAOj5bc+KlZ/6n9Lhf6wLIbMg/cy82/ynbSrr40fnHrmVnfAD/GaX8PRqX+cDEGGOMMcYY+91duuj/+fPqck2IMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi7Av0Z/07scu8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrn9vwAAAP//RgL1kg==") r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f80)={&(0x7f0000001fc0)=@newtaction={0x80, 0x30, 0xffff, 0x0, 0x25dfdbff, {}, [{0x6c, 0x1, [@m_ife={0x68, 0x1, 0x0, 0x0, {{0x8}, {0x40, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @local}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x4, 0x5, 0x1}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x45b9}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000002040), 0x0, 0x0) ioctl$OCFS2_IOC_UNRESVSP64(r6, 0x4030582b, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r9, @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r8], 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$NL80211_CMD_SET_BSS(r7, &(0x7f0000001f00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10040}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e80)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x5}]}, 0x1c}}, 0x800) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000740)={0x0, 0x6000, &(0x7f0000000780)=[{&(0x7f00000007c0)='U', 0xa00120}], 0x1}, 0x3) executing program 5: socket(0x10, 0x803, 0x0) syz_read_part_table(0x1051, &(0x7f00000005c0)="$eJzsz7utAjEUBNB5eou1KwIktD2QkBJTBCKnEkQLtEFEgwhkzKcDtME5gcfXGgc3TMK5xeqaTY7j8vP+/8rbdyrbrl773JPMM2uFLkONv/ecvh67MTk8f5Z1ktOQLLqU1ijZX36zHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM2yMAAP//2qsHZg==") open(0x0, 0x121342, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001640)={0x1, &(0x7f0000001680)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0x6) sync() sync() sync() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setfsuid(0x0) openat(0xffffffffffffff9c, &(0x7f00000016c0)='./file1\x00', 0x101042, 0x65) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00007c2000/0x4000)=nil, &(0x7f00009dc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000726000/0x13000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000180)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019240)={0x1, &(0x7f0000019280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000019300)) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/uts\x00') syz_ublk_setup_io_uring(0x20, &(0x7f0000019340)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r5, &(0x7f0000019480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000019500)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000019540)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000019580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ddc, 0x80, 0x2, 0x33d, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x20, 0x0, 0x142}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0x9, 0x135}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x800, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, 0x0, 0xfdef) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f00000002c0)=ANY=[@ANYRESHEX], 0x10) write$9p(r0, &(0x7f0000000300)="d5", 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000440)='GPL\x00', 0x8, 0x0, 0x0, 0x100, 0xf8, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x0, 0x0, 0x0, 0x1}}, 0x40) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000001000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./proc_mnt/kcore\x00', 0x0, 0x0) readv(r0, &(0x7f0000002240)=[{0x0}], 0x1) executing program 0: socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0xf7) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') sendfile(r3, r3, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) pread64(r4, &(0x7f00000002c0)=""/267, 0x10b, 0x304) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000600)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000640)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000680), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000006c0)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000700)=@ccm_128={{0x303}, "0e57b3d487e2db32", "a9df7ccffde8899f914d4f2c3e263509", "3c36a51c", "6775c975b6b15e11"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000740)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28) writev(r0, &(0x7f00000007c0)=[{&(0x7f0000000800)="bdc99118158ffb3222a77dce29e913c7fa56753b708da3c283982b260ce5abd73c63ebd0b452b90f91943532f9d9b862c0ea33a403e4296db241fea24984873479c48ab65e8a04715da0a09b9100da082e1ef81b1b2e9c09b2cdf5c8b51d073cb8d0b31622fbdfa82a7f4098302d956b7b9603b9119bd83b0ae863bf29bfb5ff0fdec352e751f2002915b9a97ccb11880df592aa6e77c60a33", 0x99}], 0x1) readv(r0, &(0x7f00000008c0)=[{&(0x7f0000000900)=""/153, 0x99}, {&(0x7f00000010c0)=""/4115, 0x1013}], 0x2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000004, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x2, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0xf7ff, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000004c0)='pipefs\x00', 0x1) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) set_mempolicy(0x3, &(0x7f0000000240)=0x7, 0x0) prlimit64(r0, 0x4, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000600), &(0x7f0000000640)='./bus\x00', 0x8100c4, &(0x7f0000000680)=ANY=[@ANYBLOB="666c7573682c6e6f646f74732c646973636172642c646d61736b3d30303030303030303030303030303030303030303030322c646d61736b3d30303030303030303030303030303030303030303137372c646f74732c6e6f646f74732c71756965742c646f74732c0023c3cb4d2e3cbf18508098fe0de2af38db67d42d1bc4ab714d52f019082433fc9ca2d7174b2c4ece31c9f4c7a4d53914e100"/167], 0x1, 0x159, &(0x7f0000000740)="$eJzs27+q03AUB/DTf1p16SwOARenoj6BIhXEgKJ00EmhurRSsEt06qP4Or6BLyFIp+LyE4209/a2wx3ShNvPZ+mBLw3nDMnhF8i7O5+mk/ni4/zlKvqtVnQfRRbrVgyiHZ0oLQMAuErWKcWvlFK6vowb3yKlVHdHAEDV7H8AOD32PwCcngv7v113RwBA1V6/efv8cZ6PXmVZP+LnshgX4/K3zJ8+y0f3s38G23+timLc2eQPyjw7n/fi5v/84d78Wty7W+Z/sycv8p38VkyqHx8AAABOwjDb2Hu+Hw4P5WV15v3Azvm9G7e7RxsDALiExZev0/ez2YfPzSl+p0a0oWhy8eN7RAPaaETRiyquXPeTCaja9qavuxMAAAAAAAAAAAAAAOCQY3yfVPeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOtPAAAA///Eo1Fo") unlinkat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x200) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x100008b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x6, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000effd0010000000004000700070100000807f30075"], &(0x7f0000000b00)='GPL\x00', 0x3, 0x109, &(0x7f0000000b40)=""/265, 0x41000}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./proc\x00', 0x1ff) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee", 0x1d}], 0x1}, 0x0) executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000840)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r0, 0x5, 0xb, 0x0, &(0x7f0000000900)="259a53f271a76d2688634c", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) executing program 3: r0 = openat$sndseq(0xffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r3 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r3, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r3, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r4, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) executing program 1: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) bind$can_j1939(r0, &(0x7f0000000680)={0x1d, r1}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f00000006c0)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000001700)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000001740)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000001780)={&(0x7f00000017c0), 0x18, &(0x7f0000001800)={&(0x7f0000001840)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r2, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) program crashed: INFO: task hung in mpage_prepare_extent_to_map bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 4, 24, 6, 9, 23, 14, 3, 21, 12, 27] detailed listing: executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f00000002c0)=ANY=[@ANYRESHEX], 0x10) write$9p(r0, &(0x7f0000000300)="d5", 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000440)='GPL\x00', 0x8, 0x0, 0x0, 0x100, 0xf8, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x0, 0x0, 0x0, 0x1}}, 0x40) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000001000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./proc_mnt/kcore\x00', 0x0, 0x0) readv(r0, &(0x7f0000002240)=[{0x0}], 0x1) executing program 0: socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0xf7) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') sendfile(r3, r3, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) pread64(r4, &(0x7f00000002c0)=""/267, 0x10b, 0x304) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000600)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000640)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000680), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000006c0)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000700)=@ccm_128={{0x303}, "0e57b3d487e2db32", "a9df7ccffde8899f914d4f2c3e263509", "3c36a51c", "6775c975b6b15e11"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000740)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28) writev(r0, &(0x7f00000007c0)=[{&(0x7f0000000800)="bdc99118158ffb3222a77dce29e913c7fa56753b708da3c283982b260ce5abd73c63ebd0b452b90f91943532f9d9b862c0ea33a403e4296db241fea24984873479c48ab65e8a04715da0a09b9100da082e1ef81b1b2e9c09b2cdf5c8b51d073cb8d0b31622fbdfa82a7f4098302d956b7b9603b9119bd83b0ae863bf29bfb5ff0fdec352e751f2002915b9a97ccb11880df592aa6e77c60a33", 0x99}], 0x1) readv(r0, &(0x7f00000008c0)=[{&(0x7f0000000900)=""/153, 0x99}, {&(0x7f00000010c0)=""/4115, 0x1013}], 0x2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000004, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x2, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0xf7ff, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000004c0)='pipefs\x00', 0x1) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) set_mempolicy(0x3, &(0x7f0000000240)=0x7, 0x0) prlimit64(r0, 0x4, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000600), &(0x7f0000000640)='./bus\x00', 0x8100c4, &(0x7f0000000680)=ANY=[@ANYBLOB="666c7573682c6e6f646f74732c646973636172642c646d61736b3d30303030303030303030303030303030303030303030322c646d61736b3d30303030303030303030303030303030303030303137372c646f74732c6e6f646f74732c71756965742c646f74732c0023c3cb4d2e3cbf18508098fe0de2af38db67d42d1bc4ab714d52f019082433fc9ca2d7174b2c4ece31c9f4c7a4d53914e100"/167], 0x1, 0x159, &(0x7f0000000740)="$eJzs27+q03AUB/DTf1p16SwOARenoj6BIhXEgKJ00EmhurRSsEt06qP4Or6BLyFIp+LyE4209/a2wx3ShNvPZ+mBLw3nDMnhF8i7O5+mk/ni4/zlKvqtVnQfRRbrVgyiHZ0oLQMAuErWKcWvlFK6vowb3yKlVHdHAEDV7H8AOD32PwCcngv7v113RwBA1V6/efv8cZ6PXmVZP+LnshgX4/K3zJ8+y0f3s38G23+timLc2eQPyjw7n/fi5v/84d78Wty7W+Z/sycv8p38VkyqHx8AAABOwjDb2Hu+Hw4P5WV15v3Azvm9G7e7RxsDALiExZev0/ez2YfPzSl+p0a0oWhy8eN7RAPaaETRiyquXPeTCaja9qavuxMAAAAAAAAAAAAAAOCQY3yfVPeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOtPAAAA///Eo1Fo") unlinkat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x200) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x100008b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x6, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000effd0010000000004000700070100000807f30075"], &(0x7f0000000b00)='GPL\x00', 0x3, 0x109, &(0x7f0000000b40)=""/265, 0x41000}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./proc\x00', 0x1ff) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee", 0x1d}], 0x1}, 0x0) executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000840)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r0, 0x5, 0xb, 0x0, &(0x7f0000000900)="259a53f271a76d2688634c", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) executing program 3: r0 = openat$sndseq(0xffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r3 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r3, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r3, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r4, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) executing program 1: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) bind$can_j1939(r0, &(0x7f0000000680)={0x1d, r1}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f00000006c0)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000001700)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000001740)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000001780)={&(0x7f00000017c0), 0x18, &(0x7f0000001800)={&(0x7f0000001840)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r2, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 24, 14, 6, 26, 28, 20, 24, 16, 21, 9, 27, 8] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 5: socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0xf7) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') sendfile(r3, r3, 0x0, 0x15) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000047c0), 0x0}, 0x20) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) pread64(r4, &(0x7f00000002c0)=""/267, 0x10b, 0x304) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xa, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001640)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee", 0x1d}], 0x1}, 0x0) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 5: fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000600)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000019640)='./sys\x00', 0x1ff) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) request_key(0x0, &(0x7f00000197c0)={'syz', 0x3}, 0x0, 0xfffffffffffffffe) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019840)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000019880)={0x2020}, 0x2020) mount(0x0, &(0x7f000001b8c0)='./sys\x00', 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r5, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574"], 0x60}}, 0x0) executing program 0: io_uring_setup(0x4fa, &(0x7f0000000680)={0x0, 0x7fdd, 0x200, 0x1, 0x17c}) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000019700)={0x40000000, 0x0, &(0x7f0000019740)={&(0x7f0000019780)=ANY=[@ANYBLOB="020700"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000197c0)={0x2, 0x0, @local}, 0x16) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='smaps_rollup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f00009ca000/0x3000)=nil, 0x3000, 0x2, &(0x7f0000000200)=0x4, 0x8, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r6, &(0x7f0000019940)={0x2020}, 0x2020) connect$inet(r4, &(0x7f0000019800)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r4, 0x0, 0x0, 0x1c) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000500)={0x1f, 0xffff, 0x3}, 0x6) write(r7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./trace\x00', 0x1ff) executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x143102) writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000300)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x200001, 0x6c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x34ff, 0x0, 0x0, 0xb7}}, 0xe8) syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r2 = syz_io_uring_setup(0x3b, &(0x7f0000000700)={0x0, 0x0, 0x10000, 0x2}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) io_uring_register$IORING_REGISTER_NAPI(r2, 0x1b, &(0x7f0000000840)={0xffffff01}, 0x1) io_uring_enter(r2, 0x1103, 0x38cc, 0x28, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000880)='fdinfo/3\x00') read$eventfd(r3, &(0x7f00000008c0), 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f00000000c0)={{0x0, 0x1}, {0xf, 0x20}, 0x4, 0x7, 0x4}) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r1, &(0x7f00000002c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$get_persistent(0x16, 0x0, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x180080e, &(0x7f0000000400)={[{@utf8}, {@allow_utime={'allow_utime', 0x3d, 0xb1}}, {}, {@errors_continue}, {@namecase}, {@zero_size_dir}, {@fmask={'fmask', 0x3d, 0x5}}, {@iocharset={'iocharset', 0x3d, 'iso8859-14'}}, {@discard}, {@namecase}]}, 0x1, 0x1543, &(0x7f0000000800)="$eJzs3AucjdX6OPDnWWu9Y0zSbpLLsNZ6Xja5LJIklyS5VJIkSXJLSJIcSUgMuSUNSUguQ3IZQnKZmDTu9/slIUnOJElIbsn6fybmOJ06v87vdyrnfzzfz2d/Zj177We9693P7Pey5vJ15yE1GtasWp+I4N+CF74kAkAsAAwAgGsAIACAsvFl4zP7s0tM/Pc2wn5fD6Vc7hmwy4nrf2Xj+l/ZuP5XNq7/lY3rf2Xj+l/ZuP5XNq4/Y1eyTdPyXcuPK/fxh63/X4x5/f8/GZ///4tklBzzxZqS13cBiPlXU7j+///DfyOX6/9fK/hXXsT1v7Jx/a9UsZd7Auw/AH/+rwTZ/mkP1//KxvVn7Er292vBsXD516P/7AdE/sifgfieF97lf/qajhfLcPn2nzHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY+xOc9pcoAMhqX+55McYYY4wxxhhj7Pfjs13uGTDGGGOMMcYYY+yPhyBAgoIAYiAbxEJ2iAMBEJPVfy3Ew3WQC66H3JAH8kI+SID8UAA0GLBAEEJBKARRKAxF4AYoCsWgOJQAByWhFNwIpeEmKAM3Q1m4BcrBrVAeKkBFqAS3QWW4HarAHVAV7oRqUB1qQE24C+6Ge6AW3Au14T6oA/dDXXgA6sGDUB8eggbwMDSER6ARPAqNoQk0hWbQ/P+U/wJ0hxehB/SEROgFveEl6AN9oR/0hwHwMgyEV2AQvApJMBiGwGswFF6HYfAGDIcRMBLehFHwFoyGMTAWxkEyjIcJ8DZMhHdgEkyGKTAVUmAaTId3YQbMhFnwHsyG92EOzIV5MB9S4QNYAAshDT6ERfARpMNiWAJLYRkshxWwElbBalgDa2EdrIcNsBE2wWbYAlthG2yHHfAx7IRPYBfshj3wKeyFz/6X+af+Ib8LAgIKFKhQYQzGYCzGYhzGYQ7MgTkxJ0YwgvEYj7kwF+bG3JgX82ICJmABLIAGDRISFsSCGMUoFsEiWBSLYnEsjg4dlsJSWBpvwjJYBstiWSyH5bA8VsAKWAkrYWWsjFWwClbFqlgNq2ENrIF34V3YC2thLayNtbEO1slansL6WB8bYANsiA2xETbCxtgYm2JTbI7NsQW2wJbYEltja2yDbbAttsV22A7bY3vsgB2wI3bETtgJO2Nn7IJdsWvGC9kAX8QXsSdWE72wN/bGPpiUrR/2x/74Mg7EV/AVfBWTcDAOwdfwNXwdh+FJHH5+BI7EkVhZvIWjcQySGIfJmIwTcAJOxIk4CSfjZJyKKTgNp+N0nIEzcSa+h7PxfXwf5+JcnI+pmIoLcCGmYRouwlOYjotxCS7FZbgcl+FKXIUrcQ2uxTW4HtfjRtyIm3EzbsWtuB2348eoAPAT3I27MQn34l7ch/twP+7HA3gAMzADD+JBPISH8DAexiN4BI/iMTyOx/AEnsCTeApP42k8i2fxHD6X8GWDj4utTgKRSQklYkSMiBWxIk7EiRwih8gpcoqIiIh4ES9yiVwit8gt8oq8IkEkiAKigDDCCBJh5pFCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGLKCduFeVFBdHKVRKVRGXR2lURd4iqoqqoJqqLGqKmqCnuFneLWqKWqC1qizqijqgrHhD1RC/shw+JzMo0FIOxkRiCjUUTIS8eoVqIYdhStBKtxRNiBA7HtqKFayeeFu3FaOwg/iLG4LOikxiHncXzoovoKrqJF0R30dL1ED3FJOwleoup2Ef0Ff1EfzEDq4v3cHb2GuJVkSQGiyHiNTEfXxfDxBtiuBghRoo3xSjxlhgtxoixYpxIFuPFBPG2mCjeEZPEZDFFTBUpYpqYLt4VM8RMMUu8J2aL98UcMVfME/NFqvhALBALRZr4UCwSH4l0sVgsEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQH4ud4hOxS+wWe8SnYq/4TOwTn4v94gtxQPxVZIgvxUHxlTgkvhaHxTfiiPhWHBXHxHHxnTghvhcnxSlxWpwRZ8UP4pz4UZwXXoBEKaSUSgYyRmaTsTK7jJNXyRwyyDr+y3h5ncwlr5e5ZR6ZV+aTCTK/LCC1NNJKkqEsKAvJqCwsi8gbZFFZTBaXJaSTJWUpeaMsLW+SZeTNsqy8RZaTt8rysoKsKCvJ22RlebuEyIVtVJPVZQ1ZU94lE+EeWUveK2vL+2Qdeb+sKx+Q9eSDsr58SDaQD8uG8hHZSD4qG8smsqlsJpvLx2QL+bhsKVvJ1vIJ2UY+KdvKp2Q7+bRsL/3Fb5FnZSf5nOwsn5ddZFfZTf4oz0sve8ieEnqB7C1fkn1kX9lP9pcD5MtyoHxFDpKvyiQ5WA6Rr8mh8nU5TL4hh8sRcqR8U46Sb8nRcowcK8fJZDleTpBvy4nyHTlJTpZT5FSZIqfJfhdHmiXlb+a//Sv5g37a+ka5SW6WW+RWuU1ulzvkx3Kn3Cl3yV1yj9wj98q9cp/cJ/fL/fKAPCAzZIY8KA/KQ/KQPCwPyyPyiDwqj8kz8jt5Qn4vT8pT8pQ8I8/Ks/LcxfcAFCqhpFIqUDEqm4pV2VWcukrlUFernOoaFVHXqnh1ncqlrle5VR6VV+VTCSq/KqC0Msoq8tdceItVYbz4DaOKqxLKqZKqlLrxt/NVqAqqQiqqCqsi6gZVVBX7WX7W/BL/yfyaq+aqhWqhWqqWqrVqrdqoNqqtaqvaqXaqvWqvOqgOqqPqqDqpTqqz6qy6qC6qm+qmuqvuqofqoRJVouqtXlJ9VF/VT/VXA9TLInMfBqlBKkklqSFqiBqqhqphapgaroarkWqkGqVGqdFqtBqrxqpklawmqAlKqolqkpqkpqgpKkWlqOlqupqhZqhZapaarWarOWqOmqfmqVSVqhaoBSpNpalFapFKV4vVYrVULVXL1XK1Uq1Uq9VqtVatVevVepWuNqlNaovaorapbWqH2qF2qp1ql9ql9qg9aq/aq/apfWq/2q8OqAMqQ2Wog+qgOqQOqcPqsDqijqij6qg6ro6rE+qEOqlOqtPqtDqrzqpz6pw6r85nXvYFIhCBClQQE8QEsUFsEBfEBTmCHEHOIGcQCSJBfBAf5AquD3IHeYK8Qb4gIcgfFAh0YAIbiItFjwaFgyLBDUHRoFhQPCgRuKBkUCq4MSgd3BSUCW4Oyga3BOWCW4PyQYWgYlApuC2oHNweVAnuCKoGdwbVgupBjaBmcFdwd3BPUCu4N6gd3BfUCe4P6gYPBPWCB4P6wUNBg+DhoGHwSNAoeDRoHDQJmgbNgua/6/jen8zzuOuhe+pE3Uv31i/pPrqv7qf76wH6ZT1Qv6IH6Vd1kh6sh+jX9FD9uh6m39DD9Qg9Ur+pR+m39Gg9Ro/V43SyHq8n6Lf1RP2OnqQn6yl6qk7R0/R0/a6eoWfqWfo9PVu/r+fouXqenq9T9Qd6gV6o0/SHepH+SKfrxXqJXqqX6eV6hV6pV+nVeo1eq9fp9XqD3qg36c16i96qt+nteof+WO/Un+hderfeoz/Ve/Vnep/+XO/XX+gD+q86Q3+pD+qv9CH9tT6sv9FH9Lf6qD6my+jv9An9vT6pT+nT+ow+q3/Q5/SP+rz2mRf3mad3o4wyMSbGxJpYE2fiTA6Tw+Q0OU3EREy8iTe5TC6T2+Q2eU1ek2ASTAFTwGQiQ6agKWiiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5jZzm7nd3G7uMHeYO82dprqpbrLORLVMLVPb1DZ1TB1T19Q19Uw9U9/UNw1MA9PQNDSNTCPT2DQ2TU1T09w0Ny1MC9PStDStTWvTxrQxbU1b0860M+1Ne9PBdDAdTUfTyXQynU1n08V0Md1MN9PddDc9TA+TaBJNb9Pb9DF9TD/TzwwwA8xAM9AMMoNMkkkyQ8wQM9QMNcPMMDPcjDAjMy9UzVtmtBljxppxJtkkmwlmgploJppJZpKZYqaYFJNippvpZoaZYWaZWWa2mW3mmDlmnplnUk2qWWAWmDSTZhaZRSbdpJslZolZZpaZFWaFWWVWmTVmjVkH68wGs8FsMpvMFrPFbDPbzA6zw+w0O80us8vsMXvMXrPX7DP7zH6z3xwwB0yGyTAHzUFzyBwyh81hc8QcMUfNUXPcHDcnzAlz0pw0p81pc9bkuXi+9CbWZrdx9iqbw15tc9pr7D/GeW0+m2Dz2wJW29w2z89iY60taovZ4raEdbakLWVv/EVc3lawFW0le5utbG+3VX4R323vsbXsvba2vc/WtHf9LK5j77d17SO2HiKAbWIb2Ga2oX3ENrKP2sa2iW1qm9k29knb1j5l29mnbXv7zC/iBXahXWVX2zV2rd1ld9vT9ow9ZL+2Z+0PtoftaQfYl+1A+4odZF+1SXbwL+KR9k07yr5lR9sxdqwd94t4ip1qU+w0O92+a2fYmb+IU+0HdrZNs3PsXDvPzv8pzpxTmv3QLrIf2XQbwBK71C6zy+0Ku/Jvc11q19sNdqPdaT+xW+xWu81utzuyLoTtbrvHfmr32s/sQfuV3W+/sAfsYZthv/wpzty/w/Ybe8R+a4/aY/a4/c6esN+rrOzMff/O/mjPW2+BkIAkKQoohrJRLGWnOLqKctDVlJOuoQhdS/F0HeWi6yk35aG8lI8SKD8VIE2GLBGFVJAKUZQKU9ZKQnEqQY5KUim6kUrTTVSGbqaydAuVo1upPFWgilSJbqPKdDtVoTuoKt1J1ag61aCadBfdTfdQLbqXatN9VIfup7r0ANWjB6k+PUQN6GFqSI9QI3qUGlMTakrNqDk9Ri3ocWpJrag1PUFt6ElqS09RO3qa2tMz1IH+Qh3pWepEz1Fnep66UFfqRi9Qd3qRelBPSqRe1Jteoj7Ul/pRfxpAL9NAeoUG0auURINpCL1GQ+l1GkZv0HAaQSPpTRpFb9FoGkNjaRwl03iaQG/TRHqHJtFkmkJTKYWm0XR6l2bQTJpF79Fsep/m0FyaR/MplT6gBbSQ0uhDWkQfUTotpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF22kEf0076hHbRbtpDn9Je+oz20ee0n76gA/RXyqAv6SB9RYfoazpM3/ie9C0dpWN0nL6jE/Q9naRTdJrO0Fn6gc7Rj3SePEGIoQhlqMIgjAmzhbFh9jAuvCrMEV4d5gyvCSPhtWF8eF2YK7w+zB3mCfOG+cKEMH9YINShCW1IYRgWDAuF0bBwWCS8ISwaFguLhyVCF5YMS4U3hqXDm8Iy4c1h2fCWsFx4a1g+rBA+cl+l8Lawcnh7WCW8I6wa3hlWC6uHNcKa4V3h3eE9Ya3w3rB2eF9YJrw/rBs+ENYLHwzrhw+FDcKHw4bhI2Gj8NGwcdgkbBo2C5uHj4UtwsfDlmGrsHV4VdgmfDJsGz4VtgufDtuHz/zUf//CrP4nftGfGPYKe4cvhS+F3t8r50XnR1OjH0QXRBdG06IfRhdFP4qmRxdHl0SXRpdFl0dXRFdGV0VXR9dE10bXRddHN0Q3Rr2vmQ0cOuGkUy5wMS6bi3XZXZy7yuVwV7uc7hoXcde6eHedy+Wud7ldHpfX5XMJLr8r4LQzzjpyoSvoCrmoK+yKuBtcUVfMFXclnHMlXSnXzDV3zV0L97hr6Vq51u4J94R70j3pnnJPuadde/eM6+D+4jq6Z10n95x7zj3vuriurpt7wXV343Ne+Ewmut6ut+vj+rh+rp8b4Aa4gW6gG+QGuSSX5Ia4IW6oG+qGuWFuuBvuRrqRbpQb5Ua70W6sG+uSXbKb4Ca4iW6im+QmuSluiktxKW66m+5muBmu8swLW5nj5rh5bp5Ldalugcu8Zkxzi9wil+7S3RK3xC1zy9wKt8KtcqvcGrfGrXPr3Aa3wW1ym9wWt8Vtc9vcDrfD7XQ73a6sOw631+1z+9x+t98dcH91Ge5Ld9B95Q65r91h94074r51R90xd9x95064791Jd8qddmfcWfeDO+d+dOedd8mR8ZEJkbcjEyPvRCZFJkemRKZGUiLTItMj70ZmRGZGZkXei8yOvB+ZE5kbmReZH0mNfBBZEFkYSYt8GFkU+SiSHlkcWRJZGlkWWR7xPv+W0Bf0hXzUF/ZF/A2+qC/mi/sS3vmSvpS/0Ze+MO9072/x5fytvryv4Cv6R31j38Q39c18c/+Yb+Ef9y19K9/aP+Hb+Cd9W/+Ub+ef9u39M76D/4vv6J/1nfxzvrN/3nfxXX03/4Lv7l/0PXxPn+h7+d7+Jd/H9/X9fH8/wL/sB/pX/CD/qk/yg/0Q/5of6l/3w/wbfrgf4UfGvOlHZd0iwzif7Mf7Cf5tP9G/4yf5yX6Kn+pT/DQ/3b/rZ/iZfpZ/z8/27/s5fq6f5+f7VP+BX+AX+jT/oV/kP/LpfnHWod6v8Cv9Kr/ar/Fr/Tq/3m/wG/0mv9lv8Vv9Nr/d7/Af+53+E7/L7/Z7/Kd+r//M7/Of+/3ns/4C7Ut/0H/lD/mv/WH/jT/iv/VH/TF/3H/nT/jv/Ul/yp/2Z/xZ/4M/53/05/lv1hhjjDHG/iXjLzXFz3suLOf3+pUc8Xcv7g0AV2/Nl/H3/ZlXlOtyX2j3FQmxmV+f7tn5oaxHtWqJiYkXX5suISg0FyDrJ0GZfvrVg4vxYmgNT0I7aAWlf3X+fUXXs/Qb40dvAYj7u5zMCWXFl8b/HAATf2X8x54YuaBceDr+fxh/LkDRQpdyssOleDG0/ml9pRWU+Sfzz9PiN+af/YtkgJZ/G/mClr+Yfyl4HJ6Bdn/rYYwxxhhjjDHGLukrKnbMuv/M+j2bX7s/T1CXcrLBpfi37s8ZY4wxxhhjjDF2+T3btdtTj7Vr16rj/75R5f+U9S83GsEfNTI3frXhPUDWMwoAOj5bc+KlZ/6n9Lhf6wLIbMg/cy82/ynbSrr40fnHrmVnfAD/GaX8PRqX+cDEGGOMMcYY+91duuj/+fPqck2IMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi7Av0Z/07scu8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrn9vwAAAP//RgL1kg==") r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f80)={&(0x7f0000001fc0)=@newtaction={0x80, 0x30, 0xffff, 0x0, 0x25dfdbff, {}, [{0x6c, 0x1, [@m_ife={0x68, 0x1, 0x0, 0x0, {{0x8}, {0x40, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @local}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x4, 0x5, 0x1}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x45b9}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000002040), 0x0, 0x0) ioctl$OCFS2_IOC_UNRESVSP64(r6, 0x4030582b, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r9, @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r8], 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$NL80211_CMD_SET_BSS(r7, &(0x7f0000001f00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10040}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e80)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x5}]}, 0x1c}}, 0x800) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000740)={0x0, 0x6000, &(0x7f0000000780)=[{&(0x7f00000007c0)='U', 0xa00120}], 0x1}, 0x3) executing program 5: socket(0x10, 0x803, 0x0) syz_read_part_table(0x1051, &(0x7f00000005c0)="$eJzsz7utAjEUBNB5eou1KwIktD2QkBJTBCKnEkQLtEFEgwhkzKcDtME5gcfXGgc3TMK5xeqaTY7j8vP+/8rbdyrbrl773JPMM2uFLkONv/ecvh67MTk8f5Z1ktOQLLqU1ijZX36zHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM2yMAAP//2qsHZg==") open(0x0, 0x121342, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001640)={0x1, &(0x7f0000001680)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0x6) sync() sync() sync() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setfsuid(0x0) openat(0xffffffffffffff9c, &(0x7f00000016c0)='./file1\x00', 0x101042, 0x65) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00007c2000/0x4000)=nil, &(0x7f00009dc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000726000/0x13000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000180)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019240)={0x1, &(0x7f0000019280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000019300)) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/uts\x00') syz_ublk_setup_io_uring(0x20, &(0x7f0000019340)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r5, &(0x7f0000019480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000019500)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000019540)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000019580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ddc, 0x80, 0x2, 0x33d, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x20, 0x0, 0x142}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0x9, 0x135}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x800, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, 0x0, 0xfdef) program crashed: INFO: task hung in mpage_prepare_extent_to_map bisect: the chunk can be dropped bisect: split chunks (needed=true): <13> bisect: split chunk #0 of len 13 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 16, 21, 9, 27, 8] detailed listing: executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r1, &(0x7f00000002c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$get_persistent(0x16, 0x0, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x180080e, &(0x7f0000000400)={[{@utf8}, {@allow_utime={'allow_utime', 0x3d, 0xb1}}, {}, {@errors_continue}, {@namecase}, {@zero_size_dir}, {@fmask={'fmask', 0x3d, 0x5}}, {@iocharset={'iocharset', 0x3d, 'iso8859-14'}}, {@discard}, {@namecase}]}, 0x1, 0x1543, &(0x7f0000000800)="$eJzs3AucjdX6OPDnWWu9Y0zSbpLLsNZ6Xja5LJIklyS5VJIkSXJLSJIcSUgMuSUNSUguQ3IZQnKZmDTu9/slIUnOJElIbsn6fybmOJ06v87vdyrnfzzfz2d/Zj177We9693P7Pey5vJ15yE1GtasWp+I4N+CF74kAkAsAAwAgGsAIACAsvFl4zP7s0tM/Pc2wn5fD6Vc7hmwy4nrf2Xj+l/ZuP5XNq7/lY3rf2Xj+l/ZuP5XNq4/Y1eyTdPyXcuPK/fxh63/X4x5/f8/GZ///4tklBzzxZqS13cBiPlXU7j+///DfyOX6/9fK/hXXsT1v7Jx/a9UsZd7Auw/AH/+rwTZ/mkP1//KxvVn7Er292vBsXD516P/7AdE/sifgfieF97lf/qajhfLcPn2nzHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY+xOc9pcoAMhqX+55McYYY4wxxhhj7Pfjs13uGTDGGGOMMcYYY+yPhyBAgoIAYiAbxEJ2iAMBEJPVfy3Ew3WQC66H3JAH8kI+SID8UAA0GLBAEEJBKARRKAxF4AYoCsWgOJQAByWhFNwIpeEmKAM3Q1m4BcrBrVAeKkBFqAS3QWW4HarAHVAV7oRqUB1qQE24C+6Ge6AW3Au14T6oA/dDXXgA6sGDUB8eggbwMDSER6ARPAqNoQk0hWbQ/P+U/wJ0hxehB/SEROgFveEl6AN9oR/0hwHwMgyEV2AQvApJMBiGwGswFF6HYfAGDIcRMBLehFHwFoyGMTAWxkEyjIcJ8DZMhHdgEkyGKTAVUmAaTId3YQbMhFnwHsyG92EOzIV5MB9S4QNYAAshDT6ERfARpMNiWAJLYRkshxWwElbBalgDa2EdrIcNsBE2wWbYAlthG2yHHfAx7IRPYBfshj3wKeyFz/6X+af+Ib8LAgIKFKhQYQzGYCzGYhzGYQ7MgTkxJ0YwgvEYj7kwF+bG3JgX82ICJmABLIAGDRISFsSCGMUoFsEiWBSLYnEsjg4dlsJSWBpvwjJYBstiWSyH5bA8VsAKWAkrYWWsjFWwClbFqlgNq2ENrIF34V3YC2thLayNtbEO1slansL6WB8bYANsiA2xETbCxtgYm2JTbI7NsQW2wJbYEltja2yDbbAttsV22A7bY3vsgB2wI3bETtgJO2Nn7IJdsWvGC9kAX8QXsSdWE72wN/bGPpiUrR/2x/74Mg7EV/AVfBWTcDAOwdfwNXwdh+FJHH5+BI7EkVhZvIWjcQySGIfJmIwTcAJOxIk4CSfjZJyKKTgNp+N0nIEzcSa+h7PxfXwf5+JcnI+pmIoLcCGmYRouwlOYjotxCS7FZbgcl+FKXIUrcQ2uxTW4HtfjRtyIm3EzbsWtuB2348eoAPAT3I27MQn34l7ch/twP+7HA3gAMzADD+JBPISH8DAexiN4BI/iMTyOx/AEnsCTeApP42k8i2fxHD6X8GWDj4utTgKRSQklYkSMiBWxIk7EiRwih8gpcoqIiIh4ES9yiVwit8gt8oq8IkEkiAKigDDCCBJh5pFCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGLKCduFeVFBdHKVRKVRGXR2lURd4iqoqqoJqqLGqKmqCnuFneLWqKWqC1qizqijqgrHhD1RC/shw+JzMo0FIOxkRiCjUUTIS8eoVqIYdhStBKtxRNiBA7HtqKFayeeFu3FaOwg/iLG4LOikxiHncXzoovoKrqJF0R30dL1ED3FJOwleoup2Ef0Ff1EfzEDq4v3cHb2GuJVkSQGiyHiNTEfXxfDxBtiuBghRoo3xSjxlhgtxoixYpxIFuPFBPG2mCjeEZPEZDFFTBUpYpqYLt4VM8RMMUu8J2aL98UcMVfME/NFqvhALBALRZr4UCwSH4l0sVgsEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQH4ud4hOxS+wWe8SnYq/4TOwTn4v94gtxQPxVZIgvxUHxlTgkvhaHxTfiiPhWHBXHxHHxnTghvhcnxSlxWpwRZ8UP4pz4UZwXXoBEKaSUSgYyRmaTsTK7jJNXyRwyyDr+y3h5ncwlr5e5ZR6ZV+aTCTK/LCC1NNJKkqEsKAvJqCwsi8gbZFFZTBaXJaSTJWUpeaMsLW+SZeTNsqy8RZaTt8rysoKsKCvJ22RlebuEyIVtVJPVZQ1ZU94lE+EeWUveK2vL+2Qdeb+sKx+Q9eSDsr58SDaQD8uG8hHZSD4qG8smsqlsJpvLx2QL+bhsKVvJ1vIJ2UY+KdvKp2Q7+bRsL/3Fb5FnZSf5nOwsn5ddZFfZTf4oz0sve8ieEnqB7C1fkn1kX9lP9pcD5MtyoHxFDpKvyiQ5WA6Rr8mh8nU5TL4hh8sRcqR8U46Sb8nRcowcK8fJZDleTpBvy4nyHTlJTpZT5FSZIqfJfhdHmiXlb+a//Sv5g37a+ka5SW6WW+RWuU1ulzvkx3Kn3Cl3yV1yj9wj98q9cp/cJ/fL/fKAPCAzZIY8KA/KQ/KQPCwPyyPyiDwqj8kz8jt5Qn4vT8pT8pQ8I8/Ks/LcxfcAFCqhpFIqUDEqm4pV2VWcukrlUFernOoaFVHXqnh1ncqlrle5VR6VV+VTCSq/KqC0Msoq8tdceItVYbz4DaOKqxLKqZKqlLrxt/NVqAqqQiqqCqsi6gZVVBX7WX7W/BL/yfyaq+aqhWqhWqqWqrVqrdqoNqqtaqvaqXaqvWqvOqgOqqPqqDqpTqqz6qy6qC6qm+qmuqvuqofqoRJVouqtXlJ9VF/VT/VXA9TLInMfBqlBKkklqSFqiBqqhqphapgaroarkWqkGqVGqdFqtBqrxqpklawmqAlKqolqkpqkpqgpKkWlqOlqupqhZqhZapaarWarOWqOmqfmqVSVqhaoBSpNpalFapFKV4vVYrVULVXL1XK1Uq1Uq9VqtVatVevVepWuNqlNaovaorapbWqH2qF2qp1ql9ql9qg9aq/aq/apfWq/2q8OqAMqQ2Wog+qgOqQOqcPqsDqijqij6qg6ro6rE+qEOqlOqtPqtDqrzqpz6pw6r85nXvYFIhCBClQQE8QEsUFsEBfEBTmCHEHOIGcQCSJBfBAf5AquD3IHeYK8Qb4gIcgfFAh0YAIbiItFjwaFgyLBDUHRoFhQPCgRuKBkUCq4MSgd3BSUCW4Oyga3BOWCW4PyQYWgYlApuC2oHNweVAnuCKoGdwbVgupBjaBmcFdwd3BPUCu4N6gd3BfUCe4P6gYPBPWCB4P6wUNBg+DhoGHwSNAoeDRoHDQJmgbNgua/6/jen8zzuOuhe+pE3Uv31i/pPrqv7qf76wH6ZT1Qv6IH6Vd1kh6sh+jX9FD9uh6m39DD9Qg9Ur+pR+m39Gg9Ro/V43SyHq8n6Lf1RP2OnqQn6yl6qk7R0/R0/a6eoWfqWfo9PVu/r+fouXqenq9T9Qd6gV6o0/SHepH+SKfrxXqJXqqX6eV6hV6pV+nVeo1eq9fp9XqD3qg36c16i96qt+nteof+WO/Un+hderfeoz/Ve/Vnep/+XO/XX+gD+q86Q3+pD+qv9CH9tT6sv9FH9Lf6qD6my+jv9An9vT6pT+nT+ow+q3/Q5/SP+rz2mRf3mad3o4wyMSbGxJpYE2fiTA6Tw+Q0OU3EREy8iTe5TC6T2+Q2eU1ek2ASTAFTwGQiQ6agKWiiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5jZzm7nd3G7uMHeYO82dprqpbrLORLVMLVPb1DZ1TB1T19Q19Uw9U9/UNw1MA9PQNDSNTCPT2DQ2TU1T09w0Ny1MC9PStDStTWvTxrQxbU1b0860M+1Ne9PBdDAdTUfTyXQynU1n08V0Md1MN9PddDc9TA+TaBJNb9Pb9DF9TD/TzwwwA8xAM9AMMoNMkkkyQ8wQM9QMNcPMMDPcjDAjMy9UzVtmtBljxppxJtkkmwlmgploJppJZpKZYqaYFJNippvpZoaZYWaZWWa2mW3mmDlmnplnUk2qWWAWmDSTZhaZRSbdpJslZolZZpaZFWaFWWVWmTVmjVkH68wGs8FsMpvMFrPFbDPbzA6zw+w0O80us8vsMXvMXrPX7DP7zH6z3xwwB0yGyTAHzUFzyBwyh81hc8QcMUfNUXPcHDcnzAlz0pw0p81pc9bkuXi+9CbWZrdx9iqbw15tc9pr7D/GeW0+m2Dz2wJW29w2z89iY60taovZ4raEdbakLWVv/EVc3lawFW0le5utbG+3VX4R323vsbXsvba2vc/WtHf9LK5j77d17SO2HiKAbWIb2Ga2oX3ENrKP2sa2iW1qm9k29knb1j5l29mnbXv7zC/iBXahXWVX2zV2rd1ld9vT9ow9ZL+2Z+0PtoftaQfYl+1A+4odZF+1SXbwL+KR9k07yr5lR9sxdqwd94t4ip1qU+w0O92+a2fYmb+IU+0HdrZNs3PsXDvPzv8pzpxTmv3QLrIf2XQbwBK71C6zy+0Ku/Jvc11q19sNdqPdaT+xW+xWu81utzuyLoTtbrvHfmr32s/sQfuV3W+/sAfsYZthv/wpzty/w/Ybe8R+a4/aY/a4/c6esN+rrOzMff/O/mjPW2+BkIAkKQoohrJRLGWnOLqKctDVlJOuoQhdS/F0HeWi6yk35aG8lI8SKD8VIE2GLBGFVJAKUZQKU9ZKQnEqQY5KUim6kUrTTVSGbqaydAuVo1upPFWgilSJbqPKdDtVoTuoKt1J1ag61aCadBfdTfdQLbqXatN9VIfup7r0ANWjB6k+PUQN6GFqSI9QI3qUGlMTakrNqDk9Ri3ocWpJrag1PUFt6ElqS09RO3qa2tMz1IH+Qh3pWepEz1Fnep66UFfqRi9Qd3qRelBPSqRe1Jteoj7Ul/pRfxpAL9NAeoUG0auURINpCL1GQ+l1GkZv0HAaQSPpTRpFb9FoGkNjaRwl03iaQG/TRHqHJtFkmkJTKYWm0XR6l2bQTJpF79Fsep/m0FyaR/MplT6gBbSQ0uhDWkQfUTotpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF22kEf0076hHbRbtpDn9Je+oz20ee0n76gA/RXyqAv6SB9RYfoazpM3/ie9C0dpWN0nL6jE/Q9naRTdJrO0Fn6gc7Rj3SePEGIoQhlqMIgjAmzhbFh9jAuvCrMEV4d5gyvCSPhtWF8eF2YK7w+zB3mCfOG+cKEMH9YINShCW1IYRgWDAuF0bBwWCS8ISwaFguLhyVCF5YMS4U3hqXDm8Iy4c1h2fCWsFx4a1g+rBA+cl+l8Lawcnh7WCW8I6wa3hlWC6uHNcKa4V3h3eE9Ya3w3rB2eF9YJrw/rBs+ENYLHwzrhw+FDcKHw4bhI2Gj8NGwcdgkbBo2C5uHj4UtwsfDlmGrsHV4VdgmfDJsGz4VtgufDtuHz/zUf//CrP4nftGfGPYKe4cvhS+F3t8r50XnR1OjH0QXRBdG06IfRhdFP4qmRxdHl0SXRpdFl0dXRFdGV0VXR9dE10bXRddHN0Q3Rr2vmQ0cOuGkUy5wMS6bi3XZXZy7yuVwV7uc7hoXcde6eHedy+Wud7ldHpfX5XMJLr8r4LQzzjpyoSvoCrmoK+yKuBtcUVfMFXclnHMlXSnXzDV3zV0L97hr6Vq51u4J94R70j3pnnJPuadde/eM6+D+4jq6Z10n95x7zj3vuriurpt7wXV343Ne+Ewmut6ut+vj+rh+rp8b4Aa4gW6gG+QGuSSX5Ia4IW6oG+qGuWFuuBvuRrqRbpQb5Ua70W6sG+uSXbKb4Ca4iW6im+QmuSluiktxKW66m+5muBmu8swLW5nj5rh5bp5Ldalugcu8Zkxzi9wil+7S3RK3xC1zy9wKt8KtcqvcGrfGrXPr3Aa3wW1ym9wWt8Vtc9vcDrfD7XQ73a6sOw631+1z+9x+t98dcH91Ge5Ld9B95Q65r91h94074r51R90xd9x95064791Jd8qddmfcWfeDO+d+dOedd8mR8ZEJkbcjEyPvRCZFJkemRKZGUiLTItMj70ZmRGZGZkXei8yOvB+ZE5kbmReZH0mNfBBZEFkYSYt8GFkU+SiSHlkcWRJZGlkWWR7xPv+W0Bf0hXzUF/ZF/A2+qC/mi/sS3vmSvpS/0Ze+MO9072/x5fytvryv4Cv6R31j38Q39c18c/+Yb+Ef9y19K9/aP+Hb+Cd9W/+Ub+ef9u39M76D/4vv6J/1nfxzvrN/3nfxXX03/4Lv7l/0PXxPn+h7+d7+Jd/H9/X9fH8/wL/sB/pX/CD/qk/yg/0Q/5of6l/3w/wbfrgf4UfGvOlHZd0iwzif7Mf7Cf5tP9G/4yf5yX6Kn+pT/DQ/3b/rZ/iZfpZ/z8/27/s5fq6f5+f7VP+BX+AX+jT/oV/kP/LpfnHWod6v8Cv9Kr/ar/Fr/Tq/3m/wG/0mv9lv8Vv9Nr/d7/Af+53+E7/L7/Z7/Kd+r//M7/Of+/3ns/4C7Ut/0H/lD/mv/WH/jT/iv/VH/TF/3H/nT/jv/Ul/yp/2Z/xZ/4M/53/05/lv1hhjjDHG/iXjLzXFz3suLOf3+pUc8Xcv7g0AV2/Nl/H3/ZlXlOtyX2j3FQmxmV+f7tn5oaxHtWqJiYkXX5suISg0FyDrJ0GZfvrVg4vxYmgNT0I7aAWlf3X+fUXXs/Qb40dvAYj7u5zMCWXFl8b/HAATf2X8x54YuaBceDr+fxh/LkDRQpdyssOleDG0/ml9pRWU+Sfzz9PiN+af/YtkgJZ/G/mClr+Yfyl4HJ6Bdn/rYYwxxhhjjDHGLukrKnbMuv/M+j2bX7s/T1CXcrLBpfi37s8ZY4wxxhhjjDF2+T3btdtTj7Vr16rj/75R5f+U9S83GsEfNTI3frXhPUDWMwoAOj5bc+KlZ/6n9Lhf6wLIbMg/cy82/ynbSrr40fnHrmVnfAD/GaX8PRqX+cDEGGOMMcYY+91duuj/+fPqck2IMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi7Av0Z/07scu8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrn9vwAAAP//RgL1kg==") r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f80)={&(0x7f0000001fc0)=@newtaction={0x80, 0x30, 0xffff, 0x0, 0x25dfdbff, {}, [{0x6c, 0x1, [@m_ife={0x68, 0x1, 0x0, 0x0, {{0x8}, {0x40, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @local}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x4, 0x5, 0x1}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x45b9}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000002040), 0x0, 0x0) ioctl$OCFS2_IOC_UNRESVSP64(r6, 0x4030582b, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r9, @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r8], 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$NL80211_CMD_SET_BSS(r7, &(0x7f0000001f00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10040}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e80)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x5}]}, 0x1c}}, 0x800) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000740)={0x0, 0x6000, &(0x7f0000000780)=[{&(0x7f00000007c0)='U', 0xa00120}], 0x1}, 0x3) executing program 5: socket(0x10, 0x803, 0x0) syz_read_part_table(0x1051, &(0x7f00000005c0)="$eJzsz7utAjEUBNB5eou1KwIktD2QkBJTBCKnEkQLtEFEgwhkzKcDtME5gcfXGgc3TMK5xeqaTY7j8vP+/8rbdyrbrl773JPMM2uFLkONv/ecvh67MTk8f5Z1ktOQLLqU1ijZX36zHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM2yMAAP//2qsHZg==") open(0x0, 0x121342, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001640)={0x1, &(0x7f0000001680)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0x6) sync() sync() sync() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setfsuid(0x0) openat(0xffffffffffffff9c, &(0x7f00000016c0)='./file1\x00', 0x101042, 0x65) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00007c2000/0x4000)=nil, &(0x7f00009dc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000726000/0x13000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000180)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019240)={0x1, &(0x7f0000019280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000019300)) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/uts\x00') syz_ublk_setup_io_uring(0x20, &(0x7f0000019340)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r5, &(0x7f0000019480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000019500)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000019540)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000019580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ddc, 0x80, 0x2, 0x33d, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x20, 0x0, 0x142}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0x9, 0x135}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x800, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, 0x0, 0xfdef) program crashed: INFO: task hung in mpage_prepare_extent_to_map bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 27, 8] detailed listing: executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, 0x0, 0xfdef) program crashed: INFO: task hung in do_get_write_access bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-socket$kcm-openat$tun-close-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun detailed listing: executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, 0x0, 0xfdef) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 27] detailed listing: executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) program crashed: INFO: task hung in do_get_write_access bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-vmsplice-mkdirat-prlimit64-sched_setscheduler-getpid-sched_setaffinity-munlockall-sched_setscheduler-socketpair$unix-sendmmsg$unix-recvmmsg-creat-mkdirat-mount-openat-read-write$binfmt_elf32-close-mount-mkdirat-socket$key-sendmsg$key-mkdirat-mkdirat-mkdirat-mount detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) munlockall() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000440), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000004c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f0000000880)=""/265, 0x109) write$binfmt_elf32(r3, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00', '\x00']}, 0x258) close(r3) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x14000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-mkdirat-mount-openat-pwrite64 detailed listing: executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access bisect: concatenation succeeded found reproducer with 9 syscalls minimizing guilty program testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-mkdirat-mount-openat detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-mkdirat-mount-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-mkdirat-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-mount-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-openat$tun-mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r1, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-ioctl$TUNSETIFF-mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r1, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$tun-mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42082, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='comm\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, 0x0, 0x0, 0x2) program did not crash testing program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680), 0x0, 0x2) program did not crash extracting C reproducer testing compiled C program (duration=6m52.131387084s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access simplifying C reproducer testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in __rq_qos_throttle a never seen crash title: INFO: task hung in __rq_qos_throttle, ignore testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing compiled C program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 program crashed: INFO: task hung in do_get_write_access testing program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in __rq_qos_throttle validation run: crashed=true testing program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access validation run: crashed=true testing program (duration=6m52.131387084s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64 detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000680)="02155e65", 0x4, 0x2) program crashed: INFO: task hung in do_get_write_access validation run: crashed=true reproducing took 4h24m53.433095785s repro crashed as (corrupted=false): INFO: task kworker/u8:1:13 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:1 state:D stack:22336 pid:13 tgid:13 ppid:2 task_flags:0x4248060 flags:0x00080000 Workqueue: writeback wb_workfn (flush-8:0) Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 io_schedule+0x7f/0xd0 kernel/sched/core.c:8146 bit_wait_io+0x13/0x110 kernel/sched/wait_bit.c:258 __wait_on_bit+0xac/0x300 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:106 [inline] do_get_write_access+0x658/0x10c0 fs/jbd2/transaction.c:1113 jbd2_journal_get_write_access+0x1d7/0x230 fs/jbd2/transaction.c:1263 __ext4_journal_get_write_access+0xec/0x620 fs/ext4/ext4_jbd2.c:253 ext4_mb_mark_context+0x325/0xec0 fs/ext4/mballoc.c:4123 ext4_mb_mark_diskspace_used+0x338/0x760 fs/ext4/mballoc.c:4239 ext4_mb_new_blocks+0x1062/0x4520 fs/ext4/mballoc.c:6327 ext4_ext_map_blocks+0x1427/0x5480 fs/ext4/extents.c:4469 ext4_map_create_blocks+0x116/0x530 fs/ext4/inode.c:697 ext4_map_blocks+0xe8e/0x1c60 fs/ext4/inode.c:942 mpage_map_one_extent fs/ext4/inode.c:2505 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2601 [inline] ext4_do_writepages+0x1978/0x44a0 fs/ext4/inode.c:3077 ext4_writepages+0x1fe/0x4e0 fs/ext4/inode.c:3171 do_writepages+0x338/0x560 mm/page-writeback.c:2562 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1800 writeback_sb_inodes+0x9de/0x1af0 fs/fs-writeback.c:2111 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2187 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2298 wb_check_old_data_flush fs/fs-writeback.c:2402 [inline] wb_do_writeback fs/fs-writeback.c:2481 [inline] wb_workfn+0xc92/0x10f0 fs/fs-writeback.c:2509 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.280:6150 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.280 state:D stack:27752 pid:6150 tgid:6150 ppid:5818 task_flags:0x440040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 io_schedule+0x7f/0xd0 kernel/sched/core.c:8146 bit_wait_io+0x13/0x110 kernel/sched/wait_bit.c:258 __wait_on_bit+0xac/0x300 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:106 [inline] do_get_write_access+0x658/0x10c0 fs/jbd2/transaction.c:1113 jbd2_journal_get_write_access+0x1d7/0x230 fs/jbd2/transaction.c:1263 __ext4_journal_get_write_access+0xec/0x620 fs/ext4/ext4_jbd2.c:253 ext4_reserve_inode_write+0x294/0x360 fs/ext4/inode.c:7451 __ext4_mark_inode_dirty+0x141/0x7e0 fs/ext4/inode.c:7642 ext4_dirty_inode+0xd0/0x110 fs/ext4/inode.c:7679 __mark_inode_dirty+0x3a8/0x13b0 fs/fs-writeback.c:2741 generic_update_time fs/inode.c:2253 [inline] file_update_time_flags+0x399/0x440 fs/inode.c:2483 ext4_page_mkwrite+0x21f/0x1470 fs/ext4/inode.c:7864 do_page_mkwrite+0x147/0x310 mm/memory.c:3881 do_shared_fault mm/memory.c:6174 [inline] do_fault mm/memory.c:6236 [inline] do_pte_missing+0x70f/0x3570 mm/memory.c:4765 handle_pte_fault mm/memory.c:6651 [inline] __handle_mm_fault mm/memory.c:6800 [inline] handle_mm_fault+0x1a2a/0x3540 mm/memory.c:6967 do_user_addr_fault+0xb35/0x1480 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7f7116c6cea3 RSP: 002b:00007ffe56b085f0 EFLAGS: 00010246 RAX: 000000000003fde8 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000001b30524000 RSI: 0000000000040000 RDI: 00007f7116fe7708 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffe56b08880 Showing all locks held in the system: locks held by kworker/u8:1/13: 6, on CPU#0: #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff8880377660e8 (&type->s_umount_key#34){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 fs/super.c:670 #3: ffff888037744cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x1f1/0x4e0 fs/ext4/inode.c:3170 #4: ffff888037764950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fb0/0x21f0 fs/jbd2/transaction.c:444 #5: ffff888013d98218 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_map_blocks+0xacb/0x1c60 fs/ext4/inode.c:926 locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff9015a4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9015a4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9015a4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by getty/5389: 2, on CPU#1: #0: ffff8880376cb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.0.280/6150: 3, on CPU#1: #0: ffff88807bc64e48 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:337 #1: ffff888037766558 (sb_pagefaults){.+.+}-{0:0}, at: sb_start_pagefault include/linux/fs/super.h:159 [inline] #1: ffff888037766558 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1fe/0x1470 fs/ext4/inode.c:7863 #2: ffff888037764950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fb0/0x21f0 fs/jbd2/transaction.c:444 locks held by syz-executor/6165: 3, on CPU#1: #0: ffff888037766460 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:531 #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline] #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline] #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 fs/namei.c:5102 #2: ffff888037764950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fb0/0x21f0 fs/jbd2/transaction.c:444 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 9b 93 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 4b 25 00 fb f4 3c 17 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8fe07ca0 EFLAGS: 00000246 RAX: 000000000010076f RBX: ffffffff819ca1b0 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e6a8155 RDI: ffffffff8c8ea480 RBP: ffffffff8fe07d78 R08: ffff8880b8233d9b R09: 1ffff110170467b3 R10: dffffc0000000000 R11: ffffed10170467b4 R12: 0000000000000000 R13: 1ffffffff1fd1df8 R14: 1ffffffff1fc0f9c R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff88812340e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556a775b0168 CR3: 000000000ff48000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:458 rest_init+0x378/0x3a0 init/main.c:789 start_kernel+0x392/0x3e0 init/main.c:1247 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x157 final repro crashed as (corrupted=false): INFO: task kworker/u8:1:13 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:1 state:D stack:22336 pid:13 tgid:13 ppid:2 task_flags:0x4248060 flags:0x00080000 Workqueue: writeback wb_workfn (flush-8:0) Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 io_schedule+0x7f/0xd0 kernel/sched/core.c:8146 bit_wait_io+0x13/0x110 kernel/sched/wait_bit.c:258 __wait_on_bit+0xac/0x300 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:106 [inline] do_get_write_access+0x658/0x10c0 fs/jbd2/transaction.c:1113 jbd2_journal_get_write_access+0x1d7/0x230 fs/jbd2/transaction.c:1263 __ext4_journal_get_write_access+0xec/0x620 fs/ext4/ext4_jbd2.c:253 ext4_mb_mark_context+0x325/0xec0 fs/ext4/mballoc.c:4123 ext4_mb_mark_diskspace_used+0x338/0x760 fs/ext4/mballoc.c:4239 ext4_mb_new_blocks+0x1062/0x4520 fs/ext4/mballoc.c:6327 ext4_ext_map_blocks+0x1427/0x5480 fs/ext4/extents.c:4469 ext4_map_create_blocks+0x116/0x530 fs/ext4/inode.c:697 ext4_map_blocks+0xe8e/0x1c60 fs/ext4/inode.c:942 mpage_map_one_extent fs/ext4/inode.c:2505 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2601 [inline] ext4_do_writepages+0x1978/0x44a0 fs/ext4/inode.c:3077 ext4_writepages+0x1fe/0x4e0 fs/ext4/inode.c:3171 do_writepages+0x338/0x560 mm/page-writeback.c:2562 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1800 writeback_sb_inodes+0x9de/0x1af0 fs/fs-writeback.c:2111 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2187 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2298 wb_check_old_data_flush fs/fs-writeback.c:2402 [inline] wb_do_writeback fs/fs-writeback.c:2481 [inline] wb_workfn+0xc92/0x10f0 fs/fs-writeback.c:2509 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.280:6150 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.280 state:D stack:27752 pid:6150 tgid:6150 ppid:5818 task_flags:0x440040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 io_schedule+0x7f/0xd0 kernel/sched/core.c:8146 bit_wait_io+0x13/0x110 kernel/sched/wait_bit.c:258 __wait_on_bit+0xac/0x300 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:106 [inline] do_get_write_access+0x658/0x10c0 fs/jbd2/transaction.c:1113 jbd2_journal_get_write_access+0x1d7/0x230 fs/jbd2/transaction.c:1263 __ext4_journal_get_write_access+0xec/0x620 fs/ext4/ext4_jbd2.c:253 ext4_reserve_inode_write+0x294/0x360 fs/ext4/inode.c:7451 __ext4_mark_inode_dirty+0x141/0x7e0 fs/ext4/inode.c:7642 ext4_dirty_inode+0xd0/0x110 fs/ext4/inode.c:7679 __mark_inode_dirty+0x3a8/0x13b0 fs/fs-writeback.c:2741 generic_update_time fs/inode.c:2253 [inline] file_update_time_flags+0x399/0x440 fs/inode.c:2483 ext4_page_mkwrite+0x21f/0x1470 fs/ext4/inode.c:7864 do_page_mkwrite+0x147/0x310 mm/memory.c:3881 do_shared_fault mm/memory.c:6174 [inline] do_fault mm/memory.c:6236 [inline] do_pte_missing+0x70f/0x3570 mm/memory.c:4765 handle_pte_fault mm/memory.c:6651 [inline] __handle_mm_fault mm/memory.c:6800 [inline] handle_mm_fault+0x1a2a/0x3540 mm/memory.c:6967 do_user_addr_fault+0xb35/0x1480 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7f7116c6cea3 RSP: 002b:00007ffe56b085f0 EFLAGS: 00010246 RAX: 000000000003fde8 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000001b30524000 RSI: 0000000000040000 RDI: 00007f7116fe7708 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffe56b08880 Showing all locks held in the system: locks held by kworker/u8:1/13: 6, on CPU#0: #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888021a9c148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff8880377660e8 (&type->s_umount_key#34){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 fs/super.c:670 #3: ffff888037744cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x1f1/0x4e0 fs/ext4/inode.c:3170 #4: ffff888037764950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fb0/0x21f0 fs/jbd2/transaction.c:444 #5: ffff888013d98218 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_map_blocks+0xacb/0x1c60 fs/ext4/inode.c:926 locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff9015a4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9015a4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9015a4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by getty/5389: 2, on CPU#1: #0: ffff8880376cb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.0.280/6150: 3, on CPU#1: #0: ffff88807bc64e48 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:337 #1: ffff888037766558 (sb_pagefaults){.+.+}-{0:0}, at: sb_start_pagefault include/linux/fs/super.h:159 [inline] #1: ffff888037766558 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1fe/0x1470 fs/ext4/inode.c:7863 #2: ffff888037764950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fb0/0x21f0 fs/jbd2/transaction.c:444 locks held by syz-executor/6165: 3, on CPU#1: #0: ffff888037766460 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:531 #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline] #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline] #1: ffff888035a90c90 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 fs/namei.c:5102 #2: ffff888037764950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fb0/0x21f0 fs/jbd2/transaction.c:444 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 9b 93 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 4b 25 00 fb f4 3c 17 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8fe07ca0 EFLAGS: 00000246 RAX: 000000000010076f RBX: ffffffff819ca1b0 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e6a8155 RDI: ffffffff8c8ea480 RBP: ffffffff8fe07d78 R08: ffff8880b8233d9b R09: 1ffff110170467b3 R10: dffffc0000000000 R11: ffffed10170467b4 R12: 0000000000000000 R13: 1ffffffff1fd1df8 R14: 1ffffffff1fc0f9c R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff88812340e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556a775b0168 CR3: 000000000ff48000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:458 rest_init+0x378/0x3a0 init/main.c:789 start_kernel+0x392/0x3e0 init/main.c:1247 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x157