Extracting prog: 29m31.727120881s Minimizing prog: 51m30.651238161s Simplifying prog options: 0s Extracting C: 34.659456968s Simplifying C: 10m9.265887866s extracting reproducer from 14 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-syz_init_net_socket$llc-prctl$PR_SCHED_CORE-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-syz_io_uring_setup-socket$alg-syz_create_resource$binfmt-setsockopt$sock_int-bind$llc-openat$binfmt-close-open-execveat$binfmt-bind$alg-ioctl$TCFLSH-socket$nl_netfilter-sendmsg$NFULNL_MSG_CONFIG-accept4-syz_io_uring_submit-socket$nl_generic-io_uring_enter-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_CLIENT_CAP-ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES-ioctl$DRM_IOCTL_MODE_ATOMIC-bind$llc detailed listing: executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x5368, 0x0, 0x8000, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x207, 0xe, 0x5, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat$binfmt(r9, r7, 0x0, 0x0, 0x1000) bind$alg(r6, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) ioctl$TCFLSH(r9, 0x540b, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000403"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240048c2) r11 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r11, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r3, 0x627, 0x4c1, 0xb, 0x0, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r12, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r12, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r12, 0xc03864bc, &(0x7f0000000b80)={0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-writev-syz_open_dev$video4linux-syz_usb_connect-prlimit64-recvmmsg$unix-getpid-sched_setaffinity-vmsplice-prctl$PR_SCHED_CORE-syz_open_dev$MSR-sched_setscheduler-syz_clone-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-mount-openat$mice-ioctl$SIOCAX25DELFWD-socket$igmp6-quotactl_fd$Q_SYNC-sched_setaffinity-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-rt_sigsuspend-write$RDMA_USER_CM_CMD_CREATE_ID-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180)=[{0x0}], 0x1) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_kcm_SIOCKCMUNATTACH-socket$inet6-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_int-mmap-write$cgroup_int-prlimit64-sched_setscheduler-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_open_dev$sndctrl-ioctl$FS_IOC_FSGETXATTR-ioctl$SNDRV_CTL_IOCTL_ELEM_ADD-openat$sndseq-ioctl$VT_RESIZE-sendmsg$nl_xfrm-ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO detailed listing: executing program 0: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$cgroup_int(r1, &(0x7f0000000040)=0xffffffffffffffff, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000000c0)={0x400, 0x10001, 0x3, 0xe, 0xffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000003c0)) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route_sched-socketpair$tipc-socket$inet_tcp-prctl$PR_SCHED_CORE-sendmsg$TEAM_CMD_OPTIONS_SET-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$RDMA_USER_CM_CMD_SET_OPTION-socket$inet_sctp-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-writev-syz_open_dev$video4linux-syz_usb_connect-prlimit64-recvmmsg$unix-getpid-sched_setaffinity-vmsplice-prctl$PR_SCHED_CORE-syz_open_dev$MSR-sched_setscheduler-syz_clone-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-mount-openat$mice-ioctl$SIOCAX25DELFWD-socket$igmp6-quotactl_fd$Q_SYNC-sched_setaffinity-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-rt_sigsuspend-write$RDMA_USER_CM_CMD_CREATE_ID-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180), 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) program did not crash single: failed to extract reproducer bisect: bisecting 14 programs with base timeout 30s testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 24, 27, 24, 25, 15, 16, 28, 24, 24, 5, 24, 28, 29] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$nci(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d00000002000001090224000100000000090400000103000000"], 0x0) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) r2 = syz_open_procfs(0x0, 0x0) fchdir(r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2(&(0x7f0000000040), 0x0) timer_create(0x4, &(0x7f0000000180)={0x0, 0x2d, 0x0, @tid=r3}, &(0x7f00000001c0)) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x2}}, 0x14}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000070000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r7}, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0xa042, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)=""/153}, 0x20) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x2, 0x7fffffff, 0x84e1, 0x2f, 0x2006, 0x6, 0x8, 0x80ffa, 0x0, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0x32, 0x7ffffffd, 0x1ff, 0x9ea, 0xc, 0x40000, 0x8, 0x7, 0x746f, 0x48, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x9a974000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x25, 0x800, 0x5) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) writev(r0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="d8a1d7f6d33e85957476e72e9263c90c852c476295e7aae81c0efc8b0aca4fe8cafd053f4b12e937ae515ced28c74e51bde84a7006598a04c79ce495d90be7f75d25c1486e548e756fb64a3664e45093d86e248cfba5ea2e0c285d1ed971d3b8fa03cd40495a631ce54e69e81986c04c3fe0ae82a8588b96a37b6856940f943dfb3b330925575062e53fdc1b06085cfdbffd8e4d17886a", 0x97}, {&(0x7f00000002c0)="88aa5eb8ea67f17de08a90f7af78ce1dbe5d6ef4c01eae633f81d2847424a744875a03c7193ac7749e129ef8501406b4730f0d9d23aa07a781bf890f3e93d4de1076e444706ddc30c5b630183f360890d6435cab176edd635d29047ff0b5", 0x5e}, {&(0x7f0000000380)="efa9abf041e8f4f1bc3f567b779f07dd8ada29f518b160f1935de2b75c52ea3d44e322b73c1399aa3fe048833e9c1480f13dfd1123669c06861cd78902fd48d4bdd7f053810f96ca3dcbec7b1253126b0d8e8c1e4ae8daa2eb669e3bc4fd789de58a90e6a3566d1ad69a01843c4194ce4af7936fb277edfe12e0e4119c9e45ae3639e9bf285957762ad4292a18f7b9230bdca677a37ac86a575a32a5a77691c02b0c915b5777d7dde1d513eead2e263be8178eb8cc798cc4bfead61397eabe623c3bd53205ac689c2edc90113b2702d3529b8b46c67545f2aa7eb6d1bd217e4d5f945641f654e05ddcc33e62388f072dd42fe7ff1730dba0c27d074edb04ed804ae3c0392159ccf8dc5ebb59d728f3bbcdd7d73d540af47a1e03a1ec63228724eb876534c0679a2bee989c2dca458a998ea0d04a7e8b6456928a504fdcc9a1dc1dd5d3d71d0a5efa2b486445de9073b88b080e5537d1a26f396157e721fd811f946bad668f1da0d4a6b9a6e896281a5eeb4f72aa6d64a3acfb851daadcc8d83849b34d287e47b4e83a45ea0a69ed012aed1354efc885561674b92140b382a60cdf9487052f8ee1b9e838e5c29c56ee5fddea6a0050189585402057e5732252ce7f6f71917fe5b453395dfc740be8fec416b04be2d028577043b09b192079bad7b26311708b36e221226f34e7eafc5787de36d8b3ed0ec3bdc139ed42e128447b3184f00da5a1738a10f312d6be61d0fbe901a2e82bd1ca9b01ed254445317f1e30e6cad01721d698e3bd0eb8ee193d5ca419689c35352ca3f29a6a8d59242891eef7ba0dbd8a3b33dedf8e2e966be43b4802f94d0d3e46e4beb1e007a424e7626136f84f3d2cc35faf8fddcf8729da0cf9bd60c518f00f34318870033b80655e410e06aebd060ee38d43085c46f149c97647c5708f1b4d3b0512cfec07b2c1be02de66d6fe5e5093e260353493c5eeb49b6bb3d1ed0a31cc208773aac014f3d4e96ed10d57bd336b1f42a5932708f19cc513df24096de4c6341d6f9913519635fe006f733c289f81446ddbb311d99dc6b459dab5ea53a13a7c5514dc5e7bbc82946f912f2ac4eba493d4289a7008642d92c03dbd8731663374e707a9c17cc30c36be34a794946ef97892fe606b4805d1b9bb2c91455c1481169a8fcbd96c669cf0fa5b5ff11592086731fda21c6151fdc0d5f6d23d982bfeb0e52e6a3384ec2f1e093c1aa6d9362342790bb83098e0b53939744d5a32a7e262517c40f20e4dc6935ef1212db21bfdccceb63a48c61af3fe12598439225ca16ddd93e525e7cd679f491fe27aed1579836a58ad7d7a6a4dc610339ea7a1cd89f53a48563115e4821f48d243ee8edfd785c76f0ad2da73df235c183e72fa6a2ef13dec825cff403a50123c5d6bbe561f0b1e27d986157c844852f037f9923e133a66ad8e36b7e57c5a3b5e0a43cb0d89726118b1324cdb9a6dfe70e148bf492bc5eaba9cbdc3d6e49c0452bda33b859f91715c1292c041d9bc82a105d0eb04b1aa13ab1fda2620b735cb2bb7c7287e36f04b8179c730f445d3c8ae496eb4d254425474dfcb61dd8381b1e39b74b1233bf1c2bcedcb037fd530c0f267ec7074381068bd51eaafb6109b04098c6e31ca8a9f70096a592f6bf2e0fcfb26565a550e98375b105e715708eab91f160f74553b81fb0c2a510a23156a98962c20c1d2d42b6472fcd264ddcc84bf6071ca6b007d19d20acf800c21de3f800dea33fdc21160f6caab8b3738b4ed2a0bd64580def772f9993373a5c8b7821582cb78b9f95c31da0a2f8b47d47e63af29ef96492521746f9b4154246c80e80d0c4c1475982d10e60bd8c52621c5093e0cc79e7b2b696e6a7ee1a4ae609cf77b285b2b8701b9bd010a6f6329f63fda2cf5dd2d706d491e85c7bcf977edd4101080150b6963fa8c0527dff484b388b564f8d80d595965286befe5e72f8e7044bf6e6acddae59723f86c7d698e10b694656886fb5a6aedca0fc92999ef816fccc8964fe983b2e1252e3ce2d7c0cc5cec3b5ced3be963bc4096da7772b06e18dee18b5daf3a730520b06640ae3d39411fa6b33d0657e4144d361da294b2191706f80dbaa3714d63ce9512fcdecdd2b53d31a13b9c4ffb8fdf17311271a52b37c646af44f8a2224cd505dfbe1b400c6700a1f7fdb98d327dc6898887a9f6959b8f964dd09064d31a5bbcc6cc5639a78bc9ba51fbdaf34d1ef480f0deb338054521217c7ec208a91ca65aeddae0e5e9b0af34d9941a81a70dd7e5da9185e0ae3f92ca64ef6f6c83a8b0cc14fe74dff3480f6f1ac4e118f2d55ba4b65a2cd01f21872546409857851f50e307aca8be142b74967c11a5527a77097f0bff3eaa68cd38366a3972000c1401762fa350b9a7b63bf77f5e7867baa32ca7a70413cb059f259a84caa20e3da511b475a5d94f34f0c9c17d000fd37564c8dd9d31432e136a02110ea0ae7a90f57d0b8707524ac3b41b0f857ceb6efcecd4d7ff6c2b49bfb2b23857f795f25e94c63a289084c9ad16f0e65dbeb94edda348e12f31c93e56770097ce18bf8b625de138855aec86c3195af008173c91e1ecec658b46d87717e70cd6a584f89d04ae15bf2b7b15ecedf26f2cf7c2ffa1001b16408d6080a89c6bc532ff514d14ded8e8e21466d9595e11eebbb9fb38958df8184b0d6823e060dc561bbc2f39794603bb677c7c814e95295f93ece5bbc4c0f38acec4ab5b085a0ba69df2a799a70b377814ef6f2834e942f92e1498aadf4a2b99c833281a3d8db8c7bb0d8bc7db6146a854879c89c753ba041e739224fc74661101995dd567bf79af382b4adaf46b985d345b06bf54e5a8cf6b980afb18685a04463520f7d4ba907cb15f6eff9e4f221b10bad62cf8a6acee0e2693e1f8af9e2aa0b29a41f2e18cf87c440df82c54fe53ae21de6f0280751db3d4d470a3a0af94fedb1a0d059dc91168abac8989f4af81ff626914ab2d5418ae1242d4f42ce4c547d29d214123b4391e71f06421edd521f6fea9a08d109c0dbc30b8df7f91a462706abe5c6ef4eea83b8c4a5f0bb0e9b4de1863a2ca6c2997a717962386983b84ac462fb58694b64adc12afee65e0674e77a8a49044b80a3f80320c2940b4e31d53a5744fd7737b0d5e1d84042d88faf7aec7a8080e859d28e17feea3bab1bdea5fafb46ca8e8dbe04b5e0be9aa1bc44918ad411be992340f2b4ad19d556b7418683499b028211dde3aa50a0a082c69d133ea86da9f8bf588fc10d8d5b9417bc9c214cda23298cb4773d9c8a21e9ec152a0468ce976e2ab4d757c53e06e911cdcf0df650c826d83862b54834f00981dbb1b062e65d1bab9d896e4961a8676c886816c8db3d45ddf8d70a5a8343289f31feed75666ce57149b96dd2b3e42c535b65027c7e7f6041034dcd5ef4441dd73dde8ca56451f874fdfb053c8db40f89c4f4025f0dbb9b179003c2c0f342834adfab0275b1ca37904e3429e1150ee81f7a7dcd7284d2cb07d3c3fd27f2107199dc531ba7ecdaee86137c65956199225a0450517ea8968ebdbb8e410b968e9bd6c2567db300301d2476ecc301ad0aa9ea5920dc4094a76f539d102d3e478a98de48907d75cce9a6a1b4cf3d24fea5533c632045c05c3675852b19587d7b337ffead0515f9d95f6ed9ce9ba05fec41684b0c2ecfd1bf3a8ef92e479c057484b07ef5137f79fb9f22b3cef1e364f9bb75b9d64f13cfd021f61376b3805e33569a891d8405898865a804beeb40387a1e4d1b394d1881948475b4f90dfa4d558924119e4d82f96ca686c21c409b04592e4f17172b902d85ce3e899b78a5cdd52cff07a9cb1aa3a9c080eca27127e0004600cfaf4cc4d489d3f57b323543302333ec3a2eea68578b65dc9be3a6cf8b1ffb2ac7b0d30ef16ecc29c919dc311b962c97bda7f5d69b9b5f5918282d07b3440002542186b9791b797b81d23817c1f7fb112ec1c3bb2554d028035b9030ffc242d8caa382e7b2734411677796a77d77d724f2b74f9ad64134905803331842b9164f5ea497f06cc467dd1cde848c6efa8e0dbcec8702d180586dcffbe2e4b5dacb4c01f5885d1a8c7db100a7794294158c8202cd14e77169c8d15e9337b10db9c76e57254ed0efacb1e25c8bec77da6a540a52354da5e72902bf3a8c50d338443eaaf1d0ac33e3b1937ebf34d188cff462b02ad8d79e767a9169cc1309b207763c89777fc083f5e0ef9e79c3acdbab3338d532be9cc22b317f453f24a007f7245f9747af3156e6d6fba6dfe9a0f5b3cf3dc268963d886353674117b42f08cecfa5a66cb1aa54e4473676f92beaee0af5c75ae1ff240c7b334309b9b5fc293cd0d01a8bac9f464ff81fd7fbc748b8330033eca52dbf2ac49d51ca34e3ed3c19069a31395308be436cdfe25be6544eaed154fd11a5225af09cd18c5409a1962969946866edb8c79778ffac0ae019112c4063999492630e29f4331f65cfd4ae413968b8e52312e533b7ef5dfc67fbb53c4129c60b6c3b48ba3f0b8bb0f83c4c542bc2af0670f51f6511b7fbed72285647cd04ad900550163f82e4574da11836827b7a1c9669eca76e9870a4e08fa357e56e00b5a70b854a1c5b88e45d6503e545b970441e7fd71e56bfb7244e4d2eed5d8058612585322ac38d5dbdc32074a55ee21e54e994265b0e3181f0dc8059fcedebbead5037dc5dfea4d813196a43dafe410686fa2ec408964f38be3beef93c4c60bd1a396604f6c1a5c4bbbba286c3d82e2afb9d882cb09990b72ae40114f8c235ae57e92f39945992c5f81a88ee0782bee3a91ea86eab666a08635e9c11638e248ac32a3a98de2c67a0f2f79b2118d37f193e4d177a15716e059a96fc774216186e6b6034cde926784847513f804e6e4280787aa35c980d121c185a35849b36d2297f8b8d73d69fbd8f87f7c056de311319069318626a92ad33e4fec6f3ac5c0efd7ce9ab515e113779cf481840b101bccc67daf5ec64f6ce3dd56049dcde4f99b3d2895c25be47597ef1b09f1067218c2b4a31c1c915ec670c0ce294a944a9b192493db122acd59fab5e13d64261631a75362d10bbc23ede4351e6b635ff0e2726494586e0ff4a159477e2ebf6f0509bf7f4c96accfbcdcd4ca4a56ca84a9315f09391db10900400d1ceef0319d3b867ec1b0983842deb8019bf13f576e90d4a09c5a842a4e9dea973c2195ab54e346e4f066fc970e8c64c4facca40536419175bce5c0c424ea2c3384a7e84288058b05997ce78e30145f66aa42db57e2f1fb34fa22d9cfe5d34eeae7021fbdbae04db4a805d34550b5f8f598a7810d1831ea4bcada8f6168c5ec5cc99a4d36534e5b4c7e2affc909505f085763733dd7cf23b82d7c4163e96a3f259eedd9c8630fa0248ca437e6b8adfff555c63e8f568343639bb5f81d7f8a8c0be59be0adb3bc013de38b31a58913546448bddc73e27df73c01c41a25ad82db7c290b6ea9b8bb88e7b34b92ca547af0149d2b511c94470a90d2d79fb9590891b7b0fc52a01f72cb17ada27c8361ec195f1be5f48fff7cf77153c42e5e172d2b3a3231967c0652a03d0f3f46c4b4b291767bfb1128701bee188787c74b0428e9af80b4f51043b824412f95688bcdbef69fe1c4b938cfab5f70832c6f81d3ca40bfe752d0bbd00ddf36c5e4a9c4854b73d41fd1c336f59d28fae64baf6127172f", 0xfbc}, {&(0x7f0000001380)="b4d3cccd3b1fc7aa5dca5bd10a1b7274acd90b7d4047869c8bf158ca42e784fe49bdbab023e0751a66b9d32ea93c8db257c50f490eeeaeca11df2fa71d578fad0abe33eef3311720785286da47e6ebbb8cefaa89b4a650bbe6ce4158491ba630234bd325cfea81051161589e95f66de9c404d268ae55b8550cd8f4a9ba812e7adb6d641e349607e0fdb4fad67e79ba74182d7a4c46728c0dcc128dd2f65773562a20211c64b25f8ccbdcb027aa3e4ca5ad7c90490ff76170e3b0f6b57d18193c811960e2e3bdee8bdb29d4c9178fd32dc5e063ef60761ce6b22aeeee7beac7e3bb6ebeea10a7f2bbd77f2659c23e681ff0f24d19a796de32a57403cbff0004c985da3ef08acd2a49aa1e9ef5dfe4dd5db27fad5c2ea4e5b4062665a8075d6acec02a030a464a98e6a5e255cb0719b6a7b7773afb140c4bb53f05a6adf60c4c2ed6e369472fc79baebf66a66d3673dad210a5742c0c73bba32c5ded6688fba2ecf86f7adb2f3eb9a51f2f8b1dcc2c989d6d2410ed4a7d6d5c823b6cc7484db2f5d17850643303d0a869aa0346c54ec8380aad4503d78e9f9998aeb04c779eec858bc6d0f6cfa85fa56de7f88162f5d36bc87ee54f7a7cdf8bc6fe0e47a3b191ede3bdbcd70ec3aaf3e65eab07deed34085409a1282de8e6d73b5cddcada5b48f76ef476cc7b2e34138594efa8264b9627543e9b2d6be471337abfd2f615934c4855b5d7f7dd2ce25206c546c701f59e2dc36c26ee52b2e45a52cf30f8887b3401dbe21bff8ee7238cfa0c5fc76a60133f10c3ac7ae8a2bb6dca244cb0422ad5afd2f64feb07f8c8d8b6eb47ecd172de7e67f328e5bd807b21a634387219a9db8fa5dd72b04bd31d186e872ff882fa6f4fc603edbb23b6da459777f9ce04502ae25a27d533cec097d315556a1504d50009bae0c15e53e1cde1879951209e54fcd3f73e9c3934efae17ec1e89f83262597875354f859c20634674ae40419d0826f6b79ba3b53afc81f1ec1e9ca33d109a55f1b5266b2cc619b6cbdb0865880c680f76b828d6bf35c8e48c35325c4395cf6025e940bc3e083c01261367e5ff9aa1c048765bffdfca703d102be67c346238f9c5e6ffe6ee3f9dc602fd7bc3df1b311f47244f09ac403ec083269948885ba8f9e23ed27c75abcdd6b6e9fbdbb13244ceaeceadbc21db5e93edf17e0fefab4ac5a12010f682e52a6e4cbab647ecd63c6359a5e4b3b3e7c9263f452a1857f6068e0e533aa1543188243fd3303656ecc82f79c90e3405bb9d8027ec4300e7bbf7e2599423ea401a75d7d9bc0360225004d6ed2328f126ef908c482d07889478260c786b6aa8acef93da75da8511f3d54f52e7ef117fc356c6827500cb0c6d35a5941bc789ee32a758032d59e6e4f1ef056cce421a596efc6e8260cf21ceb4514472bdbcbb00645ecf61933c81a9fa2f1a5b26f5e010649daea9e81e94c9dbd2066a3e2dc5d57bbf56373c1e728a2dc54f1bb782bd0da998328324ad0459b013248629e84c7df19318791c61f073a3d05316ed580b4dabaabe536ba69122274859980d49fc18a0920fd952c0e794a23bf4a07b7817ee22653731349282b83c8a0300d07f94366597421bf6703db2938bf8e2702952c98978bd83309f9b9b97692cd8f32543f6d6c02968a5749c862bbd6acad9a9802ae208f22cc220a8d4d301ce6bca1609e571a21036c181a020326f08cceaeb1bb67cca080162a4d2080c62241555d4aa34369e9b5dfa6ececf5c981700bbf1fa58aec97b6e59976feabaf2f9c04d8fa16d3b3bdef61cb2f0bf22b0243bb059f5f0ef1375bb7f1d34b40b54a89091767a7d31c7e32257285f32d201c9bd05e2e200d1fdb04256d9c2b09bc81b40d1ddedead4c24efe5f2d138d6519239a3e51bf0cb2ba78a4af4fbe3408723178002e154a55e7abe466d28b91bdc808a10e6849dce311d01f05393c1cf6da35ba867b5f062ec02b392eaf5662d36eaa4a251f894076a358c5428fb8c60e3b84da2042a6c874574f746c2c7a4dcddb38daa6a0e265d23553165924838c3175820bebe99f03100c763fe6796895aa10642711aec9bdcd3bc8507beb99f71739fd161f258c70e704ee47d593db28f5d4929edf6309aff0d31fc3493d6fb58a547b7195dfdb3a7323a1542b5cf8913abfc8e7e47581c75ccbc82723233b843849bd9da71b02a2e083eeeb95052e288a5ba68f7fa2f63ed3f74a59222335cd677795e4858fd014a82a00de9b3cbeb49fa134ea83eb365be74245afcd81fbc7dfaa8be057fa51236a821b0be131f8b96423ce576ee03f79e703909402fb9c6664c33347ced43ec59b39480c3d77c36ae245f6ec3c4389089e614350e733080776f8f4d333729c7bd38f1d752733035b96615272322c90517333aabb1afe4ea19526734523a3b982f8e10fa6d641b825c72615fe8403d7c269473eaad26931a51fae1034a7a5e42f540f57bec0b99e2c820f1b6e4072ee16e9a4871fe6702e729121ad85c4235ae070193cc437e6c39a72f51e541a150abd43654f6375d331cc92092b93fded5bf2696d0289a8c4446df44115a788c3d17e6de8845190670e3a8aaf70fc642ad72cdc6f5444c7f0f392667f7851d57fe87ede24995a750b2778a69961817a24597196c5396262be411e7803e63c3a4ceb4137e03d9b2816e6040d0cb45fcee85d7041cb26e8bd622d6e682d813829b1d510c24c7c9ee6ff275f32fd86c7ca292d5dcbed5fa37efac06e2099933325f27e4f364b33cdc4e5680ccec8d952a04776e5381f18108da68f0c6a9ec882ae6d7f9d94c80114df135dae00fce09c7ae309068295806c5a29cb0513caf9365330e65bd3add5994e797fac6807ea3cb0e63b636d3918f44b61befb4ecafb5425a6882d15c43096e8ba72f510f5010a3db9191acab9a536ddde68dcdcf7313c41c7aa282e32be7e7542bb5ca6f15735cc1534b9835b305ae46c90030f1c4e4f606ddac700fb329e8237a67ee6e1f00d31b0ba5ba27f78c4b76e9d62386f8045f7fbecb63d5fec5c859d427a6735a18d573cefcbc425cbd3a1573e715fb49c3301c42731688c25480bf23094e6fe1206c8fac67d3ac32a18daa4b3c70067e80ab2018414a0119d2d2479c29f18ab7aea2e7616e8d1515715ffbd9ecc2f9c204833e0c15ee9c9b31b0c2a0cf4cf9de69757ec321ad6dcd53e8ba37d3ff4f6e91cdf03eca767c6e667a0623041fd089d2da8f0acbaebf122fccd51d4160dba791c684038ae9618f433f39a035322c20f1ff7df29800e246a07d7a0e0391b25f3850d157c82610864789f0e83888bed2cd8e226f7ff3885f07f37136e3e6bc25f97a7bb2c1e5e0b7a16cb12de2124bda21273bb4d4ae03dc0698446d1187305360b233b6efdc1f2e3ee97e93a306b63027e3352ee56233fe99521ca0a36bb7ddd2a5129bb5cb449765c3aaf92c820d0b1015ed9f103a1bdd1ec39fe8497145e50e786b079a4a1d31da023021d5a6061e8622e0c721bdad973ffeb66973aa3fee8b43719b84ec80eed802be5c1acd9e3fbee31905103290fb2717d3999752151d60f482cfcf467537abb3eb303b03d7bbeb3460d61b895c669646260d150db913bc31f263fe2051fbee6e2355da2dfe70d1a64de2671ceae2882d983a66df2ea44be8c767cbd4810384a1a354fe036fcc26e69161bfe18e275bea16a14965384238009c981caac0d1f3ff8b7c0d64656fe107ee31e99577700c678890e2dec1f12c8b9fbe8630f11d3a824f73be10e740f73c53c5638b76728c0cc00c616279da04346de7b1c88e2bd5ed7dc26b12812b2aa4085e23eb7e4a35bc8cab2a2e56f1f116e38a0f1ffd35c5323df7d6b79056c8198410c1b241a97d40fc06455c9e1a7df5d1bc2b07ac736f99c2ee0ff70458c3ff126e57c7494e18ed7695621607517fdb358c2b98f4e58bd63aece7f7333579f0a0ea936b7916c5560f27b0317258571b4ca2201ca32f38ede2400e9fc557b6a39360f10335d34bda381028d3eff2f40fa253d103a82c934ace677760bd8819baabe9153991e4ec4ee987444d71f19a17156be82c4fe4a1521d2ac129ff0b2cc70b5836dbbcf0aec90cdcecd91bf736751b791b5b14caaf3617bdd30effc3e09a7e27bf7887918aa490431570702fa1c8941bfb7411cdfc7cf4f895104547582693ddeb3a17962f572461b927388aa5a666ca3404932fb6e6da7ecd75f878192ccbc83812ebf3de09af5f8f070af108fbd073fcd0d07082fbd49f0cfb9cb5fda324b71e6ef635c57c4a6649b7c4e6fdd68ac8299c5ebf01c3e693277f1117676d6a45c6377613b91bce846e2dec31bde4f83b24b0ad4328f577d4cdc65ff88b47d27e5fcdb3e31dff4755fa4e8e40ab283f184d71e21dd5fa3652ddb713aed60d04c29661fedf3476e465b98c7e2e8cac8a6b2f8a614da8d78f148b2c095d35fafd30f53492d62ac76f22287a3dbb4d1f2af97898c7ab5ec22ee6fadb59edad74677285f64dace837607e8cf1b34bacb80249fc407c1c332df99e56754c9706433a53fd79ab7da8132e3e6dcd628d47e4ceb078ac1c0b85aad321d61e87198293d8405fbb74af973f87cd4d8f671503a8eb5209292026861d8d5d706658023d5cb133ff73436c7d4308360186d590fa6b8ad68f9c8adc23434ea578dae2ff9af624bea3a7d6846b8e7f10b17e61123e5af77965b36d3b45f703a53c0e74a45b41f5b9fd765a2a94150bbd316bd0cdfe5cf3fd860c41238ce0dd474cfe97424fbd8686ef96c00afb4c8f9868e518938a0b99205b8b577ab57f63cc5cfcc1f81f2d871dd6a8a12693a7ff3f45fd845068829d1d5d9863dbc40d077dc1fdd1e45ee0802c0cbe6c038596d257baeace5ded5fd838763e12e0f7b69ee7ef4a89dd06489117739e35685b1ca54debc876d6be2baf12704d5e4ccfb53def585cd88f44534cf58c35acbad49277b00ae215bd8e9e0cf3ab747623d5aeed5adc3d5357bf71d0aaca80caaadb2650a2ddf085f9dac178acb811314fe9724b9d5646ce2dc79e3966109732aa2347a4f7ccb15598a5f1b068b346d78d7b45fd4c86b9f68a4f0a233f8c51b74b44f55682ac46ff8d902bb5e29adde6dd1678b418b8ce11de711314125c8c32069fc747270f11d59528ca75b0133e45c1dee1efa7178a0c8ff0e4515f57d1af108683f3d1fa493e8fdd1768bbde83fbca2c1b7cccf5a5f60fa84b00fceb017b81cb0b62f1cc403e7d0c9df8dd9dfecc31fdbbe9b00ece99a46af2126eaa750d5757ec1c58746d69067980b3c091e4dbde3fea213079e525bcd1ab5c9457031389043ee76669861815ae7f5cb58e43d0fb8d0379729b54dfb331e61092f9e9216e5b462d6a5c8f78f01fb1bbcceb369d0dd8d4b4b7281a979c3d05156616638ee96307a0a96ab8c41612864eb2122ca2b854f6697b0653cad82c8e32101437e66ebcf3033adbfddf0a232a5c2c68ac783d58c242c6f8f4593cea416fb555de3a64202ebeb5af8e5f1c3a0bf993bee7586549ee6ccff1e211708b5d892967f9b2a1504df2a125789c3adae86db712c50cf5179a293fd06eed89c1d2d1562228ae8fef37d8ae28d663e46cac3886f92c24f8629842bff053928e3a9314e8646df9c78e8d545295276213bff4227dfa01ffb2c6cba879553655782400ae8a79331b7f762f19772e0e359e3f6ec8aa3cbaded7961baca9643b6a66f63e9b5973fa4766825f5b246d59b2bd030a1e86d11cca1914fa2e0cb4d65c7f38b0d93f5b209ef82a8e22907f9ef145b7e", 0x1000}], 0x4) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000080)={0xf0f041}) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@local}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c010000040a010400000000000000000700000804010c00c1ffc0c90bcfa5faea957bfbfe21d41f24411ed0b31014d0e41a1db4b28c918a46aa891b04f87222a82030dc40b9afc28657717dc260a8f6894590eaea0816d761ed401d3a6ee989fa9099563b2797de4ace7724747087cf03ce7c9e30a0c02078eea9eac07c2886692a11fbb3491acb969ee1e5d7da538f3463f7ec1fcea93a7fe8d115e7f86e8ec6341d1eb7662019b4885e810918ea5942a771a85fc3cf9aea748aad71c5d5cf490a9882f9134cd325bb75b1a9097f61e85a8e3b9e22130868c9fb1b1a062df446cba2066c20176e662b286ae9147230370f35e35ca7e7a2c1c6aa4ace6fe4ffcded9e38f1f2d0335fae0d79651400048008000140000070592a2302404ce545e9e3353786f19a9ba27569a0c78ada1c515a346994e8b006c5dce11ccb3fddd6049425a532ea06f949304a7500be9332fb9ef3993b46c6b3a9a99778685295511f29b5410792f3ae2596d7dbed2c1b71c328aa5940871cb404f9250f6867a866222a90b41fd3204b50aed8620ec101409e37cf8769a8d9752545c353c6b464443ff1793831470fab7b84c68b6d6997b6caf07c0f5e28522417ca1590a00407985d130455cc54d7b42c120582fac4a2f67d441eae4667e45472ab96d26780cb98a7ee33a33ed79afdbb795520763d23bee1fec706a3dafbc462c43994cc8ba1c81ceb5bf786ac47154f2773c1fe56201b9e3780cfff9e0f88f954226c9a4fbc68365820761f4ea9e428584b277db7612687d1b3db3170861597a0963ec0ebccf8ec056a49397802cdba776873a711ea67f8b38c98c8da0b37d608e9f937871505b0bdff9b90c48c579d93b2ad50ca40d56e7b757c7da8b6302d1714c4f9bc919fcecdb10fecb8d275c33f0828c8df10d37b749cfba7b57abfd31657dcccd73c19b55f43fc68aa883cb073955e9e00000000000000000000008611b0486d46fd3dfd3778fcadf0f7857113bb531467b9dfe9de67be7fbb8edd3174a1274f1cfecd133920ce82bdea71583ec50ef30dd245e168e57a339fbff4f58b75f122ff2b203f542d94ead616d2be906d3b20e98cd5b9c1f26e42e7a7619bd29c1d5f07087abb73f68489ebdd10d7acc18fe83ca18c6c3cc1a6eca16497d52cce10f932bebf40e0b532575d2bfb394f5e0d5ea99902307bfba37021340c0ff507393b6c8f5d752be1a490a80eb58805b9a3b2fc6d174459a597b7dc"], 0x12c}, 0x1, 0x0, 0x0, 0x40801}, 0x801) executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180), 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 3: socket(0x40000000015, 0x5, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socket(0xa, 0x1, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, 0x0) executing program 2: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$cgroup_int(r1, &(0x7f0000000040)=0xffffffffffffffff, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000000c0)={0x400, 0x10001, 0x3, 0xe, 0xffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000003c0)) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180)=[{0x0}], 0x1) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x5368, 0x0, 0x8000, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x207, 0xe, 0x5, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat$binfmt(r9, r7, 0x0, 0x0, 0x1000) bind$alg(r6, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) ioctl$TCFLSH(r9, 0x540b, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000403"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240048c2) r11 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r11, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r3, 0x627, 0x4c1, 0xb, 0x0, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r12, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r12, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r12, 0xc03864bc, &(0x7f0000000b80)={0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-syz_init_net_socket$llc-prctl$PR_SCHED_CORE-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-syz_io_uring_setup-socket$alg-syz_create_resource$binfmt-setsockopt$sock_int-bind$llc-openat$binfmt-close-open-execveat$binfmt-bind$alg-ioctl$TCFLSH-socket$nl_netfilter-sendmsg$NFULNL_MSG_CONFIG-accept4-syz_io_uring_submit-socket$nl_generic-io_uring_enter-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_CLIENT_CAP-ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES-ioctl$DRM_IOCTL_MODE_ATOMIC-bind$llc detailed listing: executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x5368, 0x0, 0x8000, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x207, 0xe, 0x5, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat$binfmt(r9, r7, 0x0, 0x0, 0x1000) bind$alg(r6, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) ioctl$TCFLSH(r9, 0x540b, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000403"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240048c2) r11 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r11, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r3, 0x627, 0x4c1, 0xb, 0x0, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r12, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r12, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r12, 0xc03864bc, &(0x7f0000000b80)={0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-writev-syz_open_dev$video4linux-syz_usb_connect-prlimit64-recvmmsg$unix-getpid-sched_setaffinity-vmsplice-prctl$PR_SCHED_CORE-syz_open_dev$MSR-sched_setscheduler-syz_clone-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-mount-openat$mice-ioctl$SIOCAX25DELFWD-socket$igmp6-quotactl_fd$Q_SYNC-sched_setaffinity-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-rt_sigsuspend-write$RDMA_USER_CM_CMD_CREATE_ID-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180)=[{0x0}], 0x1) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_kcm_SIOCKCMUNATTACH-socket$inet6-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_int-mmap-write$cgroup_int-prlimit64-sched_setscheduler-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_open_dev$sndctrl-ioctl$FS_IOC_FSGETXATTR-ioctl$SNDRV_CTL_IOCTL_ELEM_ADD-openat$sndseq-ioctl$VT_RESIZE-sendmsg$nl_xfrm-ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO detailed listing: executing program 0: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$cgroup_int(r1, &(0x7f0000000040)=0xffffffffffffffff, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000000c0)={0x400, 0x10001, 0x3, 0xe, 0xffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000003c0)) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route_sched-socketpair$tipc-socket$inet_tcp-prctl$PR_SCHED_CORE-sendmsg$TEAM_CMD_OPTIONS_SET-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$RDMA_USER_CM_CMD_SET_OPTION-socket$inet_sctp-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-writev-syz_open_dev$video4linux-syz_usb_connect-prlimit64-recvmmsg$unix-getpid-sched_setaffinity-vmsplice-prctl$PR_SCHED_CORE-syz_open_dev$MSR-sched_setscheduler-syz_clone-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-mount-openat$mice-ioctl$SIOCAX25DELFWD-socket$igmp6-quotactl_fd$Q_SYNC-sched_setaffinity-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-rt_sigsuspend-write$RDMA_USER_CM_CMD_CREATE_ID-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180), 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) program did not crash single: failed to extract reproducer bisect: bisecting 14 programs with base timeout 1m40s testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 24, 27, 24, 25, 15, 16, 28, 24, 24, 5, 24, 28, 29] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$nci(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d00000002000001090224000100000000090400000103000000"], 0x0) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) r2 = syz_open_procfs(0x0, 0x0) fchdir(r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2(&(0x7f0000000040), 0x0) timer_create(0x4, &(0x7f0000000180)={0x0, 0x2d, 0x0, @tid=r3}, &(0x7f00000001c0)) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x2}}, 0x14}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000070000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r7}, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0xa042, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)=""/153}, 0x20) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x2, 0x7fffffff, 0x84e1, 0x2f, 0x2006, 0x6, 0x8, 0x80ffa, 0x0, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0x32, 0x7ffffffd, 0x1ff, 0x9ea, 0xc, 0x40000, 0x8, 0x7, 0x746f, 0x48, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x9a974000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x25, 0x800, 0x5) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) writev(r0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="d8a1d7f6d33e85957476e72e9263c90c852c476295e7aae81c0efc8b0aca4fe8cafd053f4b12e937ae515ced28c74e51bde84a7006598a04c79ce495d90be7f75d25c1486e548e756fb64a3664e45093d86e248cfba5ea2e0c285d1ed971d3b8fa03cd40495a631ce54e69e81986c04c3fe0ae82a8588b96a37b6856940f943dfb3b330925575062e53fdc1b06085cfdbffd8e4d17886a", 0x97}, {&(0x7f00000002c0)="88aa5eb8ea67f17de08a90f7af78ce1dbe5d6ef4c01eae633f81d2847424a744875a03c7193ac7749e129ef8501406b4730f0d9d23aa07a781bf890f3e93d4de1076e444706ddc30c5b630183f360890d6435cab176edd635d29047ff0b5", 0x5e}, {&(0x7f0000000380)="efa9abf041e8f4f1bc3f567b779f07dd8ada29f518b160f1935de2b75c52ea3d44e322b73c1399aa3fe048833e9c1480f13dfd1123669c06861cd78902fd48d4bdd7f053810f96ca3dcbec7b1253126b0d8e8c1e4ae8daa2eb669e3bc4fd789de58a90e6a3566d1ad69a01843c4194ce4af7936fb277edfe12e0e4119c9e45ae3639e9bf285957762ad4292a18f7b9230bdca677a37ac86a575a32a5a77691c02b0c915b5777d7dde1d513eead2e263be8178eb8cc798cc4bfead61397eabe623c3bd53205ac689c2edc90113b2702d3529b8b46c67545f2aa7eb6d1bd217e4d5f945641f654e05ddcc33e62388f072dd42fe7ff1730dba0c27d074edb04ed804ae3c0392159ccf8dc5ebb59d728f3bbcdd7d73d540af47a1e03a1ec63228724eb876534c0679a2bee989c2dca458a998ea0d04a7e8b6456928a504fdcc9a1dc1dd5d3d71d0a5efa2b486445de9073b88b080e5537d1a26f396157e721fd811f946bad668f1da0d4a6b9a6e896281a5eeb4f72aa6d64a3acfb851daadcc8d83849b34d287e47b4e83a45ea0a69ed012aed1354efc885561674b92140b382a60cdf9487052f8ee1b9e838e5c29c56ee5fddea6a0050189585402057e5732252ce7f6f71917fe5b453395dfc740be8fec416b04be2d028577043b09b192079bad7b26311708b36e221226f34e7eafc5787de36d8b3ed0ec3bdc139ed42e128447b3184f00da5a1738a10f312d6be61d0fbe901a2e82bd1ca9b01ed254445317f1e30e6cad01721d698e3bd0eb8ee193d5ca419689c35352ca3f29a6a8d59242891eef7ba0dbd8a3b33dedf8e2e966be43b4802f94d0d3e46e4beb1e007a424e7626136f84f3d2cc35faf8fddcf8729da0cf9bd60c518f00f34318870033b80655e410e06aebd060ee38d43085c46f149c97647c5708f1b4d3b0512cfec07b2c1be02de66d6fe5e5093e260353493c5eeb49b6bb3d1ed0a31cc208773aac014f3d4e96ed10d57bd336b1f42a5932708f19cc513df24096de4c6341d6f9913519635fe006f733c289f81446ddbb311d99dc6b459dab5ea53a13a7c5514dc5e7bbc82946f912f2ac4eba493d4289a7008642d92c03dbd8731663374e707a9c17cc30c36be34a794946ef97892fe606b4805d1b9bb2c91455c1481169a8fcbd96c669cf0fa5b5ff11592086731fda21c6151fdc0d5f6d23d982bfeb0e52e6a3384ec2f1e093c1aa6d9362342790bb83098e0b53939744d5a32a7e262517c40f20e4dc6935ef1212db21bfdccceb63a48c61af3fe12598439225ca16ddd93e525e7cd679f491fe27aed1579836a58ad7d7a6a4dc610339ea7a1cd89f53a48563115e4821f48d243ee8edfd785c76f0ad2da73df235c183e72fa6a2ef13dec825cff403a50123c5d6bbe561f0b1e27d986157c844852f037f9923e133a66ad8e36b7e57c5a3b5e0a43cb0d89726118b1324cdb9a6dfe70e148bf492bc5eaba9cbdc3d6e49c0452bda33b859f91715c1292c041d9bc82a105d0eb04b1aa13ab1fda2620b735cb2bb7c7287e36f04b8179c730f445d3c8ae496eb4d254425474dfcb61dd8381b1e39b74b1233bf1c2bcedcb037fd530c0f267ec7074381068bd51eaafb6109b04098c6e31ca8a9f70096a592f6bf2e0fcfb26565a550e98375b105e715708eab91f160f74553b81fb0c2a510a23156a98962c20c1d2d42b6472fcd264ddcc84bf6071ca6b007d19d20acf800c21de3f800dea33fdc21160f6caab8b3738b4ed2a0bd64580def772f9993373a5c8b7821582cb78b9f95c31da0a2f8b47d47e63af29ef96492521746f9b4154246c80e80d0c4c1475982d10e60bd8c52621c5093e0cc79e7b2b696e6a7ee1a4ae609cf77b285b2b8701b9bd010a6f6329f63fda2cf5dd2d706d491e85c7bcf977edd4101080150b6963fa8c0527dff484b388b564f8d80d595965286befe5e72f8e7044bf6e6acddae59723f86c7d698e10b694656886fb5a6aedca0fc92999ef816fccc8964fe983b2e1252e3ce2d7c0cc5cec3b5ced3be963bc4096da7772b06e18dee18b5daf3a730520b06640ae3d39411fa6b33d0657e4144d361da294b2191706f80dbaa3714d63ce9512fcdecdd2b53d31a13b9c4ffb8fdf17311271a52b37c646af44f8a2224cd505dfbe1b400c6700a1f7fdb98d327dc6898887a9f6959b8f964dd09064d31a5bbcc6cc5639a78bc9ba51fbdaf34d1ef480f0deb338054521217c7ec208a91ca65aeddae0e5e9b0af34d9941a81a70dd7e5da9185e0ae3f92ca64ef6f6c83a8b0cc14fe74dff3480f6f1ac4e118f2d55ba4b65a2cd01f21872546409857851f50e307aca8be142b74967c11a5527a77097f0bff3eaa68cd38366a3972000c1401762fa350b9a7b63bf77f5e7867baa32ca7a70413cb059f259a84caa20e3da511b475a5d94f34f0c9c17d000fd37564c8dd9d31432e136a02110ea0ae7a90f57d0b8707524ac3b41b0f857ceb6efcecd4d7ff6c2b49bfb2b23857f795f25e94c63a289084c9ad16f0e65dbeb94edda348e12f31c93e56770097ce18bf8b625de138855aec86c3195af008173c91e1ecec658b46d87717e70cd6a584f89d04ae15bf2b7b15ecedf26f2cf7c2ffa1001b16408d6080a89c6bc532ff514d14ded8e8e21466d9595e11eebbb9fb38958df8184b0d6823e060dc561bbc2f39794603bb677c7c814e95295f93ece5bbc4c0f38acec4ab5b085a0ba69df2a799a70b377814ef6f2834e942f92e1498aadf4a2b99c833281a3d8db8c7bb0d8bc7db6146a854879c89c753ba041e739224fc74661101995dd567bf79af382b4adaf46b985d345b06bf54e5a8cf6b980afb18685a04463520f7d4ba907cb15f6eff9e4f221b10bad62cf8a6acee0e2693e1f8af9e2aa0b29a41f2e18cf87c440df82c54fe53ae21de6f0280751db3d4d470a3a0af94fedb1a0d059dc91168abac8989f4af81ff626914ab2d5418ae1242d4f42ce4c547d29d214123b4391e71f06421edd521f6fea9a08d109c0dbc30b8df7f91a462706abe5c6ef4eea83b8c4a5f0bb0e9b4de1863a2ca6c2997a717962386983b84ac462fb58694b64adc12afee65e0674e77a8a49044b80a3f80320c2940b4e31d53a5744fd7737b0d5e1d84042d88faf7aec7a8080e859d28e17feea3bab1bdea5fafb46ca8e8dbe04b5e0be9aa1bc44918ad411be992340f2b4ad19d556b7418683499b028211dde3aa50a0a082c69d133ea86da9f8bf588fc10d8d5b9417bc9c214cda23298cb4773d9c8a21e9ec152a0468ce976e2ab4d757c53e06e911cdcf0df650c826d83862b54834f00981dbb1b062e65d1bab9d896e4961a8676c886816c8db3d45ddf8d70a5a8343289f31feed75666ce57149b96dd2b3e42c535b65027c7e7f6041034dcd5ef4441dd73dde8ca56451f874fdfb053c8db40f89c4f4025f0dbb9b179003c2c0f342834adfab0275b1ca37904e3429e1150ee81f7a7dcd7284d2cb07d3c3fd27f2107199dc531ba7ecdaee86137c65956199225a0450517ea8968ebdbb8e410b968e9bd6c2567db300301d2476ecc301ad0aa9ea5920dc4094a76f539d102d3e478a98de48907d75cce9a6a1b4cf3d24fea5533c632045c05c3675852b19587d7b337ffead0515f9d95f6ed9ce9ba05fec41684b0c2ecfd1bf3a8ef92e479c057484b07ef5137f79fb9f22b3cef1e364f9bb75b9d64f13cfd021f61376b3805e33569a891d8405898865a804beeb40387a1e4d1b394d1881948475b4f90dfa4d558924119e4d82f96ca686c21c409b04592e4f17172b902d85ce3e899b78a5cdd52cff07a9cb1aa3a9c080eca27127e0004600cfaf4cc4d489d3f57b323543302333ec3a2eea68578b65dc9be3a6cf8b1ffb2ac7b0d30ef16ecc29c919dc311b962c97bda7f5d69b9b5f5918282d07b3440002542186b9791b797b81d23817c1f7fb112ec1c3bb2554d028035b9030ffc242d8caa382e7b2734411677796a77d77d724f2b74f9ad64134905803331842b9164f5ea497f06cc467dd1cde848c6efa8e0dbcec8702d180586dcffbe2e4b5dacb4c01f5885d1a8c7db100a7794294158c8202cd14e77169c8d15e9337b10db9c76e57254ed0efacb1e25c8bec77da6a540a52354da5e72902bf3a8c50d338443eaaf1d0ac33e3b1937ebf34d188cff462b02ad8d79e767a9169cc1309b207763c89777fc083f5e0ef9e79c3acdbab3338d532be9cc22b317f453f24a007f7245f9747af3156e6d6fba6dfe9a0f5b3cf3dc268963d886353674117b42f08cecfa5a66cb1aa54e4473676f92beaee0af5c75ae1ff240c7b334309b9b5fc293cd0d01a8bac9f464ff81fd7fbc748b8330033eca52dbf2ac49d51ca34e3ed3c19069a31395308be436cdfe25be6544eaed154fd11a5225af09cd18c5409a1962969946866edb8c79778ffac0ae019112c4063999492630e29f4331f65cfd4ae413968b8e52312e533b7ef5dfc67fbb53c4129c60b6c3b48ba3f0b8bb0f83c4c542bc2af0670f51f6511b7fbed72285647cd04ad900550163f82e4574da11836827b7a1c9669eca76e9870a4e08fa357e56e00b5a70b854a1c5b88e45d6503e545b970441e7fd71e56bfb7244e4d2eed5d8058612585322ac38d5dbdc32074a55ee21e54e994265b0e3181f0dc8059fcedebbead5037dc5dfea4d813196a43dafe410686fa2ec408964f38be3beef93c4c60bd1a396604f6c1a5c4bbbba286c3d82e2afb9d882cb09990b72ae40114f8c235ae57e92f39945992c5f81a88ee0782bee3a91ea86eab666a08635e9c11638e248ac32a3a98de2c67a0f2f79b2118d37f193e4d177a15716e059a96fc774216186e6b6034cde926784847513f804e6e4280787aa35c980d121c185a35849b36d2297f8b8d73d69fbd8f87f7c056de311319069318626a92ad33e4fec6f3ac5c0efd7ce9ab515e113779cf481840b101bccc67daf5ec64f6ce3dd56049dcde4f99b3d2895c25be47597ef1b09f1067218c2b4a31c1c915ec670c0ce294a944a9b192493db122acd59fab5e13d64261631a75362d10bbc23ede4351e6b635ff0e2726494586e0ff4a159477e2ebf6f0509bf7f4c96accfbcdcd4ca4a56ca84a9315f09391db10900400d1ceef0319d3b867ec1b0983842deb8019bf13f576e90d4a09c5a842a4e9dea973c2195ab54e346e4f066fc970e8c64c4facca40536419175bce5c0c424ea2c3384a7e84288058b05997ce78e30145f66aa42db57e2f1fb34fa22d9cfe5d34eeae7021fbdbae04db4a805d34550b5f8f598a7810d1831ea4bcada8f6168c5ec5cc99a4d36534e5b4c7e2affc909505f085763733dd7cf23b82d7c4163e96a3f259eedd9c8630fa0248ca437e6b8adfff555c63e8f568343639bb5f81d7f8a8c0be59be0adb3bc013de38b31a58913546448bddc73e27df73c01c41a25ad82db7c290b6ea9b8bb88e7b34b92ca547af0149d2b511c94470a90d2d79fb9590891b7b0fc52a01f72cb17ada27c8361ec195f1be5f48fff7cf77153c42e5e172d2b3a3231967c0652a03d0f3f46c4b4b291767bfb1128701bee188787c74b0428e9af80b4f51043b824412f95688bcdbef69fe1c4b938cfab5f70832c6f81d3ca40bfe752d0bbd00ddf36c5e4a9c4854b73d41fd1c336f59d28fae64baf6127172f", 0xfbc}, {&(0x7f0000001380)="b4d3cccd3b1fc7aa5dca5bd10a1b7274acd90b7d4047869c8bf158ca42e784fe49bdbab023e0751a66b9d32ea93c8db257c50f490eeeaeca11df2fa71d578fad0abe33eef3311720785286da47e6ebbb8cefaa89b4a650bbe6ce4158491ba630234bd325cfea81051161589e95f66de9c404d268ae55b8550cd8f4a9ba812e7adb6d641e349607e0fdb4fad67e79ba74182d7a4c46728c0dcc128dd2f65773562a20211c64b25f8ccbdcb027aa3e4ca5ad7c90490ff76170e3b0f6b57d18193c811960e2e3bdee8bdb29d4c9178fd32dc5e063ef60761ce6b22aeeee7beac7e3bb6ebeea10a7f2bbd77f2659c23e681ff0f24d19a796de32a57403cbff0004c985da3ef08acd2a49aa1e9ef5dfe4dd5db27fad5c2ea4e5b4062665a8075d6acec02a030a464a98e6a5e255cb0719b6a7b7773afb140c4bb53f05a6adf60c4c2ed6e369472fc79baebf66a66d3673dad210a5742c0c73bba32c5ded6688fba2ecf86f7adb2f3eb9a51f2f8b1dcc2c989d6d2410ed4a7d6d5c823b6cc7484db2f5d17850643303d0a869aa0346c54ec8380aad4503d78e9f9998aeb04c779eec858bc6d0f6cfa85fa56de7f88162f5d36bc87ee54f7a7cdf8bc6fe0e47a3b191ede3bdbcd70ec3aaf3e65eab07deed34085409a1282de8e6d73b5cddcada5b48f76ef476cc7b2e34138594efa8264b9627543e9b2d6be471337abfd2f615934c4855b5d7f7dd2ce25206c546c701f59e2dc36c26ee52b2e45a52cf30f8887b3401dbe21bff8ee7238cfa0c5fc76a60133f10c3ac7ae8a2bb6dca244cb0422ad5afd2f64feb07f8c8d8b6eb47ecd172de7e67f328e5bd807b21a634387219a9db8fa5dd72b04bd31d186e872ff882fa6f4fc603edbb23b6da459777f9ce04502ae25a27d533cec097d315556a1504d50009bae0c15e53e1cde1879951209e54fcd3f73e9c3934efae17ec1e89f83262597875354f859c20634674ae40419d0826f6b79ba3b53afc81f1ec1e9ca33d109a55f1b5266b2cc619b6cbdb0865880c680f76b828d6bf35c8e48c35325c4395cf6025e940bc3e083c01261367e5ff9aa1c048765bffdfca703d102be67c346238f9c5e6ffe6ee3f9dc602fd7bc3df1b311f47244f09ac403ec083269948885ba8f9e23ed27c75abcdd6b6e9fbdbb13244ceaeceadbc21db5e93edf17e0fefab4ac5a12010f682e52a6e4cbab647ecd63c6359a5e4b3b3e7c9263f452a1857f6068e0e533aa1543188243fd3303656ecc82f79c90e3405bb9d8027ec4300e7bbf7e2599423ea401a75d7d9bc0360225004d6ed2328f126ef908c482d07889478260c786b6aa8acef93da75da8511f3d54f52e7ef117fc356c6827500cb0c6d35a5941bc789ee32a758032d59e6e4f1ef056cce421a596efc6e8260cf21ceb4514472bdbcbb00645ecf61933c81a9fa2f1a5b26f5e010649daea9e81e94c9dbd2066a3e2dc5d57bbf56373c1e728a2dc54f1bb782bd0da998328324ad0459b013248629e84c7df19318791c61f073a3d05316ed580b4dabaabe536ba69122274859980d49fc18a0920fd952c0e794a23bf4a07b7817ee22653731349282b83c8a0300d07f94366597421bf6703db2938bf8e2702952c98978bd83309f9b9b97692cd8f32543f6d6c02968a5749c862bbd6acad9a9802ae208f22cc220a8d4d301ce6bca1609e571a21036c181a020326f08cceaeb1bb67cca080162a4d2080c62241555d4aa34369e9b5dfa6ececf5c981700bbf1fa58aec97b6e59976feabaf2f9c04d8fa16d3b3bdef61cb2f0bf22b0243bb059f5f0ef1375bb7f1d34b40b54a89091767a7d31c7e32257285f32d201c9bd05e2e200d1fdb04256d9c2b09bc81b40d1ddedead4c24efe5f2d138d6519239a3e51bf0cb2ba78a4af4fbe3408723178002e154a55e7abe466d28b91bdc808a10e6849dce311d01f05393c1cf6da35ba867b5f062ec02b392eaf5662d36eaa4a251f894076a358c5428fb8c60e3b84da2042a6c874574f746c2c7a4dcddb38daa6a0e265d23553165924838c3175820bebe99f03100c763fe6796895aa10642711aec9bdcd3bc8507beb99f71739fd161f258c70e704ee47d593db28f5d4929edf6309aff0d31fc3493d6fb58a547b7195dfdb3a7323a1542b5cf8913abfc8e7e47581c75ccbc82723233b843849bd9da71b02a2e083eeeb95052e288a5ba68f7fa2f63ed3f74a59222335cd677795e4858fd014a82a00de9b3cbeb49fa134ea83eb365be74245afcd81fbc7dfaa8be057fa51236a821b0be131f8b96423ce576ee03f79e703909402fb9c6664c33347ced43ec59b39480c3d77c36ae245f6ec3c4389089e614350e733080776f8f4d333729c7bd38f1d752733035b96615272322c90517333aabb1afe4ea19526734523a3b982f8e10fa6d641b825c72615fe8403d7c269473eaad26931a51fae1034a7a5e42f540f57bec0b99e2c820f1b6e4072ee16e9a4871fe6702e729121ad85c4235ae070193cc437e6c39a72f51e541a150abd43654f6375d331cc92092b93fded5bf2696d0289a8c4446df44115a788c3d17e6de8845190670e3a8aaf70fc642ad72cdc6f5444c7f0f392667f7851d57fe87ede24995a750b2778a69961817a24597196c5396262be411e7803e63c3a4ceb4137e03d9b2816e6040d0cb45fcee85d7041cb26e8bd622d6e682d813829b1d510c24c7c9ee6ff275f32fd86c7ca292d5dcbed5fa37efac06e2099933325f27e4f364b33cdc4e5680ccec8d952a04776e5381f18108da68f0c6a9ec882ae6d7f9d94c80114df135dae00fce09c7ae309068295806c5a29cb0513caf9365330e65bd3add5994e797fac6807ea3cb0e63b636d3918f44b61befb4ecafb5425a6882d15c43096e8ba72f510f5010a3db9191acab9a536ddde68dcdcf7313c41c7aa282e32be7e7542bb5ca6f15735cc1534b9835b305ae46c90030f1c4e4f606ddac700fb329e8237a67ee6e1f00d31b0ba5ba27f78c4b76e9d62386f8045f7fbecb63d5fec5c859d427a6735a18d573cefcbc425cbd3a1573e715fb49c3301c42731688c25480bf23094e6fe1206c8fac67d3ac32a18daa4b3c70067e80ab2018414a0119d2d2479c29f18ab7aea2e7616e8d1515715ffbd9ecc2f9c204833e0c15ee9c9b31b0c2a0cf4cf9de69757ec321ad6dcd53e8ba37d3ff4f6e91cdf03eca767c6e667a0623041fd089d2da8f0acbaebf122fccd51d4160dba791c684038ae9618f433f39a035322c20f1ff7df29800e246a07d7a0e0391b25f3850d157c82610864789f0e83888bed2cd8e226f7ff3885f07f37136e3e6bc25f97a7bb2c1e5e0b7a16cb12de2124bda21273bb4d4ae03dc0698446d1187305360b233b6efdc1f2e3ee97e93a306b63027e3352ee56233fe99521ca0a36bb7ddd2a5129bb5cb449765c3aaf92c820d0b1015ed9f103a1bdd1ec39fe8497145e50e786b079a4a1d31da023021d5a6061e8622e0c721bdad973ffeb66973aa3fee8b43719b84ec80eed802be5c1acd9e3fbee31905103290fb2717d3999752151d60f482cfcf467537abb3eb303b03d7bbeb3460d61b895c669646260d150db913bc31f263fe2051fbee6e2355da2dfe70d1a64de2671ceae2882d983a66df2ea44be8c767cbd4810384a1a354fe036fcc26e69161bfe18e275bea16a14965384238009c981caac0d1f3ff8b7c0d64656fe107ee31e99577700c678890e2dec1f12c8b9fbe8630f11d3a824f73be10e740f73c53c5638b76728c0cc00c616279da04346de7b1c88e2bd5ed7dc26b12812b2aa4085e23eb7e4a35bc8cab2a2e56f1f116e38a0f1ffd35c5323df7d6b79056c8198410c1b241a97d40fc06455c9e1a7df5d1bc2b07ac736f99c2ee0ff70458c3ff126e57c7494e18ed7695621607517fdb358c2b98f4e58bd63aece7f7333579f0a0ea936b7916c5560f27b0317258571b4ca2201ca32f38ede2400e9fc557b6a39360f10335d34bda381028d3eff2f40fa253d103a82c934ace677760bd8819baabe9153991e4ec4ee987444d71f19a17156be82c4fe4a1521d2ac129ff0b2cc70b5836dbbcf0aec90cdcecd91bf736751b791b5b14caaf3617bdd30effc3e09a7e27bf7887918aa490431570702fa1c8941bfb7411cdfc7cf4f895104547582693ddeb3a17962f572461b927388aa5a666ca3404932fb6e6da7ecd75f878192ccbc83812ebf3de09af5f8f070af108fbd073fcd0d07082fbd49f0cfb9cb5fda324b71e6ef635c57c4a6649b7c4e6fdd68ac8299c5ebf01c3e693277f1117676d6a45c6377613b91bce846e2dec31bde4f83b24b0ad4328f577d4cdc65ff88b47d27e5fcdb3e31dff4755fa4e8e40ab283f184d71e21dd5fa3652ddb713aed60d04c29661fedf3476e465b98c7e2e8cac8a6b2f8a614da8d78f148b2c095d35fafd30f53492d62ac76f22287a3dbb4d1f2af97898c7ab5ec22ee6fadb59edad74677285f64dace837607e8cf1b34bacb80249fc407c1c332df99e56754c9706433a53fd79ab7da8132e3e6dcd628d47e4ceb078ac1c0b85aad321d61e87198293d8405fbb74af973f87cd4d8f671503a8eb5209292026861d8d5d706658023d5cb133ff73436c7d4308360186d590fa6b8ad68f9c8adc23434ea578dae2ff9af624bea3a7d6846b8e7f10b17e61123e5af77965b36d3b45f703a53c0e74a45b41f5b9fd765a2a94150bbd316bd0cdfe5cf3fd860c41238ce0dd474cfe97424fbd8686ef96c00afb4c8f9868e518938a0b99205b8b577ab57f63cc5cfcc1f81f2d871dd6a8a12693a7ff3f45fd845068829d1d5d9863dbc40d077dc1fdd1e45ee0802c0cbe6c038596d257baeace5ded5fd838763e12e0f7b69ee7ef4a89dd06489117739e35685b1ca54debc876d6be2baf12704d5e4ccfb53def585cd88f44534cf58c35acbad49277b00ae215bd8e9e0cf3ab747623d5aeed5adc3d5357bf71d0aaca80caaadb2650a2ddf085f9dac178acb811314fe9724b9d5646ce2dc79e3966109732aa2347a4f7ccb15598a5f1b068b346d78d7b45fd4c86b9f68a4f0a233f8c51b74b44f55682ac46ff8d902bb5e29adde6dd1678b418b8ce11de711314125c8c32069fc747270f11d59528ca75b0133e45c1dee1efa7178a0c8ff0e4515f57d1af108683f3d1fa493e8fdd1768bbde83fbca2c1b7cccf5a5f60fa84b00fceb017b81cb0b62f1cc403e7d0c9df8dd9dfecc31fdbbe9b00ece99a46af2126eaa750d5757ec1c58746d69067980b3c091e4dbde3fea213079e525bcd1ab5c9457031389043ee76669861815ae7f5cb58e43d0fb8d0379729b54dfb331e61092f9e9216e5b462d6a5c8f78f01fb1bbcceb369d0dd8d4b4b7281a979c3d05156616638ee96307a0a96ab8c41612864eb2122ca2b854f6697b0653cad82c8e32101437e66ebcf3033adbfddf0a232a5c2c68ac783d58c242c6f8f4593cea416fb555de3a64202ebeb5af8e5f1c3a0bf993bee7586549ee6ccff1e211708b5d892967f9b2a1504df2a125789c3adae86db712c50cf5179a293fd06eed89c1d2d1562228ae8fef37d8ae28d663e46cac3886f92c24f8629842bff053928e3a9314e8646df9c78e8d545295276213bff4227dfa01ffb2c6cba879553655782400ae8a79331b7f762f19772e0e359e3f6ec8aa3cbaded7961baca9643b6a66f63e9b5973fa4766825f5b246d59b2bd030a1e86d11cca1914fa2e0cb4d65c7f38b0d93f5b209ef82a8e22907f9ef145b7e", 0x1000}], 0x4) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000080)={0xf0f041}) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@local}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c010000040a010400000000000000000700000804010c00c1ffc0c90bcfa5faea957bfbfe21d41f24411ed0b31014d0e41a1db4b28c918a46aa891b04f87222a82030dc40b9afc28657717dc260a8f6894590eaea0816d761ed401d3a6ee989fa9099563b2797de4ace7724747087cf03ce7c9e30a0c02078eea9eac07c2886692a11fbb3491acb969ee1e5d7da538f3463f7ec1fcea93a7fe8d115e7f86e8ec6341d1eb7662019b4885e810918ea5942a771a85fc3cf9aea748aad71c5d5cf490a9882f9134cd325bb75b1a9097f61e85a8e3b9e22130868c9fb1b1a062df446cba2066c20176e662b286ae9147230370f35e35ca7e7a2c1c6aa4ace6fe4ffcded9e38f1f2d0335fae0d79651400048008000140000070592a2302404ce545e9e3353786f19a9ba27569a0c78ada1c515a346994e8b006c5dce11ccb3fddd6049425a532ea06f949304a7500be9332fb9ef3993b46c6b3a9a99778685295511f29b5410792f3ae2596d7dbed2c1b71c328aa5940871cb404f9250f6867a866222a90b41fd3204b50aed8620ec101409e37cf8769a8d9752545c353c6b464443ff1793831470fab7b84c68b6d6997b6caf07c0f5e28522417ca1590a00407985d130455cc54d7b42c120582fac4a2f67d441eae4667e45472ab96d26780cb98a7ee33a33ed79afdbb795520763d23bee1fec706a3dafbc462c43994cc8ba1c81ceb5bf786ac47154f2773c1fe56201b9e3780cfff9e0f88f954226c9a4fbc68365820761f4ea9e428584b277db7612687d1b3db3170861597a0963ec0ebccf8ec056a49397802cdba776873a711ea67f8b38c98c8da0b37d608e9f937871505b0bdff9b90c48c579d93b2ad50ca40d56e7b757c7da8b6302d1714c4f9bc919fcecdb10fecb8d275c33f0828c8df10d37b749cfba7b57abfd31657dcccd73c19b55f43fc68aa883cb073955e9e00000000000000000000008611b0486d46fd3dfd3778fcadf0f7857113bb531467b9dfe9de67be7fbb8edd3174a1274f1cfecd133920ce82bdea71583ec50ef30dd245e168e57a339fbff4f58b75f122ff2b203f542d94ead616d2be906d3b20e98cd5b9c1f26e42e7a7619bd29c1d5f07087abb73f68489ebdd10d7acc18fe83ca18c6c3cc1a6eca16497d52cce10f932bebf40e0b532575d2bfb394f5e0d5ea99902307bfba37021340c0ff507393b6c8f5d752be1a490a80eb58805b9a3b2fc6d174459a597b7dc"], 0x12c}, 0x1, 0x0, 0x0, 0x40801}, 0x801) executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180), 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 3: socket(0x40000000015, 0x5, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socket(0xa, 0x1, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, 0x0) executing program 2: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$cgroup_int(r1, &(0x7f0000000040)=0xffffffffffffffff, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000000c0)={0x400, 0x10001, 0x3, 0xe, 0xffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000003c0)) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180)=[{0x0}], 0x1) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x5368, 0x0, 0x8000, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x207, 0xe, 0x5, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat$binfmt(r9, r7, 0x0, 0x0, 0x1000) bind$alg(r6, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) ioctl$TCFLSH(r9, 0x540b, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000403"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240048c2) r11 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r11, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r3, 0x627, 0x4c1, 0xb, 0x0, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r12, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r12, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r12, 0xc03864bc, &(0x7f0000000b80)={0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init bisect: bisecting 14 programs bisect: split chunks (needed=false): <14> bisect: split chunk #0 of len 14 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 16, 28, 24, 24, 5, 24, 28, 29] detailed listing: executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x9a974000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x25, 0x800, 0x5) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) writev(r0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="d8a1d7f6d33e85957476e72e9263c90c852c476295e7aae81c0efc8b0aca4fe8cafd053f4b12e937ae515ced28c74e51bde84a7006598a04c79ce495d90be7f75d25c1486e548e756fb64a3664e45093d86e248cfba5ea2e0c285d1ed971d3b8fa03cd40495a631ce54e69e81986c04c3fe0ae82a8588b96a37b6856940f943dfb3b330925575062e53fdc1b06085cfdbffd8e4d17886a", 0x97}, {&(0x7f00000002c0)="88aa5eb8ea67f17de08a90f7af78ce1dbe5d6ef4c01eae633f81d2847424a744875a03c7193ac7749e129ef8501406b4730f0d9d23aa07a781bf890f3e93d4de1076e444706ddc30c5b630183f360890d6435cab176edd635d29047ff0b5", 0x5e}, {&(0x7f0000000380)="efa9abf041e8f4f1bc3f567b779f07dd8ada29f518b160f1935de2b75c52ea3d44e322b73c1399aa3fe048833e9c1480f13dfd1123669c06861cd78902fd48d4bdd7f053810f96ca3dcbec7b1253126b0d8e8c1e4ae8daa2eb669e3bc4fd789de58a90e6a3566d1ad69a01843c4194ce4af7936fb277edfe12e0e4119c9e45ae3639e9bf285957762ad4292a18f7b9230bdca677a37ac86a575a32a5a77691c02b0c915b5777d7dde1d513eead2e263be8178eb8cc798cc4bfead61397eabe623c3bd53205ac689c2edc90113b2702d3529b8b46c67545f2aa7eb6d1bd217e4d5f945641f654e05ddcc33e62388f072dd42fe7ff1730dba0c27d074edb04ed804ae3c0392159ccf8dc5ebb59d728f3bbcdd7d73d540af47a1e03a1ec63228724eb876534c0679a2bee989c2dca458a998ea0d04a7e8b6456928a504fdcc9a1dc1dd5d3d71d0a5efa2b486445de9073b88b080e5537d1a26f396157e721fd811f946bad668f1da0d4a6b9a6e896281a5eeb4f72aa6d64a3acfb851daadcc8d83849b34d287e47b4e83a45ea0a69ed012aed1354efc885561674b92140b382a60cdf9487052f8ee1b9e838e5c29c56ee5fddea6a0050189585402057e5732252ce7f6f71917fe5b453395dfc740be8fec416b04be2d028577043b09b192079bad7b26311708b36e221226f34e7eafc5787de36d8b3ed0ec3bdc139ed42e128447b3184f00da5a1738a10f312d6be61d0fbe901a2e82bd1ca9b01ed254445317f1e30e6cad01721d698e3bd0eb8ee193d5ca419689c35352ca3f29a6a8d59242891eef7ba0dbd8a3b33dedf8e2e966be43b4802f94d0d3e46e4beb1e007a424e7626136f84f3d2cc35faf8fddcf8729da0cf9bd60c518f00f34318870033b80655e410e06aebd060ee38d43085c46f149c97647c5708f1b4d3b0512cfec07b2c1be02de66d6fe5e5093e260353493c5eeb49b6bb3d1ed0a31cc208773aac014f3d4e96ed10d57bd336b1f42a5932708f19cc513df24096de4c6341d6f9913519635fe006f733c289f81446ddbb311d99dc6b459dab5ea53a13a7c5514dc5e7bbc82946f912f2ac4eba493d4289a7008642d92c03dbd8731663374e707a9c17cc30c36be34a794946ef97892fe606b4805d1b9bb2c91455c1481169a8fcbd96c669cf0fa5b5ff11592086731fda21c6151fdc0d5f6d23d982bfeb0e52e6a3384ec2f1e093c1aa6d9362342790bb83098e0b53939744d5a32a7e262517c40f20e4dc6935ef1212db21bfdccceb63a48c61af3fe12598439225ca16ddd93e525e7cd679f491fe27aed1579836a58ad7d7a6a4dc610339ea7a1cd89f53a48563115e4821f48d243ee8edfd785c76f0ad2da73df235c183e72fa6a2ef13dec825cff403a50123c5d6bbe561f0b1e27d986157c844852f037f9923e133a66ad8e36b7e57c5a3b5e0a43cb0d89726118b1324cdb9a6dfe70e148bf492bc5eaba9cbdc3d6e49c0452bda33b859f91715c1292c041d9bc82a105d0eb04b1aa13ab1fda2620b735cb2bb7c7287e36f04b8179c730f445d3c8ae496eb4d254425474dfcb61dd8381b1e39b74b1233bf1c2bcedcb037fd530c0f267ec7074381068bd51eaafb6109b04098c6e31ca8a9f70096a592f6bf2e0fcfb26565a550e98375b105e715708eab91f160f74553b81fb0c2a510a23156a98962c20c1d2d42b6472fcd264ddcc84bf6071ca6b007d19d20acf800c21de3f800dea33fdc21160f6caab8b3738b4ed2a0bd64580def772f9993373a5c8b7821582cb78b9f95c31da0a2f8b47d47e63af29ef96492521746f9b4154246c80e80d0c4c1475982d10e60bd8c52621c5093e0cc79e7b2b696e6a7ee1a4ae609cf77b285b2b8701b9bd010a6f6329f63fda2cf5dd2d706d491e85c7bcf977edd4101080150b6963fa8c0527dff484b388b564f8d80d595965286befe5e72f8e7044bf6e6acddae59723f86c7d698e10b694656886fb5a6aedca0fc92999ef816fccc8964fe983b2e1252e3ce2d7c0cc5cec3b5ced3be963bc4096da7772b06e18dee18b5daf3a730520b06640ae3d39411fa6b33d0657e4144d361da294b2191706f80dbaa3714d63ce9512fcdecdd2b53d31a13b9c4ffb8fdf17311271a52b37c646af44f8a2224cd505dfbe1b400c6700a1f7fdb98d327dc6898887a9f6959b8f964dd09064d31a5bbcc6cc5639a78bc9ba51fbdaf34d1ef480f0deb338054521217c7ec208a91ca65aeddae0e5e9b0af34d9941a81a70dd7e5da9185e0ae3f92ca64ef6f6c83a8b0cc14fe74dff3480f6f1ac4e118f2d55ba4b65a2cd01f21872546409857851f50e307aca8be142b74967c11a5527a77097f0bff3eaa68cd38366a3972000c1401762fa350b9a7b63bf77f5e7867baa32ca7a70413cb059f259a84caa20e3da511b475a5d94f34f0c9c17d000fd37564c8dd9d31432e136a02110ea0ae7a90f57d0b8707524ac3b41b0f857ceb6efcecd4d7ff6c2b49bfb2b23857f795f25e94c63a289084c9ad16f0e65dbeb94edda348e12f31c93e56770097ce18bf8b625de138855aec86c3195af008173c91e1ecec658b46d87717e70cd6a584f89d04ae15bf2b7b15ecedf26f2cf7c2ffa1001b16408d6080a89c6bc532ff514d14ded8e8e21466d9595e11eebbb9fb38958df8184b0d6823e060dc561bbc2f39794603bb677c7c814e95295f93ece5bbc4c0f38acec4ab5b085a0ba69df2a799a70b377814ef6f2834e942f92e1498aadf4a2b99c833281a3d8db8c7bb0d8bc7db6146a854879c89c753ba041e739224fc74661101995dd567bf79af382b4adaf46b985d345b06bf54e5a8cf6b980afb18685a04463520f7d4ba907cb15f6eff9e4f221b10bad62cf8a6acee0e2693e1f8af9e2aa0b29a41f2e18cf87c440df82c54fe53ae21de6f0280751db3d4d470a3a0af94fedb1a0d059dc91168abac8989f4af81ff626914ab2d5418ae1242d4f42ce4c547d29d214123b4391e71f06421edd521f6fea9a08d109c0dbc30b8df7f91a462706abe5c6ef4eea83b8c4a5f0bb0e9b4de1863a2ca6c2997a717962386983b84ac462fb58694b64adc12afee65e0674e77a8a49044b80a3f80320c2940b4e31d53a5744fd7737b0d5e1d84042d88faf7aec7a8080e859d28e17feea3bab1bdea5fafb46ca8e8dbe04b5e0be9aa1bc44918ad411be992340f2b4ad19d556b7418683499b028211dde3aa50a0a082c69d133ea86da9f8bf588fc10d8d5b9417bc9c214cda23298cb4773d9c8a21e9ec152a0468ce976e2ab4d757c53e06e911cdcf0df650c826d83862b54834f00981dbb1b062e65d1bab9d896e4961a8676c886816c8db3d45ddf8d70a5a8343289f31feed75666ce57149b96dd2b3e42c535b65027c7e7f6041034dcd5ef4441dd73dde8ca56451f874fdfb053c8db40f89c4f4025f0dbb9b179003c2c0f342834adfab0275b1ca37904e3429e1150ee81f7a7dcd7284d2cb07d3c3fd27f2107199dc531ba7ecdaee86137c65956199225a0450517ea8968ebdbb8e410b968e9bd6c2567db300301d2476ecc301ad0aa9ea5920dc4094a76f539d102d3e478a98de48907d75cce9a6a1b4cf3d24fea5533c632045c05c3675852b19587d7b337ffead0515f9d95f6ed9ce9ba05fec41684b0c2ecfd1bf3a8ef92e479c057484b07ef5137f79fb9f22b3cef1e364f9bb75b9d64f13cfd021f61376b3805e33569a891d8405898865a804beeb40387a1e4d1b394d1881948475b4f90dfa4d558924119e4d82f96ca686c21c409b04592e4f17172b902d85ce3e899b78a5cdd52cff07a9cb1aa3a9c080eca27127e0004600cfaf4cc4d489d3f57b323543302333ec3a2eea68578b65dc9be3a6cf8b1ffb2ac7b0d30ef16ecc29c919dc311b962c97bda7f5d69b9b5f5918282d07b3440002542186b9791b797b81d23817c1f7fb112ec1c3bb2554d028035b9030ffc242d8caa382e7b2734411677796a77d77d724f2b74f9ad64134905803331842b9164f5ea497f06cc467dd1cde848c6efa8e0dbcec8702d180586dcffbe2e4b5dacb4c01f5885d1a8c7db100a7794294158c8202cd14e77169c8d15e9337b10db9c76e57254ed0efacb1e25c8bec77da6a540a52354da5e72902bf3a8c50d338443eaaf1d0ac33e3b1937ebf34d188cff462b02ad8d79e767a9169cc1309b207763c89777fc083f5e0ef9e79c3acdbab3338d532be9cc22b317f453f24a007f7245f9747af3156e6d6fba6dfe9a0f5b3cf3dc268963d886353674117b42f08cecfa5a66cb1aa54e4473676f92beaee0af5c75ae1ff240c7b334309b9b5fc293cd0d01a8bac9f464ff81fd7fbc748b8330033eca52dbf2ac49d51ca34e3ed3c19069a31395308be436cdfe25be6544eaed154fd11a5225af09cd18c5409a1962969946866edb8c79778ffac0ae019112c4063999492630e29f4331f65cfd4ae413968b8e52312e533b7ef5dfc67fbb53c4129c60b6c3b48ba3f0b8bb0f83c4c542bc2af0670f51f6511b7fbed72285647cd04ad900550163f82e4574da11836827b7a1c9669eca76e9870a4e08fa357e56e00b5a70b854a1c5b88e45d6503e545b970441e7fd71e56bfb7244e4d2eed5d8058612585322ac38d5dbdc32074a55ee21e54e994265b0e3181f0dc8059fcedebbead5037dc5dfea4d813196a43dafe410686fa2ec408964f38be3beef93c4c60bd1a396604f6c1a5c4bbbba286c3d82e2afb9d882cb09990b72ae40114f8c235ae57e92f39945992c5f81a88ee0782bee3a91ea86eab666a08635e9c11638e248ac32a3a98de2c67a0f2f79b2118d37f193e4d177a15716e059a96fc774216186e6b6034cde926784847513f804e6e4280787aa35c980d121c185a35849b36d2297f8b8d73d69fbd8f87f7c056de311319069318626a92ad33e4fec6f3ac5c0efd7ce9ab515e113779cf481840b101bccc67daf5ec64f6ce3dd56049dcde4f99b3d2895c25be47597ef1b09f1067218c2b4a31c1c915ec670c0ce294a944a9b192493db122acd59fab5e13d64261631a75362d10bbc23ede4351e6b635ff0e2726494586e0ff4a159477e2ebf6f0509bf7f4c96accfbcdcd4ca4a56ca84a9315f09391db10900400d1ceef0319d3b867ec1b0983842deb8019bf13f576e90d4a09c5a842a4e9dea973c2195ab54e346e4f066fc970e8c64c4facca40536419175bce5c0c424ea2c3384a7e84288058b05997ce78e30145f66aa42db57e2f1fb34fa22d9cfe5d34eeae7021fbdbae04db4a805d34550b5f8f598a7810d1831ea4bcada8f6168c5ec5cc99a4d36534e5b4c7e2affc909505f085763733dd7cf23b82d7c4163e96a3f259eedd9c8630fa0248ca437e6b8adfff555c63e8f568343639bb5f81d7f8a8c0be59be0adb3bc013de38b31a58913546448bddc73e27df73c01c41a25ad82db7c290b6ea9b8bb88e7b34b92ca547af0149d2b511c94470a90d2d79fb9590891b7b0fc52a01f72cb17ada27c8361ec195f1be5f48fff7cf77153c42e5e172d2b3a3231967c0652a03d0f3f46c4b4b291767bfb1128701bee188787c74b0428e9af80b4f51043b824412f95688bcdbef69fe1c4b938cfab5f70832c6f81d3ca40bfe752d0bbd00ddf36c5e4a9c4854b73d41fd1c336f59d28fae64baf6127172f", 0xfbc}, {&(0x7f0000001380)="b4d3cccd3b1fc7aa5dca5bd10a1b7274acd90b7d4047869c8bf158ca42e784fe49bdbab023e0751a66b9d32ea93c8db257c50f490eeeaeca11df2fa71d578fad0abe33eef3311720785286da47e6ebbb8cefaa89b4a650bbe6ce4158491ba630234bd325cfea81051161589e95f66de9c404d268ae55b8550cd8f4a9ba812e7adb6d641e349607e0fdb4fad67e79ba74182d7a4c46728c0dcc128dd2f65773562a20211c64b25f8ccbdcb027aa3e4ca5ad7c90490ff76170e3b0f6b57d18193c811960e2e3bdee8bdb29d4c9178fd32dc5e063ef60761ce6b22aeeee7beac7e3bb6ebeea10a7f2bbd77f2659c23e681ff0f24d19a796de32a57403cbff0004c985da3ef08acd2a49aa1e9ef5dfe4dd5db27fad5c2ea4e5b4062665a8075d6acec02a030a464a98e6a5e255cb0719b6a7b7773afb140c4bb53f05a6adf60c4c2ed6e369472fc79baebf66a66d3673dad210a5742c0c73bba32c5ded6688fba2ecf86f7adb2f3eb9a51f2f8b1dcc2c989d6d2410ed4a7d6d5c823b6cc7484db2f5d17850643303d0a869aa0346c54ec8380aad4503d78e9f9998aeb04c779eec858bc6d0f6cfa85fa56de7f88162f5d36bc87ee54f7a7cdf8bc6fe0e47a3b191ede3bdbcd70ec3aaf3e65eab07deed34085409a1282de8e6d73b5cddcada5b48f76ef476cc7b2e34138594efa8264b9627543e9b2d6be471337abfd2f615934c4855b5d7f7dd2ce25206c546c701f59e2dc36c26ee52b2e45a52cf30f8887b3401dbe21bff8ee7238cfa0c5fc76a60133f10c3ac7ae8a2bb6dca244cb0422ad5afd2f64feb07f8c8d8b6eb47ecd172de7e67f328e5bd807b21a634387219a9db8fa5dd72b04bd31d186e872ff882fa6f4fc603edbb23b6da459777f9ce04502ae25a27d533cec097d315556a1504d50009bae0c15e53e1cde1879951209e54fcd3f73e9c3934efae17ec1e89f83262597875354f859c20634674ae40419d0826f6b79ba3b53afc81f1ec1e9ca33d109a55f1b5266b2cc619b6cbdb0865880c680f76b828d6bf35c8e48c35325c4395cf6025e940bc3e083c01261367e5ff9aa1c048765bffdfca703d102be67c346238f9c5e6ffe6ee3f9dc602fd7bc3df1b311f47244f09ac403ec083269948885ba8f9e23ed27c75abcdd6b6e9fbdbb13244ceaeceadbc21db5e93edf17e0fefab4ac5a12010f682e52a6e4cbab647ecd63c6359a5e4b3b3e7c9263f452a1857f6068e0e533aa1543188243fd3303656ecc82f79c90e3405bb9d8027ec4300e7bbf7e2599423ea401a75d7d9bc0360225004d6ed2328f126ef908c482d07889478260c786b6aa8acef93da75da8511f3d54f52e7ef117fc356c6827500cb0c6d35a5941bc789ee32a758032d59e6e4f1ef056cce421a596efc6e8260cf21ceb4514472bdbcbb00645ecf61933c81a9fa2f1a5b26f5e010649daea9e81e94c9dbd2066a3e2dc5d57bbf56373c1e728a2dc54f1bb782bd0da998328324ad0459b013248629e84c7df19318791c61f073a3d05316ed580b4dabaabe536ba69122274859980d49fc18a0920fd952c0e794a23bf4a07b7817ee22653731349282b83c8a0300d07f94366597421bf6703db2938bf8e2702952c98978bd83309f9b9b97692cd8f32543f6d6c02968a5749c862bbd6acad9a9802ae208f22cc220a8d4d301ce6bca1609e571a21036c181a020326f08cceaeb1bb67cca080162a4d2080c62241555d4aa34369e9b5dfa6ececf5c981700bbf1fa58aec97b6e59976feabaf2f9c04d8fa16d3b3bdef61cb2f0bf22b0243bb059f5f0ef1375bb7f1d34b40b54a89091767a7d31c7e32257285f32d201c9bd05e2e200d1fdb04256d9c2b09bc81b40d1ddedead4c24efe5f2d138d6519239a3e51bf0cb2ba78a4af4fbe3408723178002e154a55e7abe466d28b91bdc808a10e6849dce311d01f05393c1cf6da35ba867b5f062ec02b392eaf5662d36eaa4a251f894076a358c5428fb8c60e3b84da2042a6c874574f746c2c7a4dcddb38daa6a0e265d23553165924838c3175820bebe99f03100c763fe6796895aa10642711aec9bdcd3bc8507beb99f71739fd161f258c70e704ee47d593db28f5d4929edf6309aff0d31fc3493d6fb58a547b7195dfdb3a7323a1542b5cf8913abfc8e7e47581c75ccbc82723233b843849bd9da71b02a2e083eeeb95052e288a5ba68f7fa2f63ed3f74a59222335cd677795e4858fd014a82a00de9b3cbeb49fa134ea83eb365be74245afcd81fbc7dfaa8be057fa51236a821b0be131f8b96423ce576ee03f79e703909402fb9c6664c33347ced43ec59b39480c3d77c36ae245f6ec3c4389089e614350e733080776f8f4d333729c7bd38f1d752733035b96615272322c90517333aabb1afe4ea19526734523a3b982f8e10fa6d641b825c72615fe8403d7c269473eaad26931a51fae1034a7a5e42f540f57bec0b99e2c820f1b6e4072ee16e9a4871fe6702e729121ad85c4235ae070193cc437e6c39a72f51e541a150abd43654f6375d331cc92092b93fded5bf2696d0289a8c4446df44115a788c3d17e6de8845190670e3a8aaf70fc642ad72cdc6f5444c7f0f392667f7851d57fe87ede24995a750b2778a69961817a24597196c5396262be411e7803e63c3a4ceb4137e03d9b2816e6040d0cb45fcee85d7041cb26e8bd622d6e682d813829b1d510c24c7c9ee6ff275f32fd86c7ca292d5dcbed5fa37efac06e2099933325f27e4f364b33cdc4e5680ccec8d952a04776e5381f18108da68f0c6a9ec882ae6d7f9d94c80114df135dae00fce09c7ae309068295806c5a29cb0513caf9365330e65bd3add5994e797fac6807ea3cb0e63b636d3918f44b61befb4ecafb5425a6882d15c43096e8ba72f510f5010a3db9191acab9a536ddde68dcdcf7313c41c7aa282e32be7e7542bb5ca6f15735cc1534b9835b305ae46c90030f1c4e4f606ddac700fb329e8237a67ee6e1f00d31b0ba5ba27f78c4b76e9d62386f8045f7fbecb63d5fec5c859d427a6735a18d573cefcbc425cbd3a1573e715fb49c3301c42731688c25480bf23094e6fe1206c8fac67d3ac32a18daa4b3c70067e80ab2018414a0119d2d2479c29f18ab7aea2e7616e8d1515715ffbd9ecc2f9c204833e0c15ee9c9b31b0c2a0cf4cf9de69757ec321ad6dcd53e8ba37d3ff4f6e91cdf03eca767c6e667a0623041fd089d2da8f0acbaebf122fccd51d4160dba791c684038ae9618f433f39a035322c20f1ff7df29800e246a07d7a0e0391b25f3850d157c82610864789f0e83888bed2cd8e226f7ff3885f07f37136e3e6bc25f97a7bb2c1e5e0b7a16cb12de2124bda21273bb4d4ae03dc0698446d1187305360b233b6efdc1f2e3ee97e93a306b63027e3352ee56233fe99521ca0a36bb7ddd2a5129bb5cb449765c3aaf92c820d0b1015ed9f103a1bdd1ec39fe8497145e50e786b079a4a1d31da023021d5a6061e8622e0c721bdad973ffeb66973aa3fee8b43719b84ec80eed802be5c1acd9e3fbee31905103290fb2717d3999752151d60f482cfcf467537abb3eb303b03d7bbeb3460d61b895c669646260d150db913bc31f263fe2051fbee6e2355da2dfe70d1a64de2671ceae2882d983a66df2ea44be8c767cbd4810384a1a354fe036fcc26e69161bfe18e275bea16a14965384238009c981caac0d1f3ff8b7c0d64656fe107ee31e99577700c678890e2dec1f12c8b9fbe8630f11d3a824f73be10e740f73c53c5638b76728c0cc00c616279da04346de7b1c88e2bd5ed7dc26b12812b2aa4085e23eb7e4a35bc8cab2a2e56f1f116e38a0f1ffd35c5323df7d6b79056c8198410c1b241a97d40fc06455c9e1a7df5d1bc2b07ac736f99c2ee0ff70458c3ff126e57c7494e18ed7695621607517fdb358c2b98f4e58bd63aece7f7333579f0a0ea936b7916c5560f27b0317258571b4ca2201ca32f38ede2400e9fc557b6a39360f10335d34bda381028d3eff2f40fa253d103a82c934ace677760bd8819baabe9153991e4ec4ee987444d71f19a17156be82c4fe4a1521d2ac129ff0b2cc70b5836dbbcf0aec90cdcecd91bf736751b791b5b14caaf3617bdd30effc3e09a7e27bf7887918aa490431570702fa1c8941bfb7411cdfc7cf4f895104547582693ddeb3a17962f572461b927388aa5a666ca3404932fb6e6da7ecd75f878192ccbc83812ebf3de09af5f8f070af108fbd073fcd0d07082fbd49f0cfb9cb5fda324b71e6ef635c57c4a6649b7c4e6fdd68ac8299c5ebf01c3e693277f1117676d6a45c6377613b91bce846e2dec31bde4f83b24b0ad4328f577d4cdc65ff88b47d27e5fcdb3e31dff4755fa4e8e40ab283f184d71e21dd5fa3652ddb713aed60d04c29661fedf3476e465b98c7e2e8cac8a6b2f8a614da8d78f148b2c095d35fafd30f53492d62ac76f22287a3dbb4d1f2af97898c7ab5ec22ee6fadb59edad74677285f64dace837607e8cf1b34bacb80249fc407c1c332df99e56754c9706433a53fd79ab7da8132e3e6dcd628d47e4ceb078ac1c0b85aad321d61e87198293d8405fbb74af973f87cd4d8f671503a8eb5209292026861d8d5d706658023d5cb133ff73436c7d4308360186d590fa6b8ad68f9c8adc23434ea578dae2ff9af624bea3a7d6846b8e7f10b17e61123e5af77965b36d3b45f703a53c0e74a45b41f5b9fd765a2a94150bbd316bd0cdfe5cf3fd860c41238ce0dd474cfe97424fbd8686ef96c00afb4c8f9868e518938a0b99205b8b577ab57f63cc5cfcc1f81f2d871dd6a8a12693a7ff3f45fd845068829d1d5d9863dbc40d077dc1fdd1e45ee0802c0cbe6c038596d257baeace5ded5fd838763e12e0f7b69ee7ef4a89dd06489117739e35685b1ca54debc876d6be2baf12704d5e4ccfb53def585cd88f44534cf58c35acbad49277b00ae215bd8e9e0cf3ab747623d5aeed5adc3d5357bf71d0aaca80caaadb2650a2ddf085f9dac178acb811314fe9724b9d5646ce2dc79e3966109732aa2347a4f7ccb15598a5f1b068b346d78d7b45fd4c86b9f68a4f0a233f8c51b74b44f55682ac46ff8d902bb5e29adde6dd1678b418b8ce11de711314125c8c32069fc747270f11d59528ca75b0133e45c1dee1efa7178a0c8ff0e4515f57d1af108683f3d1fa493e8fdd1768bbde83fbca2c1b7cccf5a5f60fa84b00fceb017b81cb0b62f1cc403e7d0c9df8dd9dfecc31fdbbe9b00ece99a46af2126eaa750d5757ec1c58746d69067980b3c091e4dbde3fea213079e525bcd1ab5c9457031389043ee76669861815ae7f5cb58e43d0fb8d0379729b54dfb331e61092f9e9216e5b462d6a5c8f78f01fb1bbcceb369d0dd8d4b4b7281a979c3d05156616638ee96307a0a96ab8c41612864eb2122ca2b854f6697b0653cad82c8e32101437e66ebcf3033adbfddf0a232a5c2c68ac783d58c242c6f8f4593cea416fb555de3a64202ebeb5af8e5f1c3a0bf993bee7586549ee6ccff1e211708b5d892967f9b2a1504df2a125789c3adae86db712c50cf5179a293fd06eed89c1d2d1562228ae8fef37d8ae28d663e46cac3886f92c24f8629842bff053928e3a9314e8646df9c78e8d545295276213bff4227dfa01ffb2c6cba879553655782400ae8a79331b7f762f19772e0e359e3f6ec8aa3cbaded7961baca9643b6a66f63e9b5973fa4766825f5b246d59b2bd030a1e86d11cca1914fa2e0cb4d65c7f38b0d93f5b209ef82a8e22907f9ef145b7e", 0x1000}], 0x4) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000080)={0xf0f041}) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@local}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c010000040a010400000000000000000700000804010c00c1ffc0c90bcfa5faea957bfbfe21d41f24411ed0b31014d0e41a1db4b28c918a46aa891b04f87222a82030dc40b9afc28657717dc260a8f6894590eaea0816d761ed401d3a6ee989fa9099563b2797de4ace7724747087cf03ce7c9e30a0c02078eea9eac07c2886692a11fbb3491acb969ee1e5d7da538f3463f7ec1fcea93a7fe8d115e7f86e8ec6341d1eb7662019b4885e810918ea5942a771a85fc3cf9aea748aad71c5d5cf490a9882f9134cd325bb75b1a9097f61e85a8e3b9e22130868c9fb1b1a062df446cba2066c20176e662b286ae9147230370f35e35ca7e7a2c1c6aa4ace6fe4ffcded9e38f1f2d0335fae0d79651400048008000140000070592a2302404ce545e9e3353786f19a9ba27569a0c78ada1c515a346994e8b006c5dce11ccb3fddd6049425a532ea06f949304a7500be9332fb9ef3993b46c6b3a9a99778685295511f29b5410792f3ae2596d7dbed2c1b71c328aa5940871cb404f9250f6867a866222a90b41fd3204b50aed8620ec101409e37cf8769a8d9752545c353c6b464443ff1793831470fab7b84c68b6d6997b6caf07c0f5e28522417ca1590a00407985d130455cc54d7b42c120582fac4a2f67d441eae4667e45472ab96d26780cb98a7ee33a33ed79afdbb795520763d23bee1fec706a3dafbc462c43994cc8ba1c81ceb5bf786ac47154f2773c1fe56201b9e3780cfff9e0f88f954226c9a4fbc68365820761f4ea9e428584b277db7612687d1b3db3170861597a0963ec0ebccf8ec056a49397802cdba776873a711ea67f8b38c98c8da0b37d608e9f937871505b0bdff9b90c48c579d93b2ad50ca40d56e7b757c7da8b6302d1714c4f9bc919fcecdb10fecb8d275c33f0828c8df10d37b749cfba7b57abfd31657dcccd73c19b55f43fc68aa883cb073955e9e00000000000000000000008611b0486d46fd3dfd3778fcadf0f7857113bb531467b9dfe9de67be7fbb8edd3174a1274f1cfecd133920ce82bdea71583ec50ef30dd245e168e57a339fbff4f58b75f122ff2b203f542d94ead616d2be906d3b20e98cd5b9c1f26e42e7a7619bd29c1d5f07087abb73f68489ebdd10d7acc18fe83ca18c6c3cc1a6eca16497d52cce10f932bebf40e0b532575d2bfb394f5e0d5ea99902307bfba37021340c0ff507393b6c8f5d752be1a490a80eb58805b9a3b2fc6d174459a597b7dc"], 0x12c}, 0x1, 0x0, 0x0, 0x40801}, 0x801) executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180), 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 3: socket(0x40000000015, 0x5, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socket(0xa, 0x1, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, 0x0) executing program 2: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$cgroup_int(r1, &(0x7f0000000040)=0xffffffffffffffff, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000000c0)={0x400, 0x10001, 0x3, 0xe, 0xffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000003c0)) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180)=[{0x0}], 0x1) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x5368, 0x0, 0x8000, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x207, 0xe, 0x5, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat$binfmt(r9, r7, 0x0, 0x0, 0x1000) bind$alg(r6, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) ioctl$TCFLSH(r9, 0x540b, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000403"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240048c2) r11 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r11, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r3, 0x627, 0x4c1, 0xb, 0x0, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r12, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r12, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r12, 0xc03864bc, &(0x7f0000000b80)={0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 24, 27, 24, 25, 5, 24, 28, 29] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$nci(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d00000002000001090224000100000000090400000103000000"], 0x0) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) r2 = syz_open_procfs(0x0, 0x0) fchdir(r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2(&(0x7f0000000040), 0x0) timer_create(0x4, &(0x7f0000000180)={0x0, 0x2d, 0x0, @tid=r3}, &(0x7f00000001c0)) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x2}}, 0x14}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000070000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r7}, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0xa042, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)=""/153}, 0x20) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x2, 0x7fffffff, 0x84e1, 0x2f, 0x2006, 0x6, 0x8, 0x80ffa, 0x0, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0x32, 0x7ffffffd, 0x1ff, 0x9ea, 0xc, 0x40000, 0x8, 0x7, 0x746f, 0x48, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) executing program 3: socket(0x40000000015, 0x5, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socket(0xa, 0x1, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, 0x0) executing program 2: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$cgroup_int(r1, &(0x7f0000000040)=0xffffffffffffffff, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000000c0)={0x400, 0x10001, 0x3, 0xe, 0xffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000003c0)) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001180)=[{0x0}], 0x1) syz_open_dev$video4linux(&(0x7f0000000040), 0x80000000000006, 0x82) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x11000, &(0x7f0000001a00)) r1 = getpid() sched_setaffinity(r1, 0xfffffffffffffea4, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80082) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null}) r4 = socket$igmp6(0xa, 0x3, 0x2) quotactl_fd$Q_SYNC(r4, 0xffffffff80000102, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x2, 0x2}}, 0x20) rt_sigsuspend(0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200), 0x2, 0x7760e7b8f80efdb7}}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff0000}]}) executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x5368, 0x0, 0x8000, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x207, 0xe, 0x5, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat$binfmt(r9, r7, 0x0, 0x0, 0x1000) bind$alg(r6, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) ioctl$TCFLSH(r9, 0x540b, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000403"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240048c2) r11 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r11, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r3, 0x627, 0x4c1, 0xb, 0x0, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r12, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r12, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r12, 0xc03864bc, &(0x7f0000000b80)={0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 24, 27, 24, 25] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$nci(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d00000002000001090224000100000000090400000103000000"], 0x0) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) r2 = syz_open_procfs(0x0, 0x0) fchdir(r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2(&(0x7f0000000040), 0x0) timer_create(0x4, &(0x7f0000000180)={0x0, 0x2d, 0x0, @tid=r3}, &(0x7f00000001c0)) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x2}}, 0x14}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000070000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r7}, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0xa042, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)=""/153}, 0x20) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x2, 0x7fffffff, 0x84e1, 0x2f, 0x2006, 0x6, 0x8, 0x80ffa, 0x0, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0x32, 0x7ffffffd, 0x1ff, 0x9ea, 0xc, 0x40000, 0x8, 0x7, 0x746f, 0x48, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 25] detailed listing: executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_io_uring_setup(0x49b, &(0x7f0000000440)={0x0, 0x237b, 0x400, 0x0, 0x28f}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x3c}}, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route-pwritev2-syz_usb_control_io$cdc_ecm-sched_setscheduler-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ecm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route-pwritev2-syz_usb_control_io$cdc_ecm-sched_setscheduler-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ecm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init bisect: concatenation succeeded found reproducer with 25 syscalls minimizing guilty program testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route-pwritev2-syz_usb_control_io$cdc_ecm-sched_setscheduler-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route-pwritev2-syz_usb_control_io$cdc_ecm-sched_setscheduler detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route-pwritev2-syz_usb_control_io$cdc_ecm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route-pwritev2 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pwritev2(r7, &(0x7f0000001040), 0x0, 0x800, 0x9, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc-socket$nl_route detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg-sendmsg$tipc detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc-recvmsg detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE-socketpair$tipc detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap-setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0xc, 0x8001}, 0x8) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program crashed: lost connection to test machine testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-write$RDMA_USER_CM_CMD_BIND detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_SET_OPTION-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-openat$rdma_cm-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, 0xffffffffffffffff, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-write$RDMA_USER_CM_CMD_CREATE_ID-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-sendmmsg$unix-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-connect$unix-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-socketpair$unix-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program did not crash testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x10, @private1, 0x7}}}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init extracting C reproducer testing compiled C program (duration=1m57.31453175s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init simplifying C reproducer testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program did not crash testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init validation run: crashed=true testing program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init validation run: crashed=true testing program (duration=1m57.31453175s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-recvmmsg-write$RDMA_USER_CM_CMD_CREATE_ID-openat$nullb-dup-write$RDMA_USER_CM_CMD_BIND-mmap detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x4, 0xb6, 0x65, 0x20, 0x413, 0x6023, 0x31ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x40, [{{0x9, 0x4, 0xa1, 0x7, 0x1, 0xb8, 0x3b, 0xfc, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r1 = dup(r0) write$RDMA_USER_CM_CMD_BIND(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init validation run: crashed=true reproducing took 1h36m46.826373818s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 Read of size 8 at addr ffff88807bb84748 by task v4l_id/6510 CPU: 1 UID: 0 PID: 6510 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x156/0x4c9 mm/kasan/report.c:482 kasan_report+0xdf/0x1e0 mm/kasan/report.c:595 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 v4l2_fh_open+0x64/0xa0 drivers/media/v4l2-core/v4l2-fh.c:64 em28xx_v4l2_open+0x11e/0x570 drivers/media/usb/em28xx/em28xx-video.c:2153 v4l2_open+0x1d2/0x490 drivers/media/v4l2-core/v4l2-dev.c:433 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4671 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4830 do_file_open+0x20e/0x430 fs/namei.c:4859 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f891b8a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffd3037cb90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f891bfd9880 RCX: 00007f891b8a7407 RDX: 0000000000000000 RSI: 00007ffd3037df1b RDI: ffffffffffffff9c RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffd3037cde0 R14: 00007f891c140000 R15: 0000562582ce84d8 Allocated by task 9: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] em28xx_v4l2_init.cold+0x94/0x3503 drivers/media/usb/em28xx/em28xx-video.c:2532 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x80 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 9: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2687 [inline] slab_free mm/slub.c:6124 [inline] kfree+0x1f6/0x6b0 mm/slub.c:6442 kref_put.isra.0+0x56/0x90 include/linux/kref.h:65 em28xx_v4l2_init.cold+0x280/0x3503 drivers/media/usb/em28xx/em28xx-video.c:2901 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x80 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88807bb84000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 1864 bytes inside of freed 8192-byte region [ffff88807bb84000, ffff88807bb86000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bb80 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe3b280 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe3b280 dead000000000100 dead000000000122 head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 00fff00000000003 ffffea0001eee001 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5852, tgid 5852 (syz-executor), ts 65720159947, free_ts 50369426882 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889 prep_new_page mm/page_alloc.c:1897 [inline] get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3962 __alloc_frozen_pages_noprof+0x27c/0x2ba0 mm/page_alloc.c:5250 alloc_slab_page mm/slub.c:3255 [inline] allocate_slab mm/slub.c:3444 [inline] new_slab+0xa6/0x6d0 mm/slub.c:3502 refill_objects+0x26b/0x400 mm/slub.c:7134 refill_sheaf mm/slub.c:2804 [inline] alloc_full_sheaf mm/slub.c:2825 [inline] __pcs_replace_empty_main+0x19f/0x600 mm/slub.c:4588 alloc_from_pcs mm/slub.c:4681 [inline] slab_alloc_node mm/slub.c:4815 [inline] __do_kmalloc_node mm/slub.c:5218 [inline] __kmalloc_noprof+0x688/0x850 mm/slub.c:5231 kmalloc_noprof include/linux/slab.h:966 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] ops_init+0x77/0x5f0 net/core/net_namespace.c:127 setup_net+0x118/0x3a0 net/core/net_namespace.c:446 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:581 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:130 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x455/0xab0 kernel/fork.c:3174 __do_sys_unshare kernel/fork.c:3245 [inline] __se_sys_unshare kernel/fork.c:3243 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3243 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5727 tgid 5727 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1433 [inline] __free_frozen_pages+0x7e1/0x10d0 mm/page_alloc.c:2978 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4501 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4837 alloc_buffer_head+0x21/0x140 fs/buffer.c:3027 folio_alloc_buffers+0x2a0/0x8f0 fs/buffer.c:933 create_empty_buffers+0x3a/0x660 fs/buffer.c:1689 ext4_block_write_begin+0xd85/0x1530 fs/ext4/inode.c:1178 ext4_da_write_begin+0x646/0xd70 fs/ext4/inode.c:3146 generic_perform_write+0x292/0xa40 mm/filemap.c:4314 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:300 ext4_file_write_iter+0xa2f/0x1d40 fs/ext4/file.c:719 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 Memory state around the buggy address: ffff88807bb84600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807bb84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807bb84700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807bb84780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807bb84800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 Read of size 8 at addr ffff88807bb84748 by task v4l_id/6510 CPU: 1 UID: 0 PID: 6510 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x156/0x4c9 mm/kasan/report.c:482 kasan_report+0xdf/0x1e0 mm/kasan/report.c:595 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 v4l2_fh_open+0x64/0xa0 drivers/media/v4l2-core/v4l2-fh.c:64 em28xx_v4l2_open+0x11e/0x570 drivers/media/usb/em28xx/em28xx-video.c:2153 v4l2_open+0x1d2/0x490 drivers/media/v4l2-core/v4l2-dev.c:433 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4671 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4830 do_file_open+0x20e/0x430 fs/namei.c:4859 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f891b8a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffd3037cb90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f891bfd9880 RCX: 00007f891b8a7407 RDX: 0000000000000000 RSI: 00007ffd3037df1b RDI: ffffffffffffff9c RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffd3037cde0 R14: 00007f891c140000 R15: 0000562582ce84d8 Allocated by task 9: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] em28xx_v4l2_init.cold+0x94/0x3503 drivers/media/usb/em28xx/em28xx-video.c:2532 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x80 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 9: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2687 [inline] slab_free mm/slub.c:6124 [inline] kfree+0x1f6/0x6b0 mm/slub.c:6442 kref_put.isra.0+0x56/0x90 include/linux/kref.h:65 em28xx_v4l2_init.cold+0x280/0x3503 drivers/media/usb/em28xx/em28xx-video.c:2901 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x80 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88807bb84000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 1864 bytes inside of freed 8192-byte region [ffff88807bb84000, ffff88807bb86000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bb80 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe3b280 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe3b280 dead000000000100 dead000000000122 head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 00fff00000000003 ffffea0001eee001 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5852, tgid 5852 (syz-executor), ts 65720159947, free_ts 50369426882 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889 prep_new_page mm/page_alloc.c:1897 [inline] get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3962 __alloc_frozen_pages_noprof+0x27c/0x2ba0 mm/page_alloc.c:5250 alloc_slab_page mm/slub.c:3255 [inline] allocate_slab mm/slub.c:3444 [inline] new_slab+0xa6/0x6d0 mm/slub.c:3502 refill_objects+0x26b/0x400 mm/slub.c:7134 refill_sheaf mm/slub.c:2804 [inline] alloc_full_sheaf mm/slub.c:2825 [inline] __pcs_replace_empty_main+0x19f/0x600 mm/slub.c:4588 alloc_from_pcs mm/slub.c:4681 [inline] slab_alloc_node mm/slub.c:4815 [inline] __do_kmalloc_node mm/slub.c:5218 [inline] __kmalloc_noprof+0x688/0x850 mm/slub.c:5231 kmalloc_noprof include/linux/slab.h:966 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] ops_init+0x77/0x5f0 net/core/net_namespace.c:127 setup_net+0x118/0x3a0 net/core/net_namespace.c:446 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:581 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:130 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x455/0xab0 kernel/fork.c:3174 __do_sys_unshare kernel/fork.c:3245 [inline] __se_sys_unshare kernel/fork.c:3243 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3243 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5727 tgid 5727 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1433 [inline] __free_frozen_pages+0x7e1/0x10d0 mm/page_alloc.c:2978 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4501 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4837 alloc_buffer_head+0x21/0x140 fs/buffer.c:3027 folio_alloc_buffers+0x2a0/0x8f0 fs/buffer.c:933 create_empty_buffers+0x3a/0x660 fs/buffer.c:1689 ext4_block_write_begin+0xd85/0x1530 fs/ext4/inode.c:1178 ext4_da_write_begin+0x646/0xd70 fs/ext4/inode.c:3146 generic_perform_write+0x292/0xa40 mm/filemap.c:4314 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:300 ext4_file_write_iter+0xa2f/0x1d40 fs/ext4/file.c:719 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 Memory state around the buggy address: ffff88807bb84600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807bb84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807bb84700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807bb84780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807bb84800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================